Privacy policy

Who operates this service

BikePartPicker is operated by BytePair LLC, located in Florida, United States. General questions can be sent to [email protected]. Legal and copyright inquiries can be sent to [email protected].

Browser drafts

Your current editable build stays in browser local storage until you clear that site data. It is not stored as a build record in the BikePartPicker database.

Shared builds

When you create a build link, the build version, name, build type, and selected catalog variant IDs are stored in the BikePartPicker database. The public link contains a random identifier rather than those build details. Shared builds are unlisted, not private. Anyone with an unlisted build link can open it, copy it, or pass it on, so do not put personal or sensitive information in a build name.

Published build records are retained indefinitely unless manually removed; there is no automatic expiry or self-service deletion. To request manual removal, use the correction form, choose “Other,” and provide the shared link, or contact the privacy address below. Removing BikePartPicker's record cannot revoke copies or screenshots already held by other people.

Opening a shared link does not overwrite your browser draft. BikePartPicker reloads the selected IDs and evaluates them using current catalog data and compatibility rules, so availability, price, and compatibility results can change after the link was created. Clearing a browser draft does not remove a published build.

Correction reports

Correction reports store the submitted page, source URL, note, correction type, and related catalog or rule identifiers. They remain in the operator review queue until reviewed and are retained as needed to investigate and document catalog corrections; no automatic correction-report expiry is currently configured. Do not include personal or sensitive information in a correction note.

Abuse prevention

For correction intake and build sharing, the service derives a keyed HMAC-SHA-256 value from the client network address supplied by the reverse proxy. BikePartPicker uses that linkable pseudonymous value to count requests and does not store the raw address in the rate-limit table. Buckets cover a one-hour correction window or a one-minute build-publication window and become eligible for opportunistic deletion after the applicable window expires.

Providers and operational logs

The application runs on a DigitalOcean Droplet and uses DigitalOcean Managed PostgreSQL. Cloudflare DNS directs the domain, and Cloudflare R2 serves catalog images. These infrastructure providers may separately process normal delivery and security information such as network address, user agent, request time, requested path, and errors under their own service settings. Shared build paths may appear in infrastructure request logs, but the stored build snapshot is not embedded in the short public URL.

Cloudflare Web Analytics collects aggregate page-view and performance metrics without cookies. Cloudflare retains unsampled beacon data for seven days and provides aggregated reporting for six months.

Google Analytics measures page use and limited interactions with the builder, product offers, and correction process. Google may process this limited data in the United States or other countries under its own service terms.

BikePartPicker application event logs record a request ID, event and outcome, method, path, status, and duration for instrumented API requests. Application event logs do not include correction notes or raw IP addresses. The reverse proxy and infrastructure providers may maintain separate access or security logs, and protective services may use strictly necessary security cookies when configured.

Report suspected vulnerabilities privately to [email protected]. Avoid public disclosure and unnecessary sensitive data while providing enough detail to investigate.

Cookies, analytics, and choices

Analytics and advertising storage are denied by default. If you decline, Google Analytics may still receive cookieless aggregate measurement pings, but those pings do not provide dependable recognition of a unique visitor. If you allow, Google Analytics may use first-party analytics cookies. Advertising storage and personalization remain disabled.

You can change this choice at any time by clicking here. Analytics event data is configured for 14 months of retention. BikePartPicker deliberately excludes build names, correction notes, shared-link identifiers, and complete build contents from analytics events.

BikePartPicker does not sell personal information. Manufacturer, retailer, and evidence links lead to third parties with their own privacy practices. Data may otherwise be disclosed when legally required.

You can clear local drafts through your browser. To request access, correction, removal, or deletion of service records, use the correction form, choose “Other,” and provide enough information to identify the record.

Legal bases

BytePair LLC processes service data as necessary to provide features you request and administer the Terms of Use, comply with legal obligations, and pursue legitimate interests in securing, maintaining, and improving BikePartPicker, except where those interests are overridden by applicable rights.

Your privacy rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of personal information, and to object to or restrict certain processing. BytePair LLC will review and honor verified requests as required by applicable law.

Send a request to [email protected]. Requests are reviewed by a person before action is taken.

International transfers

BytePair LLC is based in the United States. BikePartPicker and its infrastructure providers may process information in the United States and other countries where they operate. Where required, BytePair LLC uses applicable safeguards for international transfers.

Children and changes

The service is not directed to children under 13. Material policy changes will be posted here with a new effective date.