Privacy policy

Short version: this is a static site with no accounts, no comments and no working review-submission form. We set no cookies and store nothing in your browser. Two companies see that you requested a page — our host and our analytics, which are the same company — and neither of them, and neither do we, builds a profile of you. If you subscribe to the newsletter, your email address is the only personal data we hold — what happens to it is written down below.

In force since 2026-08-26.

What we collect directly: your email address, if you give it to us

We have no accounts, no login and no comment threads. There is exactly one form on this site that does anything: the newsletter sign-up box in the footer. If you type an address into it and press the button, we hold that address, and nothing else — the newsletter section says what happens to it. If you never touch that box, we hold nothing about you at all.

The review submission form is the other form you will see, and it is deliberately inert — every field disabled and no destination to send to, so nothing you type into it leaves your browser.

We set no cookies. Not analytics cookies, not preference cookies, not "essential" cookies. We use no local storage, no session storage and no fingerprinting. If a browser extension tells you this site set a cookie, we would like to know about it.

What our host and analytics see

The site is hosted on Cloudflare Pages and uses Cloudflare Web Analytics. Cloudflare is therefore a processor for us, and the only third party involved in serving you a page.

Serving the page. Like any web host, Cloudflare receives your IP address and user-agent as part of the request, and uses them to deliver the page and to block abuse. We do not have access to raw server logs and do not keep our own.
Analytics. Cloudflare Web Analytics is cookieless and stores nothing in your browser. It reports which pages were viewed, referrer, load performance, and coarse country / browser / device type derived from the request. It does not assign you an identifier and does not follow you to other sites.
What we see. Aggregate counts only — page views, referrers, rough country. We cannot identify an individual visitor from it, and we do not try.

The analytics script is loaded from static.cloudflareinsights.com. It is the only external request any page on this site makes: no ad networks, no tag managers, no embedded fonts, no social widgets, no third-party images.

If you'd rather not be counted at all, any content blocker that blocks cloudflareinsights.com stops it, and the site works identically without it.

What we do not do

We do not sell, rent or share personal data. There is none to sell.
We do not run advertising or advertising trackers.
We do not use tag managers, session recording, heatmaps or A/B testing tools.
We do not email you unless you asked us to. The sign-up box is the only way to ask.
We do not sell, rent, share or trade the subscriber list — not to advertisers, not to manufacturers, and not to the brands whose bikes we write about.
We do not use your email address to work out which pages you read. Our analytics cannot see who you are, and we do not join the two together.

Affiliate links

We currently have no affiliate relationships at all — see the affiliate disclosure, which is generated from our database and cannot drift out of date. If that changes, following such a link takes you to the retailer's own site, and what they collect is governed by their privacy policy, not this one. The link itself sets nothing on our side.

In force. There is a sign-up box in the footer of every page, so everything below applies. It was written and published before the box existed rather than after, which is the order these things should happen in.

What we collect. Your email address. That is the entire list. It reaches us only because you typed it into a sign-up box and pressed the button — we do not ask for a name, a location, an interest or anything else, and there is nowhere to enter them.

What we use it for. Sending the newsletter: new data we have published, notable price changes, and changes to the state law pages. Nothing else. If an email ever carries something a reasonable person would call an advertisement, it says so at the top, and any affiliate relationship is disclosed in the email itself rather than only here.

How to leave. Every email carries an unsubscribe link at the bottom. One click, no login, no "are you sure", no reason required. It takes effect immediately, and unsubscribing deletes your address rather than flagging it as unsubscribed — so there is no dormant copy of it sitting on a list you think you have left. You can also email us and we will do it by hand.

Who else handles it. We use Buttondown to store the list and send the emails, so your address sits on Buttondown's systems as well as being visible to us. They are our processor: we decide what is collected and why, they act on our instructions. Their privacy policy is at buttondown.email/privacy.

What we can see. Aggregate delivery information — how many emails went out, how many bounced. We do not build a per-subscriber profile of who opened what.

Where it is processed, and for how long. Buttondown is a United States company and the list is held in the United States; if you subscribe from outside the US, your address is transferred there. We keep it until you unsubscribe, or until the newsletter stops existing — at which point the list is deleted rather than archived.

When review submissions open

None of this is in effect yet. The submission form is not connected to anything. This section describes what we intend to collect when it opens, so that the commitments are on the record before the code is written rather than after.

At that point a submitted report would involve:

Your email address, used once to verify the report is from a real person. Stored as a hash, never published, never sold, never shared.
An optional display name, published with your report if you give one. Leave it blank and the report is anonymous.
The report itself — bike, miles achieved, rider weight bracket, terrain, assist level, reliability notes. This is the data the site exists to publish, and it is published.
A hashed IP address and user-agent, used only to detect spam and duplicate submissions, and discarded on a schedule.
Any photo you upload, with EXIF metadata stripped before storage.

Why the EXIF point is not boilerplate. A photo of a bike taken in someone's garage usually carries their home GPS coordinates in its metadata. Stripping that has to be a property of the upload code, not a sentence in a policy — which is exactly why we would rather not accept photos at all until that code exists and has been tested.

Before submissions open, this section will be replaced with a description of what the system actually does, along with retention periods, how to request deletion or a copy of your data, and our position under GDPR / UK GDPR and the CCPA.

Children

This site is not directed at children and we knowingly collect nothing from anyone. When submissions open they will be limited to adults.

Changes

If this policy changes materially we will say what changed and when, on this page, rather than silently updating a date. The current version is the one you are reading.

Contact

Questions about anything on this page, including a request to see or delete anything we hold: [email protected].