QuietField LLC

Privacy policy

Velodex Privacy Policy

Effective date: 2026-10-20
Applies to: the Velodex iOS app, published by QuietField LLC, a Florida limited liability company.

Velodex is an independent app and is not affiliated with, endorsed by, or sponsored by Peloton Interactive, Inc.

The short version

  • Velodex analyzes your own Peloton workout history on your own device. Your workout data reaches Velodex only one way: from a workout file you download from Peloton’s website and choose to import (plus any workouts you type in yourself). Velodex never signs in to Peloton and never connects to Peloton’s service.
  • Your workout data is never transmitted to Velodex — no Velodex server receives it, and we have no ability to access it. The only thing the app ever downloads from us is a small, signed configuration file that carries nothing about you (Section 3 explains it).
  • We do not sell your data, show ads, share data with data brokers, or use third-party analytics SDKs. Ever, for health data; and not at all today.
  • You can remove imported workouts, or delete everything Velodex holds and withdraw your consent, at any time in the app’s Settings.
  • You can export your data as a CSV file at any time.

The rest of this policy is the same story in more detail.

1. Who we are

Velodex is developed and published by QuietField LLC, a Florida limited liability company (the “developer,” “we,” or “us”). For users in the EU/UK, QuietField LLC is the data controller for any personal data described in this policy.

Contact for anything in this policy: Matthew Dickerson (representative of QuietField LLC) — info@quietfieldllc.com

2. What data Velodex handles

Velodex stores the following on your device only, and only after you give the separate health-data consent in the app:

  • Workout data from a file you import. Peloton lets members download their workout history as a CSV file from Peloton’s website. When you choose that file in Velodex (or share it to Velodex from Files, Mail, or AirDrop), Velodex reads it and keeps, for each workout: date and start time, workout type (discipline), length, total output (cycling only), average heart rate, average cadence, calories, class title, and instructor name. Velodex ignores the file’s other columns (including class type, live/on-demand, watts, resistance, speed, distance, incline, and pace) and does not store them. Velodex does not keep a copy of the file itself.
  • Workouts and fitness settings you enter yourself: workouts you add by hand, the FTP (functional threshold power) value you set, and FTP test results.
  • Health-related results computed on your device from the above (for example, training load, streaks, personal records, and recommendations).
  • A consent record: the exact text of the health-data consent you agreed to, its version, and the timestamp — kept so that both of us can prove what you agreed to and when.
  • Purchase state for the Velodex Premium subscription, handled through Apple’s App Store (Apple processes the payment; we never see your payment details).

Heart-rate and workout data are health-related data, and we treat all of it as sensitive health data under the strictest applicable standard.

What Velodex never handles: any Peloton login, session, or account identifier (Velodex never signs in to Peloton), your payment card details, your contacts, your location, or — knowingly — data about anyone other than you. The workout file carries no Peloton account ID, so Velodex can’t tell whose file it is; if you import someone else’s file by mistake, Settings › Remove imported workouts undoes it.

3. Where your data lives

On your device. Nowhere else.

  • All workout data, analysis results, and the consent record are stored locally on your device. The app’s data store is configured never to sync to iCloud (CloudKit).
  • All analysis — training load, trends, streaks, records, recommendations — is computed on-device.
  • Your workout data never leaves your device for us. Your workout, heart-rate, and fitness data is processed only on your device. It is never sent to Velodex, and we have no servers that receive it and no ability to access it.
  • Velodex makes no connection to Peloton. It does not sign in to Peloton or call Peloton’s servers. When you tap Open Peloton’s website, Velodex hands off to Safari, and you download your workout file from Peloton directly — that visit is between you and Peloton, under Peloton’s own privacy policy, and Velodex sees nothing of it.
  • The app does periodically download a small, cryptographically signed configuration file from a Velodex-controlled address (velodex-config.quietfieldllc.com). It lets us show you a notice or an update prompt, or switch off a feature with an explanation if something breaks. It can never turn on a new data source or make the app send anything about you. That request sends nothing about you: no account information, no workout or health data, no identifiers, and no cookies. Like any internet request, the server hosting the file can observe your IP address; we do not receive it and do not use it to identify you. We do not collect or receive access logs from this request and have not enabled any logging of it. The file is hosted for us by Google LLC (Firebase Hosting), which transiently processes your IP address to deliver it and retains limited operational logs under its own privacy policy (https://policies.google.com/privacy).
  • The only network connections the app makes are to Apple (App Store purchases) and to velodex-config.quietfieldllc.com (the anonymous configuration download described above).

Standard iOS device backups (iCloud/computer) may include the app’s local data under your own Apple account, governed by Apple’s terms — that is your backup, not a transfer to us.

4. How your data is used

Only to provide the app’s features to you:

  • Importing your workout file (and any newer file you import later) and keeping your history on your device.
  • Computing analytics: training load, trends, streaks, PRs, milestones, and comparisons, from the data you have imported or entered.
  • Generating rule-based training recommendations from your own data.
  • CSV export you initiate.
  • Determining free vs. Premium access (your newest 25 workouts are analyzed free; Premium unlocks the rest).

5. What we never do

  • No sale of your data — to anyone, for any purpose.
  • No advertising — no ads in the app, and your health and fitness data is never used for advertising or marketing purposes (this is also a requirement of Apple’s App Store Guideline 5.1.3, which we treat as a floor, not a ceiling).
  • No data brokers — no sharing with data brokers or “information resellers,” ever.
  • No third-party analytics or tracking SDKs — none are integrated in the app today.
  • No tracking across other companies’ apps or websites, in Apple’s sense of the term or anyone else’s.
  • No sharing with third parties at all, except: (a) Apple, for purchases you make; and (b) Google LLC, solely in the sense described in Section 3 — it hosts our configuration file (Firebase Hosting), and delivering any file over the internet necessarily exposes your IP address to the host. Velodex sends nothing to Peloton. Share cards and CSV exports go only where you send them. We have no affiliates. Our only data processor is Google LLC, in that configuration-file-hosting role only, and it never receives your workout, health, account, or identity data.

6. Retention and deletion

  • Data stays on your device until you remove it or delete the app.
  • Remove imported workouts (Settings): deletes every workout that came from an imported file, with its derived results. Workouts you added by hand stay. This does not withdraw your consent.
  • Delete all Velodex data (Settings): deletes all of your workout and health data from your device — every workout (imported or entered by hand), your FTP and test results, derived results, and your consent record — in one action, and withdraws your health-data consent. This is a real deletion from the device, not a soft-hide. Velodex then returns to its welcome screen.
  • Deleting the app from your device removes its local data per standard iOS behavior (subject to any device backups you control).
  • Because we hold no copy of your data — the configuration server described in Section 3 stores nothing about you — there is nothing for us to retain or delete on any server.

7. Your rights

Because everything lives on your device, you can exercise the substance of every right yourself, immediately, without asking us:

  • Access: open the app — all data Velodex holds about you is visible in it, and it holds nothing anywhere else.
  • Portability / export: built-in CSV export of your workout history.
  • Deletion: Remove imported workouts or Delete all Velodex data, as described in Section 6.
  • Withdraw consent: Delete all Velodex data withdraws your health-data consent; the app stops processing and deletes what it holds.

Formal rights by jurisdiction:

  • GDPR (EU/UK): Heart-rate and workout data are treated as special-category health data under Article 9. We process them only with your explicit, separate consent, given via a dedicated health-data consent step before any import (recorded with text, version, and timestamp). You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time (Sections 6–7 above are how); withdrawal doesn’t affect the lawfulness of processing before withdrawal. You may lodge a complaint with your supervisory authority. Your workout and personal data never leave your device to us, so we make no cross-border transfers of that data. The anonymous configuration request described in Section 3 is served by Google’s global network (Firebase Hosting) under Google’s data-processing terms.
  • California (CCPA/CPRA): We do not sell or share (in the CCPA sense) personal information, and we do not use or disclose sensitive personal information for purposes beyond providing the service you asked for — so no “Do Not Sell or Share” or “Limit the Use of My Sensitive Personal Information” action is needed; the limits are already permanent. You may exercise access, deletion, correction, and portability rights in-app as above, or by contacting us; we will respond within the statutory window and will never discriminate against you for exercising a right.
  • Washington State: see our separate Consumer Health Data Privacy Policy (required by the Washington My Health My Data Act), published alongside this policy.
  • Other states/countries: the same in-app access, export, deletion, and consent-withdrawal mechanisms are available to everyone, everywhere, and you can always contact us at the address in Section 1.

8. Peloton and your workout file

Velodex does not link to, sign in to, or connect with your Peloton account. It reads only the workout file Peloton lets you download from its website, after you download it yourself. Peloton may change or remove that download at any time; if it does, everything you have already imported stays viewable on your device and exportable to CSV. Use of Peloton’s website is governed by Peloton’s own terms and privacy policy.

9. Children

Velodex is not directed at children and is not intended for anyone under 16. We do not knowingly collect data from anyone under 16 (and never knowingly from children under 13). If you believe a child has used the app, use Delete all Velodex data or delete the app from the device — as described above, that removes the data — and feel free to contact us.

10. Security

Velodex holds no Peloton login or session credential — there is nothing of that kind to steal. Workout data is protected by iOS’s device-level protections (passcode/Face ID, file encryption), and the app does not keep a copy of the files you import. No user data leaves the device to us, which is the strongest security posture we can offer: we cannot lose, breach, or misuse what we never have. The configuration file the app downloads (Section 3) is cryptographically signed, and the app refuses any file that fails verification.

11. Changes to this policy

If this policy changes materially — above all, if any data ever starts leaving your device, or Velodex adds a new source of health data — we will update the policy, change the effective date, and notify you in the app before the change applies to you. Health-data practices will never be expanded beyond what you consented to without asking for new consent first.

12. Contact

QuietField LLC — Attn: Matthew Dickerson — info@quietfieldllc.com