Privacy Policy

This Privacy Policy explains how Tertiair LLC, doing business as Suspend MTB ("Suspend," "we," "us," or "our") collects, uses, discloses, and protects information when you use the Suspend mobile application ("App"), the website at suspendmtb.com (the "Site"), and any related services (together, the "Services"). By using the Services, you agree to the collection and use of information in accordance with this Policy.

1. Who we are

The Services are operated by Tertiair LLC, 2222 W Grand River Ave, Ste A, Okemos, MI 48864, United States. If you have any questions about this Policy or our privacy practices, you can reach us at support@suspendmtb.com.

2. Information we collect

We collect information in the following categories. Not every user will generate every category; several depend on features or permissions you choose to use.

2.1 Information you provide directly

• Account information: email address, password (stored as a hash by our authentication provider), display name, and any profile details you add. If you sign in with Google or Apple, we receive your name and email address from that provider (with Sign in with Apple, this may be a private relay address if you choose to hide your email).
• Rider profile: rider weight, riding style, experience level, preferences, and any other profile data you supply to improve tuning recommendations.
• Bike and component data: bike make/model, components you track (fork, shock, drivetrain, brakes, wheels, tires, etc.), serial numbers, purchase dates, service history, notes, and photos you upload.
• Tuning conversations: messages you send to the in-app AI tuning assistant, suspension settings you commit, and any feedback you provide about those recommendations.
• Assistant memory: durable facts the tuning assistant saves from your conversations — such as riding preferences, riding context, and bike-specific details — so it can give better recommendations without you repeating yourself. You can view and delete these at any time in the app under Settings → “Rider Profile & Memory”.
• Maintenance data: service intervals, ride logs, trail-side issues you record, and any notes about work performed.
• Payment-related information: subscription status, purchase history, and transaction identifiers. Payment card details are handled by Apple or Google; we do not receive or store card numbers.
• Support and communications: emails, messages, survey responses, waitlist sign-ups, and any other content you send us.
• Marketing preferences: whether you have opted in to marketing email, and any consent records we keep for compliance purposes.

2.2 Information collected automatically

• Device and technical data: device model, operating system and version, unique device identifiers, app version, language, time zone, crash logs, and performance metrics.
• Usage data: screens viewed, features used, in-app actions, session duration, referring pages, and similar analytics.
• Session replays (optional, off by default): if you turn on session replays, either when the app first asks about your privacy choices or later in Settings → Privacy, we record portions of your in-app sessions as screen captures via our analytics provider (PostHog) to diagnose issues and understand how features perform in real use. Replays only run while usage analytics is also on, and may not be available on every device. Text input fields, images (including photos you upload), and the profile name and email shown on the account screen are masked on your device before any recording is transmitted. Recordings are associated with your account so we can investigate issues you report. We do not use session replays for advertising and we do not sell them. You can turn them off at any time in Settings → Privacy.
• Approximate location: we may infer approximate location from IP address to understand where our users are.
• Cookies and similar technologies: the Site may use cookies, local storage, and similar technologies for authentication, preferences, analytics, and session management. You can disable cookies in your browser, but parts of the Site may not work correctly.
• Anti-abuse signals: on pages that include forms (for example, the contact form), we use Google reCAPTCHA v3 via Firebase App Check to distinguish humans from bots. reCAPTCHA collects information about the device and user interactions (such as mouse movement, IP address, and browser characteristics) and sends it to Google for analysis. Google's collection and use of this information is governed by its Privacy Policy and Terms of Service.

2.3 Information from permissions you grant

• Photo library: if you grant permission, we access photos you choose from your library to attach to bikes, components, tuning conversations, or support requests. We only access what you pick.
• Camera: if you grant permission, we access your device camera so you can capture photos of your bike, components, or other items to attach within the Services (for example, uploading a photo while chatting with the tuning assistant). We only access the camera while you are actively using a feature that requires it.
• Notifications: if you grant permission, we may send push notifications for service reminders, chat updates, account and subscription notices (for example, that a free trial is ending), a heads-up when your monthly free messages reset, and occasional check-ins if you haven't used the App in a while. You can turn notifications off at any time in your device settings.
• Apple Health (HealthKit): if you grant permission, we read your cycling workouts from Apple Health (such as ride date, duration, and distance) solely to attribute rides to your bikes for service tracking. For workouts that include a route, we read the starting coordinate and convert it on your device, using Apple's geocoding service, into a city, state, and country label for the ride; we store that label, not the coordinates. We never use Health data for advertising or marketing, and we never sell it. You can revoke this access at any time in the Health app or your device settings.
• Connected services: if you choose to connect a third-party service (for example, Strava), we receive data from that service as authorized by you through the connection, such as activity summaries (for example, activity name, date, distance, duration, and the city where the activity started) and the gear (bikes) on your account.

2.4 Information from third parties

We may receive information about you from service providers (for example, authentication, analytics, crash reporting, email delivery, and subscription management), from connected third-party services you link to your account. We may combine this with information we collect directly.

3. How we use information

We use information for the following purposes:

• Provide, operate, maintain, and improve the Services.
• Create and secure your account, authenticate sign-ins, and prevent fraud or abuse.
• Generate tuning recommendations, maintenance reminders, and other personalized features. This includes processing your bike, component, rider, and conversation data through our AI systems and third-party AI providers.
• Process subscriptions, in-app purchases, refunds, and entitlements.
• Respond to support requests and communicate with you about the Services.
• Send transactional messages (for example, account, security, or service notices) and, if you have opted in, marketing or product updates. You can opt out of marketing at any time.
• Measure and analyze how the Services are used, diagnose bugs, and develop new features.
• Comply with legal obligations, enforce our Terms of Service, and protect the rights, property, or safety of Suspend, our users, or others.
• Carry out any other purpose disclosed at the time of collection or with your consent.

4. Legal bases for processing (EEA / UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases: (a) performance of a contract with you (to provide the Services you request); (b) your consent (for example, for marketing or optional device permissions); (c) our legitimate interests (for example, to secure the Services, prevent fraud, and improve our product, including using retained tuning conversations to evaluate and train the tuning assistant as described in Section 6); and (d) compliance with legal obligations. Where we rely on legitimate interests, you have the right to object to that processing; see Section 10.

5. How we share information

We do not sell your personal information. We share information as follows:

• Service providers. We use third-party vendors to host, operate, and support the Services, including cloud hosting and databases (Google Cloud / Firebase), authentication (Firebase Authentication), product analytics, session replay, and feature-flag delivery (PostHog), crash reporting (Firebase Crashlytics), push notification delivery (Apple Push Notification service and Firebase Cloud Messaging), app-integrity checks (Firebase App Check), AI model providers (Google and OpenAI for the tuning assistant; OpenAI for service-interval suggestions; Google for bike-photo analysis), transactional and marketing email delivery (Resend), subscription management (RevenueCat), payment processing by Apple and Google, and bot/abuse prevention (Google reCAPTCHA via Firebase App Check). These providers are only permitted to use personal information to perform services on our behalf.
• Connected services you choose. If you connect Suspend to a third-party service, we share data with that service as necessary to provide the integration.
• Refund requests. If you ask Apple or Google for a refund of a purchase made through their store, they may ask us about that purchase. Through our subscription processor (RevenueCat), we may tell them whether the purchase was delivered and working, whether you had a free trial before buying, and our preference on the request. Apple or Google makes the final decision.
• Business transfers. If Suspend is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction. We will notify you of any such transfer.
• Legal and safety. We may disclose information to comply with law, legal process, or regulatory requests; to enforce our agreements; or to protect the rights, property, or safety of Suspend, our users, or others.
• With your consent. We may share information for any other purpose with your consent or at your direction.
• Aggregated or de-identified data. We may share information in aggregated or de-identified form that cannot reasonably be used to identify you.

6. AI features

Features that provide suspension tuning, service-interval suggestions, and bike-photo component analysis use artificial intelligence and machine learning, including third-party models. To produce useful output, we may transmit relevant portions of your bike setup, rider profile, tuning history, message content, and any photos you choose to attach to those providers. Under their API terms, these providers do not use that data to train their models. Ride and workout data from Strava or Apple Health is never sent to AI providers and is never included in the retained conversations described below; it is used only for ride and service tracking. Output from AI features may be inaccurate, incomplete, or unsuitable for your riding conditions. Always use your own judgment and consult a qualified mechanic before making changes that affect safety.

Improving the tuning assistant. To improve the quality of the AI tuning assistant over time, we retain a pseudonymized copy of tuning conversations after they leave your in-app history. Before retention, your user ID is replaced with a one-way hash, your name and email are not included, and any photos you attached are stripped. The retained copy keeps your messages, the assistant's replies (including any settings it proposed), and internal identifiers for the bike and setup profile the conversation was about. Because the hash and those identifiers can still be matched to your account by us, this is pseudonymized data, not anonymous data, and we treat it as personal information. It may also contain anything you typed into the conversation yourself, such as a place or a name. We use it to evaluate, debug, and train future versions of the tuning assistant, on the basis of our legitimate interest in improving the Services. We do not use it for advertising, we do not sell it, and we do not share it outside our service providers. You can object to this use at any time by emailing support@suspendmtb.com; once you do, we exclude conversations associated with your account from this use, including conversations we have already retained.

Assistant memory. To personalise tuning advice across sessions, the assistant may save durable facts it learns from your conversations (for example, a riding preference or a bike-specific detail) and reuse them in later chats. This memory is stored with your account and used only to improve your tuning recommendations. You can review everything the assistant has saved, delete any individual item, or clear it entirely at any time in the app under Settings → “Rider Profile & Memory”; deleting your account removes it as well.

Service usage metrics. We log basic usage signals tied to your account so we can monitor cost, enforce fair-use quotas, detect abuse, and prioritise improvements. These signals include which AI features you used (such as tuning chat, bike-photo analysis, and service-interval suggestions), the model invoked, the number of input/output tokens, an estimated cost in USD, the duration of the request, and a timestamp. We also count how often you invoke specific Cloud Functions (for example, Strava sync) and how many transactional emails we send to you. These metrics describe your interactions with the Services and are not used for advertising or sold to third parties. Per-request AI usage records are kept as cost and accounting records and are not removed when you delete your account; they contain your account ID but not your name, email, or message content.

7. Data retention

We retain personal information for as long as your account is active or as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it. You can request deletion of your account at any time (see "Your rights" below).

Tuning conversations. Recent tuning conversations are kept in your account so you can resume them in the app. They stay visible in your in-app history for seven days (thirty days for Pro subscribers) after their last update; the underlying conversation is retained for up to thirty days, after which it is deleted and kept only in the pseudonymized form described in Section 6 (AI features). When you delete your account, your in-app conversations are removed and your hashed identifier is added to an exclusion list so that prior conversations associated with it are not used in future model training or evaluation.

Assistant memory. Durable facts the tuning assistant saves (see Section 6) persist until you delete them in the app (Settings → “Rider Profile & Memory”) or delete your account, whichever comes first.

Other data. Your account, profile, bikes, components, service history, rides, and saved setups are kept until you delete them or delete your account. Usage analytics events are kept by our analytics provider for up to seven years, session replays for up to one year, and crash reports for up to 90 days. Records of marketing-email consent and unsubscribes are kept as long as needed to honor your choice.

8. Security

We use reasonable technical and organizational measures to protect personal information, including encryption in transit and at rest, access controls, and server-side security rules. No system is perfectly secure, however, and we cannot guarantee absolute security. You are responsible for keeping your password confidential.

9. International transfers

The Services are operated from the United States and may involve transfers of information to countries other than the one you live in. Those countries may have different data protection laws. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for international transfers.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of your personal information; to object to or restrict certain processing; and to withdraw consent. To exercise any of these rights, email support@suspendmtb.com. You may also:

• Update your profile and preferences in the app's Settings.
• Turn usage analytics and session replays on or off at any time in the app under Settings → Privacy.
• Opt out of marketing emails by using the unsubscribe link in any such email, which opens a hosted unsubscribe page at suspendmtb.com/unsubscribe. Your preference is also reflected in the app's Settings.
• Revoke device permissions (photos, camera, notifications, Apple Health) in your device settings.
• Disconnect any third-party integrations in the app.
• Request that we delete your account and associated data.

We will not discriminate against you for exercising any of these rights.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concern first, so please contact us.

11. U.S. state privacy rights

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect and how we use it, the right to request deletion, the right to correct inaccurate information, and the right to opt out of the "sale" or "sharing" of personal information. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. To submit a rights request, email support@suspendmtb.com.

Residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others) may have similar rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling. We do not sell personal information, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, so there is nothing to opt out of, including through a browser's Global Privacy Control signal. Some of these laws treat health-related information as sensitive; we read Apple Health workouts only with your permission, as described in Section 2.3. To exercise a right, email support@suspendmtb.com. If we deny your request, you may appeal by replying to our decision, and if you are not satisfied with the outcome of the appeal you may contact your state attorney general.

12. Children

The Services are not directed to children under 13 (or the equivalent age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.

13. Third-party links and services

The Services may contain links to or integrate with third-party websites and services. We are not responsible for the privacy practices of those third parties. Please review their privacy policies before providing them with information.

14. Changes to this Policy

We may update this Policy from time to time. When we do, we will post the updated Policy and update the "Effective" date above. If changes are material, we will provide additional notice (for example, by email or through the Services). Where the law requires your consent to a change, we will ask for it before the change applies to you. Otherwise, your continued use of the Services after an update means you accept the updated Policy.

15. Contact us

If you have any questions or requests regarding this Policy or our privacy practices, contact us at support@suspendmtb.com.