Privacy Policy

Bike Flux Vault ("we," "us," or "our") operates www.bikeflux.com (the "Service"). This Privacy Policy explains what information we collect, how we use it, and your rights with respect to it. By using the Service you agree to the practices described here.

1 Information We Collect

Information you provide directly

• Account registration: username and email address.
• Bike builds: make, model, year, type, frame material, image URLs, and any notes you choose to add.
• Components: category, brand, part name, and weight entered via the component editor.
• Reports: the reason text you submit when reporting a build for moderation.

Information collected automatically

• Log data: IP address, browser type, pages visited, and timestamps, recorded in standard server logs.
• Session data: a session cookie is set on login to maintain your authenticated session. It is HTTP-only, not accessible to JavaScript, and expires after 24 hours of inactivity.
• View counts: we count page views on public bike builds to show popularity; this data is not linked to individual visitors.

2 How We Use Your Information

• To create and maintain your account.
• To display your public bike builds to other visitors (only builds you mark as public are shared).
• To calculate and display component weights.
• To process likes and abuse reports.
• To operate the admin moderation queue.
• To detect and prevent spam, fraud, and abuse (including rate-limiting by IP address).
• To diagnose technical problems via server error logs.

We do not sell, rent, or share your personal information with third parties for their own marketing purposes.

3 Cookies

We use one first-party session cookie (bike_flux_session) strictly to maintain your login state. No third-party tracking cookies or advertising pixels are used. The Service loads external resources from Google Fonts, Tailwind CSS CDN, Font Awesome CDN, and Unsplash (for demo images only) — these providers may set their own cookies subject to their own privacy policies.

4 Data Retention

Your account and all associated data are retained for as long as your account is active. Deleted bike builds are removed immediately and are not retained in backups beyond the next scheduled backup rotation. Server log files are retained for up to 30 days. You may request deletion of your account and all associated data at any time by contacting us (see Section 7).

5 Security

Passwords are hashed using bcrypt and are never stored or transmitted in plain text. Sessions use HTTP-only cookies, CSRF tokens, and periodic session ID rotation. All form submissions are protected against cross-site request forgery. Despite these measures, no internet transmission or storage system is 100% secure; we cannot guarantee absolute security of your data.

6 Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.

7 Your Rights & Contact

You may request access to, correction of, or deletion of your personal data at any time. To exercise any of these rights, or if you have questions about this policy, contact us at:

8 Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Continued use of the Service after any changes constitutes acceptance of the updated policy.