1. Data We Collect

Account data (registered users)

• Email address — used to sign you in, verify your account, and send account-related email (verification, password reset). Never used for marketing without separate consent.
• Name — display name shown on your profile and public builds.
• Password — stored only as a bcrypt hash. We never store or see your plaintext password.
• Email verification status and timestamps (account created, last updated).

Sign in with Google (OAuth)

If you sign in with Google, we receive your name, email address, and profile picture from Google and link them to your BikeDialed account. We do not receive your Google password and we request no other Google data. Google's own privacy policy (https://policies.google.com/privacy) governs their side of the sign-in.

Content you create

• Bike builds — component selections, custom components (names, weights, prices), personal notes, target weight/budget, build names and descriptions.
• Sharing state — whether a build is public and its share link. Public builds (including your display name) are visible to anyone; private builds are visible only to you.
• Social actions — likes and saves on public builds.
• CSV imports — the contents of build files you upload are stored as build data.

Feature suggestions

The message and optional reply email you submit are emailed to BikeDialed via Resend to review your idea and reply. No account is required. We do not use them for marketing. Please do not include sensitive information.

Automatically collected data

• Server logs — our hosting provider records standard request metadata (IP address, user agent, timestamps) for security and operations.
• Usage analytics — we use Vercel Web Analytics to count page views and referrers in aggregate, including homepage visits, builder entry actions, wizard steps, and save attempts and outcomes. Funnel event properties contain only entry source, step, create/update action, or failure category, not build names, contents, IDs, or account information. Vercel analytics is cookieless. If you allow optional analytics, Google Analytics 4 also measures visits, traffic sources, engagement, builder entry actions, wizard steps, and save attempts and outcomes using analytics cookies. Google is not contacted by this integration before you consent. We do not send account information or build contents in save events. Advertising signals and personalization are disabled. Analytics also counts opening the suggestion form and successful submissions, without the suggestion text or reply email.

2. Cookies and Local Storage

• Optional analytics — Google Analytics cookies (_ga and _ga_*) are set only after you allow analytics, with a lifetime of up to 180 days renewed by visits. Your consent choice is saved in localStorage for 180 days. Use the control below to change your choice or withdraw consent; withdrawal stops collection and removes these analytics cookies from this site.
• Session cookie — an encrypted JWT session cookie keeps you signed in for up to 30 days. It is strictly necessary for authentication; deleting it signs you out.
• CSRF/auth cookies — set by the authentication layer to protect sign-in.
• Guest build draft (localStorage) — if you configure a bike without an account, your draft is saved in your browser's localStorage on your device (key bikedialed:guest-build-draft). It is not transmitted to our servers until you sign in and save the build. Drafts expire automatically after 30 days and can be removed at any time by clearing your browser storage.

We do not use advertising cookies and we do not sell or share personal data for advertising.

3. How We Use Data

• Provide the Service: store and display your builds, calculate weights and prices.
• Authenticate you and keep your account secure.
• Send transactional email (verification, password reset) via our email provider.
• Maintain, debug, and protect the Service (logs, abuse prevention).
• Understand traffic and improve the builder using usage analytics.
• Review feature suggestions and reply when you provide an email address.

We do not sell personal data. We do not use your data to train AI models.

4. Service Providers (Processors)

We share data only with providers needed to run the Service:

Vercel and, with consent, Google also receive categorical feedback opening and submission actions; suggestion text and reply emails are excluded from analytics.

5. Data Retention

• Account and build data are kept while your account exists.
• Guest drafts live only in your browser and expire after 30 days.
• Server logs are retained per our hosting provider's standard rotation.
• When you delete your account, your data is permanently deleted (see below).

6. Your Rights

Depending on your location (e.g. GDPR, UK GDPR, CCPA), you may have the right to access, correct, export, delete, or object to processing of your personal data.

• Access & export — your builds can be exported to CSV from within the Service.
• Correction — name and password can be changed on your Profile page.
• Deletion — you can permanently delete your account and all associated data yourself at Profile → Delete Account (/account/delete). This removes your builds, custom components, notes, and profile, and cannot be undone.
• For anything else, contact us (Section 9) and we will respond within 30 days.

7. Security

Passwords are hashed with bcrypt; sessions use signed, encrypted JWT cookies; all traffic is served over HTTPS. No method of storage is 100% secure, but we follow industry-standard practices and limit data collection to what the Service needs.

8. Children

The Service is not directed to children under 16 and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

9. Contact

Questions or privacy requests: [email protected]

10. Changes to This Policy

We will post any changes on this page and update the “Last updated” date. For material changes affecting registered users, we will notify you by email or an in-product notice before they take effect.