Peloton’s API exposes riders’ private data