Privacy notice

Last updated: 31 October 2026

Spokepilot is free to use. Personal data is processed to provide and protect the functions described below. The operator identified below is responsible for this processing.

Spokepilot helps you calculate spoke lengths and manage your wheel projects. This notice explains which data is processed. While the public website displays a coming-soon page, the account functions described here apply only to people who already have access to the application.

1. Data controller

You can use the email address above for data protection questions and to exercise your rights.

2. Visiting the website

When you visit, technically necessary connection data is processed, particularly your IP address, the time, the requested address, browser and device information and, where applicable, the referring page. This enables delivery of the website, error analysis and protection against attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.

Hosting is provided through ChatGPT Sites by OpenAI Ireland Limited, with technical subprocessors including Cloudflare. The applicable documents are the ChatGPT Sites Data Processing Addendum and its linked list of subprocessors. Technical logs are retained for operation and investigation of disruptions or misuse. Their retention depends on whether they remain necessary for these purposes or to meet legal obligations.

3. Account, profile and sign-in

An account requires your email address, a technical user identifier, verification and sign-in status and, when signing in with a password, the authentication data needed for that purpose. Your profile contains your display name (a pseudonym is possible), a unique username, your selected interface language, creation and modification timestamps and, optionally, a profile picture. An uploaded profile picture is resized in your browser before it is stored. Your settings also store your preferred measurement method and the available purchase-length increments for the spoke calculator.

We use this data to provide your account, sign you in and associate your saved data with you. The necessary processing is based on Article 6(1)(b) GDPR. We cannot provide a personal account without the required account data. A profile picture is optional and can be removed in Settings.

We use Google's Firebase Authentication for sign-in and account management. The service also processes IP addresses and browser information to protect against misuse, based on Article 6(1)(f) GDPR. Emails for address verification, email address changes and password recovery support account security and are sent through Firebase.

When you sign in with a username, the Spokepilot server temporarily processes your username and password to identify the account and have Firebase verify the password. The password is not stored in our database or logged by the application. To counter repeated sign-in attempts, we store time-window-based hashes of the IP address or of the IP address and username, together with attempt counters, in 15-minute windows. Entries from older windows are cleaned up during later sign-in attempts; they become eligible for cleanup after no more than 75 minutes.

4. Signing in with Google

Selecting “Sign in with Google” establishes a connection to Google. Spokepilot receives the basic account details authorised for sign-in, particularly your Google user identifier, name, email address and its verification status. Google may also supply a profile picture. Spokepilot uses this information to sign you in and associate your account, not for advertising.

We do not request access to your Gmail messages, Google Drive files or calendar. Your Google password is not sent to Spokepilot. Processing for your chosen sign-in method is based on Article 6(1)(b) GDPR. Google's own processing within your Google account is additionally covered by the Google Privacy Policy.

5. Projects and shared component catalog

Your account stores your projects and wheels, including names, references, entered measurements, component details and settings. This data is used to calculate, save and later edit your projects. The legal basis is Article 6(1)(b) GDPR.

Private projects are linked to the respective account and are not displayed to other user accounts. The component catalog is shared by signed-in accounts. Moderators can add new components directly. Administrators maintain the catalog, review suggestions and manage account access and roles. The assigned role and assignment time are stored. For this purpose, the admin console displays display names, usernames, email addresses, profile pictures where present, sign-in methods, creation and last sign-in times, and account status. It does not include a view of other users' private projects.

When you suggest a component, we store the submitted details, your user identifier, the time, the review status and the administration's feedback. Suggestions are visible only to you and administrators. Approved component details appear in the shared catalog without a link to your account. Your suggestions are included in your personal data copy and are removed when your account is deleted. Already approved components remain in the shared catalog.

When you submit a bug using “Report a bug”, we store the title, description, affected app area, your user identifier, timestamps and processing status. Administrators can associate the report with your profile and process it. The report is accessible only to you and administrators. Project content is not automatically attached. Your bug reports are included in your personal data copy and are removed when your account is deleted.

Only enter data in free-text project fields that you need for your project. Enter other people's data only if you are entitled to do so.

Processing component suggestions and bug reports, including related feedback, is based on Article 6(1)(f) GDPR. Our legitimate interests are checking submitted information, correcting errors, detecting misuse and making progress visible to you. Submission is voluntary; we cannot provide these account-based features without the required information and account association. Role management, access restrictions and records of necessary administrative actions are also based on Article 6(1)(f) GDPR. They support secure allocation of permissions and traceable changes.

6. Storage locations and recipients

The Cloud Firestore application database is configured for Frankfurt. Firebase Authentication, however, processes sign-in data in the United States. For Google Cloud services with a contractual location in Germany, the responsible entity is generally Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Google LLC and other subprocessors may be involved in processing.

Google describes its processing and safeguards in the Firebase Privacy and Security information and the Cloud Data Processing Addendum. For transfers outside the European Economic Area, the providers provide for adequacy decisions, including the EU–US Data Privacy Framework for covered certified recipients, or EU Standard Contractual Clauses. The applicable bases and safeguards are set out in the linked agreements. Hosting by OpenAI and its subprocessors may also involve processing outside the EU. Exclusive storage of all data in Germany is not promised.

Google processes application database and authentication data on our behalf. For website hosting, including server-side account functions, the contact form and abuse prevention, OpenAI processes the data required for those purposes on our behalf and uses technical subprocessors. This can include account identifiers and authentication data sent to the Spokepilot server. Data is also disclosed to authorities or other recipients where a legal obligation requires it in an individual case.

Information about the transfer safeguards used is available through the linked data processing agreements or by contacting info@spokepilot.de. You can also request a copy of the relevant safeguards there.

7. Browser storage

The Spokepilot application does not create its own cookies. The legacy sidebar cookie (sidebar_state) is specifically removed on your next visit. Cloudflare currently sets the __cf_bm security cookie through the hosting service, so the website is not currently delivered entirely without cookies. Cloudflare cookie information

For the sign-in you request, Firebase stores technically necessary authentication data in your browser's session storage. Sign-in applies to the current session. Signing out or closing the relevant tab or window removes this session data, although your browser's session restoration may affect this. If session storage is unavailable, sign-in remains only in the open page's memory. Automatic persistent sign-in for later sessions is not provided. Necessary storage is based on section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG); processing for your account is based on Article 6(1)(b) GDPR.

Our hosting service may use technically necessary security cookies to detect automated misuse and deliver the website reliably. These protect the requested service (section 25(2)(2) TDDDG and Article 6(1)(f) GDPR). Spokepilot does not embed its own analytics or advertising trackers.

References to manufacturers, sources and other external websites are links. When you open one, the destination provider receives the connection data required for that visit, including your IP address. Processing on that website is governed by the respective provider's privacy notice.

8. Contact by email and contact form

When you write to us, we process your email address, message content and voluntarily supplied information to handle your enquiry. The mailbox is provided by MC-HOST24, a service of Gericke KG, Mühlenstr. 8a, 14167 Berlin, Germany. The provider's information is available in its privacy notice. For questions about using your account, the legal basis is Article 6(1)(b) GDPR. For other enquiries, it is Article 6(1)(f) GDPR, based on our interest in answering your enquiry.

The public contact form requires your email address, subject and message so that we can identify and answer your enquiry. Your name is optional. No sign-in or link to a user account is involved. A technical case identifier, receipt and update timestamps, and processing status are also stored. The enquiry is stored in the website hosting database at Cloudflare through ChatGPT Sites, not in the public component catalog. Only active Spokepilot administrators can access the inbox. Replies are sent by email, for which the mailbox processing described above applies.

The legal bases are the same as for email contact: Article 6(1)(b) GDPR for enquiries about using your account and Article 6(1)(f) GDPR for other enquiries. Our legitimate interest is processing and answering your message. Without an email address, subject and message, the form cannot submit the enquiry. Alternatively, you can use the contact methods listed in the legal notice.

To protect the form against automated misuse and excessive submissions, we process time-window-based hashes of the IP address and email address, along with request counters, based on Article 6(1)(f) GDPR. The IP address is not stored together with the message. Counters and hashes become eligible for deletion after two hours and are cleaned up when the next form submission arrives. No additional tracking services or marketing cookies are used for this purpose.

9. Retention and deletion

Your account, profile and saved projects are retained while you use your account. You can delete projects and edit your profile in the application. Under Settings → Delete account, you can delete your account yourself after explicit confirmation and reauthentication. This removes your Firebase sign-in account, profile and profile picture, username, projects, settings, your own component suggestions and bug reports, and your access roles. References to your user identifier in the processing of other people's suggestions, bug reports and roles are removed. Already approved components remain in the shared catalog without an account link. An interrupted deletion can be resumed after signing in again. Data from the former ChatGPT sign-in is also deleted if the previous identity can be independently verified in the same session and associated with your account. For previous data that cannot be associated, contact enquiries and email correspondence, or if you no longer have account access, write to info@spokepilot.de. Identity confirmation may be required. Automatic deletion solely due to inactivity is not currently configured. After account deletion, a technical blocking identifier is retained so that previously issued authentication tokens cannot recreate data for the deleted account. It contains no email address, profile or project content.

When processing is no longer necessary, the data concerned is deleted unless statutory retention obligations or evidence necessary to establish, exercise or defend legal claims require otherwise. Open contact enquiries are retained for handling. After final resolution, the enquiry and related correspondence are deleted once no follow-up questions or specific reasons for further retention remain. Administrators can view resolved enquiries separately, review their continued necessity and permanently delete them. If further retention is necessary, use is restricted to that purpose.

Google specifies a few weeks for IP addresses logged by Firebase Authentication. After account deletion has been initiated, removal of other authentication data from live and backup systems may take up to 180 days. Details are provided in the Firebase Privacy and Security information.

Hashes and technical user identifiers are pseudonymised data; hashing alone does not make them anonymous. The restriction identifier retained after account deletion is based on Article 6(1)(f) GDPR. Its legitimate purpose is to protect the deleted account against new writes using authentication tokens that were already issued. Automatic cleanup of this restriction identifier is not currently configured. Whether continued retention is necessary can be reviewed as part of a deletion request.

10. Your rights

Under Settings → Your data, you can download all data retrievable through the account data interfaces and securely associated with your account as a machine-readable JSON file or a readable HTML copy. This includes your profile and profile picture, sign-in methods, account status, roles, stored sign-in and password-change timestamps, username assignments, projects and settings, and your own component suggestions and bug reports with feedback. Existing reset requests and your own administrative activity are also included; other people's account content remains protected. The original stored project payload is retained as well, so older fields are not lost. Passwords, password hashes, session tokens and secret authentication keys are not included. The current shared component catalog is not exported separately. The file explains its scope and areas that need to be requested separately.

Service providers' technical logs, email correspondence, enquiries through the public contact form and any data from previous accounts that cannot be directly associated are not fully retrievable through this download. For additional access, even without access to the app, contact info@spokepilot.de. The download does not limit your statutory right of access. A full personal data disclosure is generally free of charge and can also be requested without signing in. We respond without undue delay, generally within one month of receipt. We will inform you within that month of any justified extension. We request additional proof of identity only where there are reasonable doubts.

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on your consent, you may withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before it.

Right to object where legitimate interests apply

You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. Please contact info@spokepilot.de. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

You may also complain to a data protection supervisory authority, particularly in your place of residence, place of work or the location of a suspected infringement. For the operator in North Rhine-Westphalia, the competent authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia .

Spokepilot does not make solely automated decisions about you with legal or similarly significant effects and does not carry out corresponding profiling.