Privacy Policy

Version 1.0.8 · Effective September 30, 2026

BTech LLC, a New Mexico limited liability company (“BTech,” “we,” or “us”), operates BiaVis. This policy explains what BiaVis processes, why it is used, how long it is kept, and the choices available to you. Contact privacy@biavis.app with privacy questions or requests.

Information we process

Account and identity: an account UUID; Sign in with Apple identifiers, email or private-relay email, and name when Apple supplies it; handle; profile appearance, including a profile picture if you upload one; an optional one-line bio and the stats you choose to showcase; whether your profile is public or private; country; and timezone. You can browse first with an anonymous account and later link Sign in with Apple.
Fitness and competition: workout results, BiaVis Points, ratings, splits, personal records, challenges, Club participation, posts, RSVPs, reports, blocks, and moderation records. If you run a Club, the Club’s photo and colour.
Posts and social activity: runs you post, their captions and up to four photos, posts made automatically for duel wins, personal records, and bounty clears, your automatic-posting choices, reactions, friend tags and whether they were accepted, the Club tagged on a post, reports about posts, and posting restrictions.
Verification evidence: precise GPS coordinates, timestamps, speed and accuracy values, motion classifications, pause and resume times for a paused Free Run, device pseudonyms, whether a run was recorded on iPhone or Apple Watch, app/device details, and verification diagnostics. Camera video is processed on-device and is not uploaded; body-joint coordinates derived from the camera may be uploaded to verify a result.
Apple Health and connected sensors: raw HealthKit samples are read only with permission and remain on the device. BiaVis can also receive heart rate, cadence, informational speed, cycling power, battery level, and device information directly from standards-based Bluetooth wearables and fitness sensors. Those raw sensor timelines remain device-only. Optional eligible summaries can be shared with a Club only after an explicit choice.
Apple Watch: if you install BiaVis on Apple Watch, it can show live figures for a run your iPhone records, or record a run on its own with the watch’s GPS, motion, and heart-rate sensors while your iPhone stays behind. During an iPhone run, the watch sends live heart-rate readings to the iPhone for display; they are handled like connected-sensor samples and stay on your devices. Your iPhone keeps the watch supplied with your account identifier, available events, unit preference, and Apple Health saving choice so it can record without a connection.
Purchases: if BiaVis Pro is offered, Apple provides the product identifier, transaction identifiers, purchase and expiration dates, revocation status, environment, and an app account token associated with your BiaVis account. Apple processes payment credentials; BTech does not receive your full payment-card number.
Product interest analytics: BiaVis records a limited allowlist of interactions with the Pro preview, restore control, and purchase choices. A rotating daily digest prevents repeat taps from inflating the count. BiaVis does not place routes, health values, workout results, messages, profile text, or device identifiers in these events, and does not use them for advertising or cross-app tracking.
Support and safety: messages you send and the operational records needed to investigate, respond, prevent abuse, and meet legal obligations.
Reliability diagnostics: when sharing is enabled, BiaVis records bounded operation outcomes, a temporary support code, app build, iOS version, connection state, and Apple MetricKit crash, hang, launch, memory, CPU, disk-write, and energy reports. These records never include routes, coordinates, Health values, raw sensor samples, camera joints, names, contact details, handles, messages, Club or Event text, tokens, or request bodies. You can turn sharing off in Account & Safety, which immediately purges the device queue.

How we use information

We use information to provide workouts and competition; verify results and detect cheating or vehicle travel; calculate standings and BiaVis Points; restore purchases; understand which planned features are useful; operate social and safety features; export or delete your data; secure, diagnose, and improve the service; and meet legal obligations. We do not sell personal data, use cross-app tracking, run targeted advertising, or use health data for marketing.

Location and route privacy

Full personal routes remain private. When you post a run or share it with a Club, a simplified map is included by default unless you turn off “Show map” for that run. Verification evidence containing GPS coordinates temporarily leaves the phone so the server can independently validate a run or ride. Accepted evidence is scheduled for deletion after 30 days; evidence requiring review or considered suspicious is scheduled for deletion after 90 days. Device-only practice traces are kept for up to seven days.

A run recorded on Apple Watch keeps its verification evidence and route on the watch until your paired iPhone receives them over Apple’s WatchConnectivity, which happens automatically once the two are in range. The watch then deletes its copy, and the run follows the same verification, retention, and sharing rules as a run recorded on iPhone. GPS keeps recording while a Free Run is paused so the run can still be verified; paused stretches do not count toward its distance or time.

Shared maps are separate from verification evidence and contain at most 500 coordinate points, rounded to about one meter. By default they hide the first and last 200 meters of the run; you can turn off “Hide start and finish” for a run, and its shared map then shows where it started and finished. You can also choose whether the shared map is colored by pace bands, which are worked out on your iPhone from that run’s own GPS pace and are not health data. Only people who can see the run can retrieve its map: eligible friends and Club members, and, if your profile is public, other signed-in BiaVis users, who see a run’s map only when its start and finish are hidden. Turning map sharing off removes the shared coordinates when the change reaches the server; offline changes remain queued and are labeled pending. Shared maps remain until you turn map sharing off or delete your account. Removing a run from an audience also removes that audience’s access.

Profile pictures

You can upload a profile picture instead of using a default avatar. Before it leaves your iPhone, BiaVis crops it to a square, resizes it, and saves it as a new image, which removes location, camera, and other metadata from the original photo. The picture is stored in private storage and is shown to signed-in BiaVis users wherever your profile appears, including rankings, friends, Clubs, and duels. It is not published on the open web, and it is hidden from anyone either of you has blocked. Other users can report a profile picture, and BTech may remove one that breaks the Community Guidelines. When you replace or remove your picture, or delete your account, it stops being shown immediately and its file is deleted from storage, normally within a day.

Club photos

A Club’s owner and admins can give the Club a photo. Like a profile picture, it is cropped, resized, and saved as a new image on the iPhone, which removes location, camera, and other metadata, and it is kept in private storage. While it is the Club’s current photo, any signed-in BiaVis user can see it wherever the Club appears, including the Club list. It is not published on the open web. Anyone can report a Club, including its photo, and BTech may remove a photo that breaks the Community Guidelines. When a Club photo is replaced or removed, or the Club is deleted, it stops being shown immediately and its file is deleted from storage, normally within a day.

Posts, photos, and profiles

Posting a run. A run appears on your profile and your friends’ Activity only when you post it. You can add up to four photos, taken with the camera or chosen from your library, and a caption. Photos are cropped, filtered, and optionally overlaid with the run’s stats on your iPhone, then saved as new images, which removes location, camera, and other metadata before they leave the device. Photos taken in BiaVis are not saved to your photo library. Photos are kept in private storage and shown only to people who can see the post. You can add, change, or remove photos, change the caption, or remove the post at any time.

Automatic posts. Verified duel wins, personal records, and bounty clears post to your profile automatically. You can turn each kind off in the You tab; turning one off stops new posts of that kind.

Reactions and tags. People who can see a post can react to it, and reactions are visible to others who can see the post. You can tag up to ten friends who ran with you; a tag appears on the post only after the tagged friend accepts it, and you can remove a tag at any time. You can tag a Club you belong to; the tag is a label and does not show the post to Club members who cannot otherwise see it.

Public and private profiles. Profiles are private unless you make them public in Settings. On a private profile, your posts are visible to your friends. On a public profile, any signed-in BiaVis user can open your profile and see your posts, photos, and each shared map whose start and finish are hidden; your friends’ Activity feeds still show your posts only to friends. Profiles are not published on the open web. Blocking hides profiles and posts in both directions.

Bio and showcase. Your bio and up to three showcase stats appear to any signed-in user who opens your profile, whether it is public or private. Showcase stats are calculated by BiaVis from verified results; only the stats you choose are sent to other people.

Reports and restrictions. Anyone who can see another athlete’s run post can report it. A post reported by three different athletes is hidden from everyone but you until reviewed, and you can ask for a review. Repeated hidden posts can pause posting on an account for a period. Reports stay private; the reported athlete is not told who reported.

Notifications. If you allow notifications, BiaVis can tell you when someone reacts to your post, tags you, or accepts your tag, in addition to friend and Club updates. You can turn notifications off in iOS Settings.

Sharing and processors

We disclose information only as needed to operate the service, follow your sharing choices, protect people and the service, complete a business transaction subject to appropriate safeguards, or comply with law. Current processor categories include:

Apple: platform identity, purchases, notifications, HealthKit, diagnostics supplied by Apple, and App Store distribution.
Supabase: authentication, database, server functions, and private evidence storage.
Vercel: public website and legal-page hosting.
Porkbun: domain and service email routing.

We do not authorize processors to use BiaVis health or activity data for their own advertising. Processors may keep restricted security logs and encrypted backups for their documented operational periods; deletion is applied to active BiaVis systems as described here and propagates through backup rotation.

Retention

Accepted verification evidence: 30 days.
Review or suspicious evidence: 90 days.
Device-only practice traces: 7 days.
Runs recorded on Apple Watch: kept on the watch only until your iPhone receives them.
Completed export packages: links expire after 48 hours and packages are purged within 72 hours.
Delivered notification payloads: 30 days; failed operational records: 90 days.
App Store notification replay receipts: 90 days. Account-linked subscription state is kept while needed to provide or restore the purchase and is removed from the account when the account is deleted, subject to records Apple or law requires Apple to keep.
Product-interest daily deduplication digests: 35 days. Aggregate counts that cannot be used by BTech to identify an account: 24 months.
First-party reliability outcomes: 14 days. Apple MetricKit reports received by BiaVis: 30 days. The device upload queue expires records after seven days and is capped at 200 events or 256 KB.
Closed safety reports: 24 months, unless safety, litigation, or law requires longer.
Legal-acceptance proofs: six years after account closure, pseudonymously.
Profile pictures: while current. A replaced or removed picture, and every picture of a deleted account, is deleted from storage, normally within a day.
Club photos: while current. A replaced or removed photo, and every photo of a deleted Club, is deleted from storage, normally within a day.
Run photos: while the post shows them. A removed photo, the photos of a removed post or deleted run, and every photo of a deleted account are deleted from storage, normally within a day.
Posts, captions, reactions, tags, bio, and showcase choices: until you remove them or delete your account.
Account, profile, and social information: for the account lifetime, then deleted or pseudonymized as described below.

Competitive result facts may remain under a random, non-public pseudonym after account deletion to preserve standings, reversals, and anti-cheat integrity. They are not used to contact or reidentify you.

Device-only Bluetooth sensor timelines are sampled into a bounded sidecar, protected, excluded from backup, and gzip-compressed. Each activity is limited to 125,000 persisted records, 24 MiB before compression, and 6 MiB after compression. Completed raw sensor sidecars share a 128 MiB device budget and may be evicted oldest-first before the associated workout summary. Download My Data includes only sensor sidecars still retained on the iPhone preparing the export. Local-history deletion, safe sign-out, and account deletion remove the applicable sensor timelines.

Your choices and rights

You can review permissions, request an export, delete local workout history, delete individual runs and duels from your Logbook, remove posts and photos, choose which wins post automatically, make your profile public or private, sign out, block accounts, report content, or delete your account in Account & Safety and the You tab. Apple Health permissions are controlled in iOS settings, and subscription management is controlled through Apple. Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing, withdraw consent, or receive portable data. See the Data Rights page or email privacy@biavis.app. We verify requests before disclosing or changing account data and do not discriminate for exercising a privacy right.

Deleting a run or duel from your Logbook removes it from your Logbook, your Activity, and the feeds of friends and Clubs it was shared with, and removes its shared map, note, and photos. The verified result facts behind ratings, BiaVis Points, and duel standings are kept, so deleting an effort does not change a rating or an opponent’s record. Signing out or deleting your account also clears BiaVis’s account details from your Apple Watch.

International use

BTech is based in the United States. BiaVis and its processors may handle information in the United States and other locations where they operate. When applicable law requires a transfer safeguard, BTech uses the processor’s approved contractual or statutory mechanism. Contact privacy@biavis.app for information relevant to your location or to complain to an applicable regulator.

Security and age restriction

We use access controls, private storage, encryption in transit, row-level database security, server verification, and limited-retention evidence. No system is perfectly secure. BiaVis is restricted to people age 18 or older and is not directed to children.

Changes

Material Terms changes require renewed acceptance. Material privacy changes will be highlighted in the app; clarifications may be shown as a nonblocking notice. The version and effective date above identify this policy.