The iPhone app — what stays on your phone

Everything, unless a line further down says otherwise.

The iPhone app — what leaves your phone

Eleven entries, and not one of them is a surprise: an account you connected, something a map needs, the name of a place you sail, a mail you wrote and sent yourself, what iOS itself already knew about a crash on this phone, a question you asked, and — while this is a beta — Apple’s own crash reports and one small file the app reads to see whether your build is still the current one. There is no twelfth.

intervals.icu — only if you connect it

If you paste your own intervals.icu API key into Settings, the app uses it to download your Garmin activities from intervals.icu so they arrive without you exporting files by hand. The key is stored in the iOS Keychain, is never copied into iCloud, and is sent only to intervals.icu, only as the login header on those requests. The traffic is one-way: CleanJibe reads your activity list and your original files, and never uploads a session, an analysis or anything about you. Clear the key in Settings and every request stops. Connect nothing and none is ever made.

Strava — only if you connect it

Import → Strava, or Settings → Strava, opens Strava's own consent page: you sign in to Strava there and not to us, and Strava itself tells you what is being asked for. What is asked for is read access (activity:read_all) and nothing else. CleanJibe lists your activities, and for the ones you pick it downloads their positions, their clock, their elevation and their heart rate. It never writes — no activity, no description, no comment — and nothing in the app is a quiet step towards it. The access token it gets back lives in the iOS Keychain on your phone, is never copied into iCloud, and is sent only to Strava. Disconnect, on either of those two screens, deletes it from the phone and also asks Strava to revoke it, the same as unlinking it yourself at strava.com/settings/apps; if your phone is offline when you disconnect, the token is still deleted here, and that page is where you can check or finish the job. Strava lets a new app connect a limited number of riders, which the app says out loud rather than reporting as a failure; if you are told the app is full, tell us. Sessions that arrive this way carry positions and no measured speed, so their speed records are marked estimated — an accuracy note rather than a privacy one, and the Import screen makes it before you tap rather than after.

The Strava sign-in comes back through cleanjibe.org

Strava returns a rider only to an address on the one web domain it has on file for an app, and refuses custom app links outright. Ours is cleanjibe.org, so the last hop of the sign-in loads cleanjibe.org/strava/callback for about a frame and that page hands the result straight back to the app. It is a single static file with no stylesheet, no counter and nothing third-party on it — an authorization code is a credential for the next few seconds and must not be handed to anybody's script. GitHub Pages, which serves this site, sees that request the way it sees every other page load on it: a URL, which in this one case has that single-use code in it, a time and an IP address. There is no code of ours on that server and nothing is stored. The code is then exchanged for the token between your phone and Strava directly, and is worthless afterwards.

Apple Maps — when a map is on screen

The session map, the full-screen map, the replay and the share card's optional map background are all drawn by Apple's MapKit, which fetches map imagery for the area you sailed in. Apple therefore sees roughly where the session was, under Apple's own privacy policy and with no identifier of ours attached. The share card's map background is off unless you turn it on; the session maps you can simply not open.

Apple Maps again — the map this phone draws for a Garmin watch

A Garmin cannot be given a real map, so CleanJibe draws it one: a coarse land/water/road picture of a 3 km box around a spot, one or two kilobytes, which the watch blits under its breadcrumb. That picture is rendered by the same MapKit, which means Apple sees the area of that spot even with no map anywhere on your screen — the part worth saying plainly. It happens when you press Send map to watch, and by itself at app launch and after an import. Which spots: the two you have ridden most, unless you tick your own under Settings → Garmin watch → Map for the watch, which replaces that automatic pair with your picks. When nothing about the pair has changed since last time, nothing is rendered and nothing is asked of Apple. The finished picture goes over Bluetooth to the watch and to nobody else.

Apple's place-name lookup — one rounded coordinate, once per new spot

When the app meets a sailing spot it has not seen before, it asks Apple’s reverse-geocoding service what that place is called, so your spots read “Nago-Torbole” instead of “Spot 3”. What is sent is a single coordinate — the centre of that spot, rounded to about 110 m — and nothing else: no session, no track, no name, no identifier, no account, and no CleanJibe server anywhere in the path. Once per new spot, never again for a spot that already has a name, and never at all if you name your spots yourself. Apple sees roughly where you sail, under Apple’s own privacy policy.

A feedback mail — written by the app, sent by you

Menu → Support & ideas, the quiet Something off, or an idea? Send feedback at the foot of every page, and Report a problem with this session… on a session's share sheet all open one thing: a mail to info@cleanjibe.org in your own Mail app, with the facts already typed in. Those facts are the build number, your iPhone model, iOS version and locale, the paired watch and which version of the CleanJibe watch app it runs, and the shape of your library — how many sessions, and how many came in by each door. Sent from a session page it also names that session's date, spot, duration and source, and attaches that session's share card. If iOS has noticed a crash, a hang or a heavy write to disk on this phone since the last mail, the newest few print too: roughly when, what iOS called it, and where in the app it happened. iOS keeps those itself, on this phone, in every channel including the App Store one, and prints them here because there is nowhere else a rider on that channel could ever read them. There is no track, no file and no coordinate in it. Every line is editable, and nothing is sent until you tap Send: it is an ordinary mail, through your own mail account, to a mailbox. There is no CleanJibe server anywhere in that path either.

One session, sent by you, from its Share page

Send this session to us on a session’s Share page is in the public beta. It opens one mail with your notes on it and that session’s recording attached, as it was imported. The file holds your track, your heart rate and your times. It is used only to improve the detection and it is never published. Under your notes it carries the same facts the feedback mail carries, plus that session’s duration, distance, jibe tally and wind source. Nothing runs in the background and nothing is sampled: it happens once, for one session, because you asked for it. You read the whole mail first, every line is editable, and nothing is sent until you tap Send. The browser app offers the same thing on a session’s Details tab, through your own share sheet or a download and a mail. There is no CleanJibe server in either path.

TestFlight — crash reports, for as long as this is a beta

The iPhone app is installed through Apple's TestFlight, and TestFlight collects crash reports, plus the feedback you send from inside it, and passes them to us: the device model, the OS version, and the stack trace of what fell over. No session, no track, no file, nothing out of your library. That collection is Apple's, under Apple's TestFlight terms and the sharing choice you made when you accepted them — we neither add to it nor can switch it off — and it ends when the app leaves TestFlight for the App Store.

One small file on this website — is your beta build still the current one?

While this is a beta, the app fetches a single file of about three hundred bytes from cleanjibe.org — at most once a day, and nothing else about it — which says which TestFlight build is current, so it can tell you when the one you are holding is older than the one we are answering reports about. The request carries nothing: no key, no identifier, no session, not even which build is asking — it is the same static file for everyone, the comparison happens on your phone, and nothing is ever sent back. If it fails, you are told nothing and the app simply tries again tomorrow. GitHub Pages, which serves this site, sees it the way it sees any page load here: a URL, a time and an IP address. The App Store build does not do this at all.

Ask CleanJibe — a question you send, in the development build

Help and a session's page have a box where you can ask a question. The first time, a page says what is sent; nothing is sent until you send a question. Then your question, the app's version and your units go through Cloudflare to Anthropic, whose Claude writes the answer from our help texts. Asked from a session, that session's numbers go too: its date and times, speeds, flights and every turn's verdict, but no map, no positions and no name. We keep the question and the answer for 30 days to improve the answers, then they are deleted. Apple's App Attest confirms that the question comes from this app, which counts the daily limit of 20 questions: a key made on your phone for that alone, deleted on our side after 30 days unused. No account, no cookie. Anthropic's privacy policy is at anthropic.com/legal/privacy. The App Store build and the beta do not have it yet.

And nothing else. The app contains no analytics, no crash reporter, no advertising, and no third-party tracking code of any kind — the crash reports above are Apple's, collected by TestFlight around the app rather than by anything we put inside it. It never asks for the App Tracking Transparency permission because it has nothing to ask for. Your data is not sold, rented or shared with anyone, and there is no one to share it with.

What the app asks permission for

Five prompts exist, all of them optional, and none of them appears until you use the feature behind it.

Health — both directions, both off by default

Writing: if you turn on workout export, CleanJibe adds your imported sessions to the Health app as workouts. Reading: if you record on an Apple Watch with Apple's own Workout app, Import → Apple Health can read those workouts — their GPS route and heart rate, and nothing else — so CleanJibe can analyse them like any other recording. It reads only the workout types you choose and only the sessions you pick, never your steps, sleep, weight or anything else in Health. Both directions are off until you switch them on, everything read stays on the phone, and nothing about a workout is ever uploaded.

Photos — add only

Asked only when you save a replay clip you just recorded to your camera roll. CleanJibe holds add-only access: it can put that one video in and cannot read your photo library. Photos you choose to splice into a clip are handed over by the system picker one at a time, without granting the app library access.

Location — one tick, one fix per map you send

There is exactly one reason CleanJibe ever asks where you are, and you have to ask for it first. Under Settings → Garmin watch → Map for the watch there is a tick called “Where I am now” — for the afternoon at a lake your library has never seen and could therefore never name. Ticking it brings up the standard iOS prompt, and what is asked for is while using the app. After that the phone reads its position once per map send: one fix, never a running update, never in the background. The coordinate is used for one thing — the corners of the 3 km box rendered on this phone and pushed to the watch. It is not stored with your sessions, not attached to anything, and not sent anywhere. Leave the tick alone and the prompt never appears at all; the automatic send at launch never prompts, and includes “Where I am now” only if you had already allowed it. Every other coordinate the app shows was already inside a file you imported.

Bluetooth — for the Garmin handoff

Used to talk to a Garmin running the CleanJibe watch app: to receive the session summary it sends when you stop recording, to send the wind direction back, and to push the kilobyte or two of coastline the watch draws under its breadcrumb. All of it rides on the Garmin Connect app's own link; CleanJibe pairs with nothing itself, and none of it goes over a network.

Notifications — only if you switch them on

Asked only when you enable the background check for new intervals.icu activities. Leave it off and the app schedules no background work.

The app never follows you around. There is one location prompt, the one above, and it exists so a map can be drawn for your watch: one fix at the moment you send a map, with the app in front of you, never in the background, and never at launch unless you had already allowed it. No background location, no geofence, no visit history, and nowhere that a position of yours is kept.

The website — cleanjibe.org

The analyzer at cleanjibe.org/app is the same engine as the phone app, running inside your browser tab.

The website — what your browser loads

A web page is a set of requests. These are all of them, and what each one can see.

umami — anonymous, cookie-free page counts

Every page here loads a small counter from Umami Cloud. It sets no cookie and stores no identifier that survives your visit, so there is nothing to consent to and nothing to opt out of. What it records is that a page was opened, which page, roughly from where, on roughly what kind of browser. It also counts named actions like a card made, with only a format, a count or a tab name. Like any web request, it necessarily reaches Umami Cloud's servers with your IP address and browser user-agent, which is how "roughly from where" is derived; Umami does not store the IP itself. It never sees your session, your file, or any number off a ride. If you would rather it did not run, any content blocker stops it and the site works identically without it.

Ask CleanJibe — the help desk on the Help page

The Help page has a box where you can ask a question. Nothing is sent until you send one. Then your question and the answer go through Cloudflare to Anthropic, whose Claude writes the answer from our help texts only. We keep the question and the answer for 30 days to improve the answers, then they are deleted. A daily limit of 20 questions is counted with a pseudonym derived from your IP address that changes every day, and the address itself is not stored. No account, no cookie, no location. Please do not type personal details into the box. Anthropic's privacy policy is at anthropic.com/legal/privacy.

The analysis runtime — jsDelivr and PyPI

The analyzer's engine is Python compiled to WebAssembly. The first time you analyse something, your browser downloads it — about 14 MB — from the jsDelivr CDN and one package from PyPI, then caches it for good. Those two see a download request from your IP address, as any file download does. They receive nothing about your session, which has not been read yet when they are asked.

OpenStreetMap — only for a map background you switch on

A share card and a session's own track map can both be drawn over a map. That background is off unless you turn it on, and when you do, your browser fetches map tiles for that area from the OpenStreetMap Foundation, which therefore sees the area and your IP address. Leave it off and no tile is ever requested. (The iPhone app uses Apple Maps for the same job, as above.)

OpenStreetMap — only when you look a spot name up

The browser app groups your sessions into spots and can put a name on each. That name comes from Look up names again, which you press yourself, and when you do, your browser asks the OpenStreetMap Foundation's reverse geocoder what that place is called. What is sent is one coordinate — the centre of that spot, rounded to about 110 m — and nothing else: no session, no track, no name, no identifier and no account. It is asked once per spot, at most once a second, and the answer is kept in this browser. Never press it and nothing is ever requested. (The iPhone app asks Apple's geocoder for the same thing, as above.)

intervals.icu — only if you paste a key

Same as on the phone: your key, your activities, download only.

There is nothing else. No advertising, no tracking pixels, no social widgets, no embedded fonts from anyone, no consent-management vendor, and no request that carries anything about a ride of yours.

Keeping it, and getting rid of it

There is no retention period, because there is nowhere for anything to be retained. What exists is on your device, and you control all of it.

On the phone

Swipe a session in the library to delete it — the row, the analysis and the original file all go. Clear your intervals.icu key in Settings to stop every network request the app can make. Deleting the app removes the whole library at once. One thing worth knowing: because the library is ordinary app data, an encrypted iPhone backup — iCloud or a computer — contains it, and restoring that backup brings it back. That backup is Apple's, under Apple's terms; CleanJibe cannot see it.

In the browser

Delete a session from the library, or clear site data for cleanjibe.org in your browser's settings to erase everything the analyzer has kept, key included.

Your rights, and why they are quick to exercise

Under the GDPR you have the right to access, correct, export, delete and object to the processing of your personal data. Because CleanJibe holds none of it — no account, no server, no copy of any session — there is nothing for us to hand over or erase on request, and the delete controls above are the whole of it. If you think that is wrong, write to us and we will look. You can also complain to a data protection authority in your country.

Children, changes and contact

Children

CleanJibe is a sports tool suitable for all ages and collects nothing from anyone, including children. It contains no advertising, no purchases and no way to reach another person.

Changes to this policy

If what the app or the site does with data changes, this page changes with it and the effective date at the top moves. Because this page lives in the project's public repository, every past version of it is readable there too.

Who to write to

CleanJibe is made by Jan-Rainer Lahmann in Germany. Questions about this policy, or about anything on this page you think is inaccurate, go to info@cleanjibe.org — or, if you would rather ask in public, as an issue on GitHub.

The claims on this page can be checked rather than taken on faith: the app and the site are open source at github.com/JanLahmann/WingFoil, and every network request either of them can make is in that code.