Privacy Policy

For Nabe on iPhone and for this website · published by outperform GmbH · last updated 3 October 2026

The Nabe app sends us no personal data. There is no account, no server of ours that receives your rides and no analytics in the app. What it knows about your training stays on your iPhone, except what you tell it to send to your own accounts at the services you connect. The short version ends here; the rest spells it out.

Who is responsible

outperform GmbH, Sömmerlistrasse 14, 9000 St. Gallen, Switzerland, is responsible for the app and for this website. Contact: support@nabehub.com.

What the app stores, and where

• Your activities, the history Nabe loaded from the services you connect, and what happened to each activity, in a database on your device.
• Access tokens for Strava and Wahoo in the iOS keychain. Your Garmin session in the iOS keychain and in the storage of the in-app browser you signed in with.
• Activity files used for transfers, kept until every transfer of that activity is finished and then for 30 days, so a failed transfer can be retried, then deleted automatically. At most 500 MB, oldest first.
• Recordings shown in the ride charts. Recordings from Garmin, from Wahoo and from files you import stay on your device until you sign out of that service in Nabe or choose Delete data. Recordings built from Strava are deleted after 7 days. Heart rate and power zones from your Garmin profile are kept for the charts and refreshed after 30 days.
• The date you first opened the app, in the keychain and in iCloud key-value storage, so reinstalling does not restart the free period.
• A local network log: one line per request with method, address without query and status code, so that transfers can be checked. It never contains tokens, cookies, security codes or account details, holds at most two files of 256 KB and is overwritten after that.

None of this is transmitted to us. We have no way to read it.

What leaves your device

Only what you tell Nabe to move, and only to your own accounts. For each service you connect you decide whether Nabe reads from it, writes to it, or both. Nabe fetches activities from the services that read and sends them to the services that write: your own accounts at Garmin Connect, Strava and Apple Health. Wahoo is only a source: Nabe reads your workouts from Wahoo and sends nothing to it. Everything travels directly from your iPhone to these services. None of it is routed through a server of ours, and none of these services is a partner of ours. The only request the app makes to this website is the status check described next, and it carries no ride data.

The app also fetches a small status file from this website, nabehub.com/status/v1.json, when it syncs. It says whether a connected service is currently disrupted. The request contains nothing about you or your rides. Like every request to this website it is delivered by Cloudflare, which processes your IP address and keeps it in short-lived access logs. It is not counted in the visitor statistics. Purpose, provider, location and legal basis are listed under Delivery and protection below.

What Nabe never does

• No analytics, no tracking, no advertising identifier, no App Tracking Transparency prompt, because there is nothing to track.
• No third-party SDK that collects data, and no crash reporting service.
• No reading or storing of your Garmin password. You sign in on Garmin's own page inside the app, and iOS fills it from your keychain, which the app cannot read.
• No selling, sharing or licensing of your data. Not to anyone, for any purpose.

Health data

If you connect Apple Health, Nabe reads the workouts you allow it to read, with heart rate and route, and writes the workouts you allow it to write. A workout from Apple Health leaves your iPhone only when you have told Nabe to read from Apple Health and to write to another service, and then it goes only to your own account at that service. It is never sent to us, never passed to anyone else, and never used for advertising or for anything beyond the transfer you asked for. You can withdraw access at any time in the Health app.

The services you connect

Once an activity arrives at Garmin Connect, Strava, Apple Health or any other destination, that service's own privacy terms govern it from then on. Nabe is independent and not affiliated with any of them.

Data you send to a connected service

When Nabe sends an activity to your account at a service, that service receives it and handles it under its own privacy policy. The same applies to what Nabe reads: Garmin, Strava, Wahoo and Apple Health hold your data under their own terms. We have no control over what a service does with data once you have sent it there.

Subscriptions

Subscriptions are sold and billed by Apple. We never see your payment details, your name or your address. We receive anonymous sales reports from Apple that cannot be traced back to an individual customer.

This website and the app's status check

Every service that a visit to nabehub.com, or the app's status check, involves is listed here with what it processes, why, who runs it, where, and on which legal basis. Nothing else is loaded: no fonts, scripts or images from other servers, no cookies, no advertising, no social media plug-ins.

Delivery and protection: Cloudflare

• What happens: every page, image and file of this website, and the status file the app fetches, is delivered by Cloudflare. Cloudflare processes your IP address and the technical data sent with each request (address requested, time, browser or app type, referring page) and keeps them in access logs for a short period.
• Purpose: delivering the website and the status file, and protecting both against attacks and abuse.
• Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.
• Where: Cloudflare's worldwide network, usually a data centre near you; data can be processed in the USA. The transfer to the USA is based on the Swiss-U.S. Data Privacy Framework, under which Cloudflare is certified; where it does not apply, on the standard contractual clauses agreed with Cloudflare.
• Legal basis: our legitimate interest in a secure, working website and app (Art. 31 para. 1 Swiss FADP; Art. 6(1)(f) GDPR where the GDPR applies).

Visitor statistics: Cloudflare Web Analytics

• What happens: Cloudflare adds a small script to each page, loaded from static.cloudflareinsights.com. It reports the page address, the referring page, browser and device type, the country derived from your IP address and load times to Cloudflare. It sets no cookies, stores nothing on your device, uses no fingerprinting and does not follow you across sites. We see totals only. The status check of the app is not counted.
• Purpose: counting visits per page and measuring load times, to improve the website.
• Provider and where: Cloudflare, Inc., as above.
• Legal basis: our legitimate interest in anonymous statistics (Art. 31 para. 1 FADP; Art. 6(1)(f) GDPR). Because nothing is stored on or read from your device, this site needs no consent banner.

Email: Hostpoint

• What happens: if you write to support@nabehub.com, your message, your email address and whatever else you include are received and stored in our mailbox.
• Purpose: answering you and, if needed, following up. We keep a message for as long as that takes and do not add you to any list.
• Provider: Hostpoint AG, Neue Jonastrasse 60, 8640 Rapperswil-Jona, Switzerland.
• Where: Switzerland.
• Legal basis: your request (Art. 31 para. 1 FADP; Art. 6(1)(b) GDPR for questions about the app, Art. 6(1)(f) GDPR otherwise).

Typefaces and links

The typefaces are files on this website, delivered by Cloudflare as above; no request goes to a font service. Links to other websites, such as Apple's reportaproblem.apple.com, load nothing until you follow them; from then on that website's own privacy policy applies.

Your rights

Under the Swiss Data Protection Act and, where it applies, the GDPR, you can ask what data is held about you, have it corrected or deleted, and object to its processing. For the app the answer is short: we hold nothing, because nothing reaches us. For the website and email, write to the address below and you will get an answer. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, to the supervisory authority in your country.

Changes

If this policy changes, the new version is published here with a new date. The link in the app's settings always opens the current version.

Contact