Privacy Policy

Last updated: 16 July 2026

Hummingbird ("the App") is developed by FlockLabs, an individual-run project based in Switzerland. This policy explains what data the App handles, why, and how you can control it.

Data collected and how it's used

Trainer & workout data

Hummingbird connects to your Bluetooth smart trainer (any device supporting the Fitness Machine Service standard) to read live metrics — power, cadence, speed, heart rate, resistance — and to send target-power commands during structured workouts. This connection is local, directly between your iPhone and your trainer; nothing is sent to us.

Completed rides (workout name, duration, average/peak power, calories, estimated distance, and timestamp) are saved as your ride history, stored locally on your device using standard iOS app storage. We do not have access to this data and it is never transmitted to any server we operate.

Bluetooth permission

The App requests Bluetooth permission solely to discover and connect to your own trainer hardware. It is never used for location tracking, advertising, or any purpose unrelated to connecting to your trainer.

Strava integration (optional)

If you choose to connect Strava from within the App:

• You authorize the connection through Strava's own login screen (via Apple's ASWebAuthenticationSession). Hummingbird never sees or stores your Strava password.
• The one-time authorization code is exchanged for an access token through a small server-side relay that we operate (a Cloudflare Worker), whose only purpose is to keep our Strava API credentials confidential — a client secret can't safely be embedded in an iPhone app. This relay does not log, store, or retain your token or any ride data; it passes the exchange request straight through to Strava's servers and returns the result.
• Your resulting Strava access token is stored securely in your device's Keychain — never on any server.
• When you tap "Share to Strava" after a ride, the App uploads that one ride's FIT file directly to Strava's API using your token. No other ride data is sent, and nothing is uploaded unless you explicitly choose to share it.
• You can disconnect Strava at any time from within the App, which deletes the stored token from your device. You can also revoke Hummingbird's access at any time from Strava's own connected apps settings.

What we don't do

• No account creation, no name/email/phone number collected inside the App.
• No analytics SDKs, no advertising identifiers, no third-party trackers.
• We do not sell your data, ever.
• We do not share your data with anyone except Strava, and only when you explicitly initiate a share.

Data retention & deletion

Your ride history and settings stay on your device until you delete them — either by deleting individual rides in the App, or by deleting the App itself, which removes all locally stored data immediately. Disconnecting Strava deletes your stored access token right away. Because we don't operate a backend database of user data, there is nothing further for us to delete on our end beyond what's described above for the Strava token-exchange relay (which retains nothing to begin with).

Your rights

Since Hummingbird doesn't store your personal data on any server we control, most data protection rights (access, correction, deletion) are exercised directly on your device — everything is already in your hands. If you have questions about your data or want something clarified, contact us at info@splitbaguette.com and we'll respond.

Children's privacy

Hummingbird is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has used the App in a way that concerns you, contact us and we'll look into it.

Changes to this policy

If this policy changes, we'll update the date at the top of this page. Continued use of the App after a change means you accept the update.

Contact

Questions about this policy or your data: FlockLabs — info@splitbaguette.com