Privacy
Last updated 2026-11-09.
Treadentials is a product of BitRey LLC. On this page, “we” and “us” mean BitRey LLC. It covers this site, the app at treadentials.app and the services behind them.
In short
- Today your ride file is read on your device. The card is drawn there. If a feature needs more of the ride, this page will say so first.
- The way out of every ride’s start and back to its finish, within 300 m of each, is hidden by default. A pass by the start in the middle of a ride is drawn.
- A card made with a credit sends us the trimmed line; we draw the file, send it back and keep nothing.
- We keep your account, your credits and a few counts. Cards only if you turn on the cloud library.
- Paddle takes payments. We never see your card.
- No selling, no tracking. Export your data or delete your account from the app at any time.
The detail is below.
Who we are
BitRey LLC runs Treadentials and decides how your data is used. Under the EU’s and the UK’s GDPR, it is the controller. Write to us at privacy@treadentials.com, or by post to BitRey LLC, 7533 S Center View Ct, Ste N, West Jordan, UT 84084, USA.
Your ride file
When you drop a FIT, GPX or TCX file into Treadentials, the app reads it in your browser (or, later, in our phone apps), on your device. It cleans the track, hides the ends, simplifies the line to at most 3,000 points and works out the numbers on the card. Then it drops the file. Today the file isn’t sent to us, and we have no copy of it.
This will change as we add features: power, heart rate, speed and cadence on a card, say, or a card you start on your phone and finish on your computer. When a feature sends us more of a ride, or keeps it, we’ll update this page before it does. What we keep is kept for your account only, for the reason given here, and you can delete it.
The ends: a card leaves out the way out of the start and the way back to the finish, the line until it is 300 m from either, so it doesn’t point to your home or wherever you start. If the ride passes back within 300 m of its start or finish in the middle, that part is drawn, and someone who looks closely could work out where the start is. You can turn hiding off for one ride, or for every ride in your account.
What reaches our servers, and when
Terrain
To draw the ground under your route, your device asks us for terrain tiles. A tile request names only the tile (a square of the map), never your route or anything worked out from it. We don’t keep a record of which tiles an account asked for. Tiles are public terrain, so one cache of them serves everyone; it holds ground, not routes.
A free picture
A free card is drawn on your device. We get a count, to keep to the free limit (3 a day): that you made a picture, not what it shows.
A card made with a credit
For its full-size PNG, SVG or PDF, your device sends us the trimmed, simplified line (ends already hidden), the card’s settings and the format. Our service draws the file, checks it and sends it back. We don’t keep the line or the file, and we never write a request’s contents to our logs. We keep that a credit was spent, and the day: not what the card shows.
The cloud library (off until you turn it on)
If you turn it on, we keep each card you save: its settings, its words and numbers (title, sport, date, length and climb, for search) and a small picture of the card, which shows the route as drawn. We still don’t keep your file or the line. You can delete any entry, or turn the library off and delete it all.
Connections (every account)
If you connect Ride with GPS, Wahoo or intervals.icu, we keep the sign-in it gives us (an access token, and for Wahoo a refresh token and Wahoo’s number for your account), encrypted, until you disconnect. When you list your rides, we pass the titles, dates and lengths to your device and keep none of them. When you pick a ride, its file goes to your device (through our server only where your device can’t fetch it itself, and then as a stream we don’t store or log), and your device reads it like any other file. We never keep a ride’s file, its route or its location from a connection.
Wahoo: we ask only to read your Wahoo profile and your workouts, and we send nothing into Wahoo. Under Wahoo’s terms, Wahoo may use any Developer Application Data sent into the Wahoo Platform for any business purpose, in line with Wahoo’s Privacy Policy. You can manage your Wahoo account, and take Treadentials off it, on Wahoo’s side at any time; we then delete the connection the next time we try to use it.
When you disconnect a service or delete your account, we also ask that service to revoke our access, and delete the sign-in at once. If Wahoo asks us to delete data, we do so within 48 hours.
A public heatmap
There isn’t one. If we ever build one, adding your rides to it will be off until you turn it on, and you’ll be able to leave any ride out. Ends stay hidden.
Your account
You sign in with a link sent to your email, or with Google or Apple. No password. The account holds your email address, your name if you give one (or Google or Apple passes it to us), your credits and your settings.
If you buy a family or team pack, or join one by its link, we keep who is in it, any limit the buyer set for each member and how many credits each has spent. The buyer sees each member’s name (or email, if they gave no name), limit and count. Never their rides or cards.
Each device you sign in on keeps a session, with the name of its browser and system (such as “Chrome on Android”) so you can see where you’re signed in. We don’t store your IP address with it.
When you ask for a sign-in link, your address is used to send that email, through our email provider, Cloudflare. To limit how many links can be asked for, we keep a keyed hash of your address (not the address itself) for a day. We use your address only to sign you in and to write to you about your account or credits: no marketing list, and no sale or sharing with advertisers.
Feedback you send
The app’s Feedback button sends us a short note: a number you’d like to see, an idea or a problem. You need to be signed in. We keep the note, its kind, the day (not the time), whether you have credits, the card’s sport, the screen you were on and your platform. Never your ride, your route, a place or a file. We never write a note to our logs. We use notes only to decide what to build and to fix problems.
Notes are in your data export, and go when you delete your account. Otherwise we delete each note after two years (730 days).
What we keep
| What | Where | For how long |
|---|---|---|
| Your email, name and settings | Our database (Cloudflare D1) | While your account exists |
| Sign-in sessions, with each device’s browser name | Our database | Until you sign out or the session ends |
| A keyed hash of your email, to limit sign-in links | Our database | A day |
| Your credits: each pack you bought, where, Paddle’s ids for it, and the day each credit was spent | Our database | While your account exists |
| A family or team pack’s members, their limits and counts | Our database | While the pack has credits or members, or until its buyer deletes their account |
| Counts of the pictures you made, per day | Our database | 90 days |
| Connection sign-ins (tokens, and Wahoo’s number for your account), encrypted | Our database | Until you disconnect, delete your account, or take Treadentials off on the service’s side |
| Library entries and their pictures | Our database and storage (Cloudflare R2) | Only once you turn the library on, until you delete them |
| Feedback notes | Our database | Two years (730 days), or until you delete your account |
| The record of each purchase: your email, the amount, the date, the tax country | Paddle | As long as tax law requires, typically several years |
| Your ride file, your route, the line | Nowhere | Never kept |
Payments
Paddle (Paddle.com Market Limited) sells Treadentials credit packs to you as our reseller and merchant of record. Paddle takes your payment details, works out tax and sends your receipts. We never see or store your card number.
When a payment or refund happens, Paddle tells our server, which adds or removes your credits. Paddle tells us your email, your country, the pack and whether it is paid. Our database keeps the pack and its credits, not the purchase details.
Paddle keeps the purchase record. Tax law requires a record of each sale, so it is kept as long as that law requires, typically several years, even after you delete your account. Paddle’s own privacy notice covers what it does with your details.
Ads
While you make free cards, the app may show ads. Each one loads in a sandboxed frame from a separate address (ads.treadentials.com), walled off from the app. The frame is never given your route, your card, your name or your email, and the app’s own pages run no ad code.
For now the frame shows only our own ads for credits, with no ad network and no ad cookies. If we add an ad network, we’ll update this page first, and visitors in the EU, the UK and anywhere else that requires it will be asked for consent before any network ad loads.
Cookies and tracking
This site (treadentials.com) sets no cookies and runs no analytics, trackers or scripts. The app (treadentials.app) sets one cookie to keep you signed in; our phone apps will use a sign-in token instead. Neither tracks you across other sites, and no advertising, analytics or tracking script from anyone else runs in either.
Who else handles your data
- Cloudflare hosts this site and the app, runs our servers, database and storage, and sends sign-in emails.
- Paddle handles payments, as above.
- Google or Apple, only if you choose to sign in with them.
- Ride with GPS, Wahoo or intervals.icu, only if you connect them. Each sends us the rides you ask to see; we send them nothing of yours.
Each handles what it holds under its own privacy terms. Cloudflare and Paddle may handle your data outside your country, including in the United States. We don’t sell your data, and we don’t share your rides with anyone.
Your choices and your rights
- Export your data. Account → “Export my data” gives you a file of your account, credits, counts, feedback notes and library entries, with the library’s pictures.
- Delete your account. Account → “Delete my account” removes your account, sessions, connections (revoking our access at each service), notes and library at once. Credits left on it go with it, so the app asks first. Our database’s recovery copies roll off within 30 days.
- Your purchase record. Email privacy@treadentials.com to see it or ask us to delete it. We’ll delete what the law lets us; the record of the sale itself has to be kept for as long as tax law requires.
- Correct your name or email in your account, or ask us.
- Wherever you live, you can ask us what we hold about you, ask us to correct or delete it, or object to how we use it, at privacy@treadentials.com. We answer within 30 days. In the EU and the UK you can also complain to your data protection authority.
Precise location is sensitive data under some laws, including the EU’s GDPR and California’s CPRA. That is why this page says what we keep of a ride, why, and how to delete it.
Children
Treadentials isn’t meant for children under 13, or under the age your country sets for agreeing to this on your own.
Changes
When this page changes, the date at the top changes. If a change matters, we’ll tell account holders by email and in the app before it takes effect.
Contact
privacy@treadentials.com
BitRey LLC, 7533 S Center View Ct, Ste N, West Jordan, UT 84084, USA