Privacy Policy

bikes.pizza is a place to share photographs of bicycles and pizza. This policy covers the bikes.pizza website and the bikes.pizza apps for iOS and Android, all operated by Pizza Predator LLC.

The short version: we collect what an account and a photo submission need, and nothing else. There is no analytics SDK, no advertising, no third-party tracker, and no profile built about you. We do not sell personal information, and we never have. Photos of people are refused automatically, and nothing is published without a human reviewer's approval.

What we collect

Your account

Signing up stores your email address and an account identifier. You can sign in with an email address and password, with Google, or with Apple. When you sign in with Google or Apple we receive your email address from them; if you use Apple's Hide My Email, we only ever see the relay address Apple gives us, not your real one.

You also choose a username. Your username is public: it appears on your profile page, on your comments, to members you message, and as the credit on anything of yours that is published. Your profile shows your username, when you joined, how many bikes and pizzas you have posted, and a location if you choose to add one. Pick a username you are comfortable having in public; it does not have to be your real name.

If you allow notifications, the app registers a push token for your device with Google's messaging service so that we can send them. The token identifies the app on that device, nothing else; it is stored with your account while you are signed in, invalidated when you sign out, and deleted with your account. Which notifications you get is up to you, under Settings in the app: new and updated posts (sent to every device that opted in, whether or not it is signed in), and, for members, direct messages, comments on your posts, and replies.

Comments and messages

Comments you write on posts, and direct messages you send to other members, are stored with your account and shown to the people they are for: comments to signed-in members, messages to the member you sent them to. Both are screened automatically before they are shown, and a comment can be held for a person to look at. Nobody at bikes.pizza reads your messages unless you or the other member reports the conversation. Your email address is not shown to other members, with one exception you control: if you and the other member both agree to continue a conversation by email, we send that conversation to the member who agreed, from bikes.pizza, with the other member's address as the reply address, so each of you can see the other's address from then on. Deleting your account deletes your comments (except placeholders where others have replied), your likes, and every conversation you were in, both sides included.

Passkeys and two-factor codes

If you create a passkey we store its public key, its credential identifier, and when it was created and last used. The private key stays on your device or in your password manager and is never sent to us — it is not something we can read, copy, or hand over. If you enroll an authenticator app instead, we store the shared secret that verifies your codes.

Submissions

When you submit a photo we store the image together with the title and description you attach to it, the account it came from (including its username and the email address on that account), and the time it arrived. Your email address is never published.

Please read the rest of this part carefully, because it is the one place where this policy asks something of you. A submission is an offer of the photo to the public. By submitting it, you grant Pizza Predator LLC a non-exclusive, worldwide, royalty-free, perpetual license to store, review, reproduce, resize, publish, and display the photo and its accompanying text on bikes.pizza and in the bikes.pizza apps, as part of a lasting public archive of bicycles and pizza. If a reviewer approves the submission it becomes a post, published with the title and description you supplied and credited to your username, and posts are intended to remain available indefinitely as a historical record.

Posts are not part of your account. A post you submitted is retained, and remains public with the username it was credited to, after your account is deleted, whoever deletes it and for whatever reason. The section "Published posts and requests for removal" below explains what can and cannot be done about that.

On your device

The app and the website keep a little information on your own device — whether you are signed in, your light or dark theme choice, and what is in your shopping cart. This stays on the device and is not a tracking cookie.

What we do not collect

We do not collect your location, your contacts, your health or fitness data, your browsing on other sites, or an advertising identifier. The app asks for camera and photo library access only so that you can choose a picture to submit. On iPhone and iPad you decide how much of your library the app can see, all of it or only the photos you select, and can change that in Settings; the app shows those photos on your device so you can pick one. Nothing is uploaded until you submit it.

No people, and a review before anything is published

bikes.pizza is a site about bicycles and pizza, not about people, and it is built to keep people out of the pictures. Nothing you submit is published as-is. Every photo passes two checks, in this order, before it can appear anywhere on the site or in the apps.

1. An automatic check, at the moment of submission. Before a photo is stored, it is sent to Google Cloud Vision, which reports whether it appears to contain a face or a person-shaped figure, and whether it appears to contain adult, violent, or racy content. A photo that reaches our threshold on any of those is refused on the spot: it is not saved, not queued, and not seen by a reviewer, and you are asked to choose a different photo. This is how we keep imagery of people off the site proactively rather than after the fact. The check is a filter applied to the image; it is not used to identify anyone, and the result is kept only as a note on the submission for the reviewer.
2. A human review, before publication. A photo that passes the automatic check goes to a reviewer, who decides whether to publish it, queue it, or reject it. Nothing becomes a post without that approval.

A word about the limits of this. Automated detection is not perfect, and a photo with no person in it can still contain something the submitter did not notice or did not intend to share: a reflection, a document on a table, a license plate, a name on a mailbox, an address, something in the background that is private, embarrassing, or unfortunate. The reviewer makes an honest, good-faith effort to catch such things and not to publish them, and rejects a photo when in doubt. That effort is a commitment to care, not a guarantee: we cannot promise that nothing of the kind will ever be published. Before you submit a photo, look at all of it, not just the bike or the pizza, because once it is published it is subject to the retention and removal terms in "Published posts and requests for removal", and the fact that something slipped past review is one of the reasons we give weight to when a removal is requested.

Who else processes your data

We use a small number of service providers, each handling only what its job requires:

• Google Firebase — accounts and sign-in, the database (including the posts published to the site), file storage for photos, the server functions behind the app, and Cloud Messaging for push notifications (through Apple's and Google's notification services on the device).
• Google Cloud Vision — the automated photo check described above.
• Shopify — runs the shop. If you buy something, your order and payment details are handled by Shopify under their privacy policy; we never see your card number.
• Cloudflare — serves the website and its domain, and delivers the email the app sends: the notice that tells a reviewer a submission is waiting, concern reports, account deletion confirmations, and conversations you chose to continue by email.

Deleting your account

You can delete your account yourself, at any time, from the Settings screen in the app or from the account page on this website; the step by step is on its own page. Deleting an account removes your sign-in details, your email address as an account identifier, your username and profile page, your passkeys, and any authenticator enrollment. The username becomes available for someone else to choose.

Deleting your account does not delete posts that have already been published, and it does not delete the record of the submissions behind them. Those are kept as described in the next section.

Published posts and requests for removal

Because posts are published as part of a public archive, they are treated differently from account information. The following applies to every post, regardless of who submitted it or whether that person still has an account.

1. Retention. Published posts, and the images in them, are retained indefinitely. We do not remove a post automatically when the account that submitted it is deleted, when any period of time has passed, or on any other automatic trigger; a post or an image leaves the site only through a request under this section. The submission record behind a post, including the account and email address it was submitted from, is kept with the post so that its origin is known.
2. Requests. Anyone may ask for a post to be removed by writing to remove.post@bikes.pizza with a link to the post and the reason for the request. Each request is considered individually.
3. No guarantee. Removal is at our discretion. We give weight to reasons such as: the photo shows you, your home, or your property and you did not intend it to be public; it was submitted by someone who had no right to submit it; it contains something that should not have passed review; or the law requires its removal. We are under no obligation to grant a request, and we may decline one, in particular where the post has become part of the record this site exists to keep.
4. Timing. A request that is granted is acted on within a reasonable time. We do not undertake to act immediately. After a post is removed from bikes.pizza, copies may continue to exist for a period in caches, in content delivery networks, in search engine indexes, in backups, and with anyone who copied the post while it was public. Those copies are outside our control, and this policy makes no promise about their removal.
5. What removal means. Removing a post takes it off the public site and out of the apps. The image itself, and the submission record behind it, are kept: by default they are retained after removal, so that the removal and the reason for it are documented. If you want the image deleted as well, say so in your request. Deletion of the image may be granted, on the same terms and with the same discretion as removal of the post, and is likewise not immediate.
6. Legal rights. If the law where you live gives you a right to have personal information erased, that right applies to a published post only to the extent the law provides, and it is subject to the exceptions the law allows, including exceptions for archiving, for freedom of expression, and for establishing or defending legal claims. A request made under such a law goes to the same address and is answered as the law requires.

Keeping it

Account information is kept for as long as the account exists. Rejected submissions are kept only long enough to handle any question about the decision. Published posts, the images in them, and the submission records behind them are kept indefinitely; a post or an image may be removed on request, as described under "Published posts and requests for removal".

Children

bikes.pizza is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, write to us and we will remove it.

Your rights

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live you may have further rights over that information, including under the GDPR or the CCPA. Write to the address below and we will help.

These rights concern your personal information: your account details and the records tied to them. They do not by themselves entitle you to the removal of a published post. A post is public content that you offered for publication, and a request to remove it is handled as described under "Published posts and requests for removal", taking account of any legal right you have.

Changes

If this policy changes we will update the date at the top of this page. Substantial changes will be announced on the site.

Contact

Questions about privacy, or a request about your data, can go to privacy@bikes.pizza.

To ask for a published post to be removed, write to remove.post@bikes.pizza instead, with a link to the post and your reason. Requests are considered individually and are not guaranteed to be granted.

General questions and comments about bikes.pizza are welcome at contact@bikes.pizza.