← IoT Privacy Database

Peloton Bike

Peloton Interactive · E-Bike / Fitness Equipment

Staff Reviewed — a person at DeSpy reviewed this rating.

5.9Surveillance
Index
Policy — what its policy permitsD
Evidence — what research provesF

Collects age, gender, city, weight and workout statistics tied to an account, and a 2021 leaky API let researchers access private profile data that users had explicitly marked private.

Why this rating

Peloton collects age, gender, city, weight and workout data tied to an account, and a 2021 API vulnerability let researchers access other users' private profile data that had been explicitly marked private — a clear security failure.

What it is

Manufacturer
Peloton Interactive
Category
E-Bike / Fitness Equipment
Model years
2014-present
Market status
Current
Companion app
Peloton

The evidence 2

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. SiliconANGLE: Open API Exercise Equipment Company Peloton Exposed Private User Data
    Major breach · SiliconANGLE · 2021-05-05

    Security researchers found a Peloton API leak in 2021 that let anyone access other users' age, gender, city, weight and workout data, even when marked private.

    Why it matters here: Direct report on the 2021 Peloton API leak exposing private user profile data.

  2. TechCrunch: Peloton Bug Leaked Account Data
    Major breach · TechCrunch · 2021-05-05

    TechCrunch's coverage confirming the Peloton API vulnerability exposed private user profile data to unauthorized requesters.

    Why it matters here: TechCrunch confirmation of the Peloton API vulnerability.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database