Privacy at BikeGenie

Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

In short

BikeGenie manages your bikes and maintenance and answers questions with AI. For that you create an account, I store your entries and send AI requests, including photos, to Google. Google's audience measurement only runs if you agree in the cookie banner.

There is no profiling and no automated decision with legal effect. Fonts come from the same server as the page.

When you open the site

When you open the site, your browser sends details without which it cannot be delivered: IP address, date and time, the requested address, the page you came from (referrer) and the browser identifier.

The site is hosted at Netlify, with Cloudflare in front. Cloudflare encrypts the connection, blocks attacks, caches content and produces aggregated traffic statistics from the requests. No script runs in your browser for this.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest: delivering the site securely and reliably and seeing how often it is opened. How long the providers keep their logs follows their own terms.

Netlify, Inc.

101 2nd Street, San Francisco, CA 94105, USA

Data may be transferred to the USA. Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Cloudflare, Inc.

101 Townsend St., San Francisco, CA 94107, USA

Data may be transferred to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Storage in your browser

BikeGenie keeps in your browser: your cookie choice, language and appearance, your sign-in, a timestamp for automatic sign-out after four hours of inactivity, drafts and lists (such as tools and parts), cached repair guides for offline use and the state of the newsletter prompt. This is needed for the site to work the way you use it (section 25(2) no. 2 TDDDG).

The entries stay until you clear this site's browser storage; session data lasts until you close the tab.

Account

To sign in I need your email address and a password; Supabase stores the password only as a hash. You may add a name. I also store your settings, for example whether your profile and bikes should be visible to the community. The default for the profile is "public", for the bikes "not public". In the community your name appears next to your questions and answers.

The legal basis is Art. 6(1)(b) GDPR. The data stays until you have your account deleted. Supabase (Singapore) runs sign-in, database and storage; the transfer relies on standard contractual clauses.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Your bikes, maintenance and the community

Stored are your bikes with components, the maintenance history, reminders, the AI chat history and your community posts (questions, answers, votes). Bike photos sit in Supabase storage and can be retrieved via a public address, even if you do not share the address; upload only images anyone may see.

Community posts are visible to other signed-in users. The legal basis is Art. 6(1)(b) GDPR. The data stays until you delete it or your account.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

AI chat and photo diagnosis

For chat, diagnosis and search suggestions your browser sends the input to a function on my server, which passes it to Google's Gemini API: your text and, for photo diagnosis, the photo, which is downsized first. The key is not in your browser. The photo should show only the bike and its parts, no people or number plates.

According to Google's terms, within the European Economic Area the rules of the paid tier also apply to the free tier: inputs are not used to train the models. The chat history is stored in your account (see above).

The legal basis is Art. 6(1)(b) GDPR.

Google LLC

1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Audience measurement with consent

With your consent in the cookie banner the site loads Google Analytics 4. Google then receives page views and events, your IP address is shortened, and advertising features and personalisation are switched off. Without consent nothing is loaded.

The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). The banner appears only on the first visit; the app currently has no switch to withdraw later. You withdraw by clearing this site's browser storage and cookies, after which the banner asks again.

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Connecting Strava

If you connect Strava, the site sends you to Strava. After you approve, my server receives an access token, stores it encrypted and reads your activities to calculate maintenance intervals by distance ridden. You can disconnect in BikeGenie.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by connecting and withdraw by disconnecting.

Strava, Inc.

181 Fremont Street, Floor 27, San Francisco, CA 94105, USA

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Newsletter and contact form

If you sign up for the newsletter, the site sends you a welcome email through Resend. The app currently keeps the subscriber list only in the browser storage of the respective device; I keep no central list. The unsubscribe link is in every email.

If you submit the contact form, name, email address, subject, message and, if you include them, technical details about your device go through Resend to my mailbox.

The legal basis for the newsletter is your consent (Art. 6(1)(a) GDPR), for the form Art. 6(1)(b) or (f) GDPR.

Resend, Inc.

2261 Market Street #5039, San Francisco, CA 94114, USA

Provider’s privacy policy

When you write to me

If you email me, I process your address, the content and the timestamps of the message to reply. Cloudflare (Email Routing) receives the contact address and forwards it to my mailbox at goneo. I delete the message once your matter is settled, unless statutory retention duties require longer. The legal basis is Art. 6(1)(b) or (f) GDPR.

Resend, Inc.

2261 Market Street #5039, San Francisco, CA 94114, USA

Provider’s privacy policy

Cloudflare, Inc.

101 Townsend St., San Francisco, CA 94107, USA

Data may be transferred to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

goneo Internet GmbH

Dresdener Straße 18, 32423 Minden, Germany

Provider’s privacy policy

Deleting your account

The app has no button for this. Write to me at the address above and I will delete your account and all related data.

Links to other sites

Links to shops, Strava or GitHub are ordinary links. Your browser connects to the target only when you click one; the privacy policy of that provider applies there.

Your rights

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests (Art. 21). An email to the address above is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live.