Privacy & cookies

Last updated: October 7, 2026.

This page explains what personal data IDbike (idbike.org, app.idbike.org, our Telegram bot and API) collects, why, who sees it, how long we keep it and what you can do about it. It complements the Rules. Questions or requests: info@idbike.org.

1. Who is responsible

The IDbike service is the controller of the data described here. You can reach us at info@idbike.org.

2. What we collect and why

Your account

Name, email address and a password (stored only as a one-way hash). Optionally: phone number, other contacts, language and theme, the public-profile choices you make, and your Telegram chat ID if you link the bot. We use this to run your account, sign you in and send service emails (verification, password reset, notifications about your bikes).

Your bikes

Brand, model, frame number, colours, description, city and country, and photos. The public card shows only what you choose to make public (the frame number appears truncated; your contact details are not shown unless you explicitly allow it while a bike is marked wanted). Photos of numbered parts and ownership documents (receipts, technical passports, bills of sale) are stored privately, scanned for viruses, and are visible to you and — only where needed to investigate theft, fraud or to answer a lawful request — to service administrators.

To keep the history of a bike trustworthy, we keep an internal record of ownership periods, status changes and uploaded documents, including copies of files you later replace or remove from display. This record is not public.

Messages you send through the site

If you tell an owner you found their bike, or write to a seller, we store your message, the location or map pin you give, the contact you provide and your IP address, and forward the message to the owner or seller by email and Telegram. Their contact details are not shown to you.

Searches and technical logs

When you check a frame number we store the query and your IP address. Our servers log, for each request, the IP address, the page address, the referring page and your browser's user agent (one-time links are redacted before they are stored); we also keep a record of sign-ins (IP, browser) and failed form submissions. We use this to run and secure the service, prevent abuse and investigate incidents. Request logs are deleted after 90 days.

3. Legal bases

to provide the service you asked for (account, bikes, messages) — performance of a contract;
security, abuse prevention, support for theft investigations and keeping the bike history reliable — our legitimate interests;
analytics and advertising cookies — your consent where the law requires it;
compliance with legal obligations and lawful requests from authorities.

4. Cookies and similar technologies

Strictly necessary

A session cookie (idbike-session) and a security token (XSRF-TOKEN) keep you signed in and protect forms; a language choice may be remembered. Your light/dark theme is kept in your browser's local storage. These do not need consent.

Analytics and advertising (Google)

We use Google Analytics 4 to see how the site is used and Google AdSense to show ads on the landing page. They set cookies such as _ga, _ga_*, __gads and __gpi and share data (including your IP address) with Google. For visitors in the EEA, the United Kingdom and Switzerland these stay off until you choose in Google's consent message; you can change your choice at any time with the "Cookie settings" link in the footer. Elsewhere they are active by default and you can block them in your browser. Google acts as an independent controller for ad personalisation; see how Google uses data from sites that use its services.

5. Who receives your data

We do not sell your personal data. It is processed by providers that help us run the service: our hosting provider, our email delivery provider, Telegram (if you use the bot), Google (analytics, ads, reCAPTCHA) and the third-party content hosts listed above. Some of them are located outside your country, including outside the EEA; where required, transfers rely on the provider's standard contractual safeguards. We disclose data to authorities only when the law requires it.

6. How long we keep it

Account and bike data: while your account exists. After you delete the account you can restore it for 30 days; later your login email is freed for reuse.
Request logs: 90 days.
Ownership history, status events, the document archive, sign-in records and messages relating to bikes: for as long as needed to prevent theft and fraud, handle disputes and meet legal obligations — they may outlast your account, but are never public.

7. Your rights

Depending on where you live, you can ask us to give you access to your data, correct it, delete it, restrict or object to its use, or give it to you in a portable form, and you can withdraw consent at any time. Write to info@idbike.org from the email address of your account. You also have the right to complain to your data protection authority. You can edit your data and delete your account yourself in the personal cabinet.

8. Security

The site is served over HTTPS; passwords are hashed; private documents are not reachable by a web address and are virus-scanned on upload; administrator access requires a second factor. No system is perfectly secure — if you suspect misuse of your account, contact us right away.

9. Children

The service is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has registered, tell us and we will remove the account.

10. Changes

We will update this page when our practices change and show the date at the top. Material changes will be announced on the site.