Privacy

If you sponsor a spot

I store your brand name, the link and tagline you give me, your email address (Stripe collects it at checkout), the amount you paid, the Stripe payment reference, and the artwork you upload. If your spot is taken over, the refund amount and date are stored with it.

I need this to run the sponsorship: to show your logo, to email you when something happens to your spot, to issue refunds, and to keep the accounting records HMRC requires.

If you join the email list

I store your email address, the date you joined and where you joined from. Nothing else — no name, no tracking of whether you opened anything.

Every email has an unsubscribe link, and your mail app's own unsubscribe button works too. When you unsubscribe I keep the address on a suppression list so it does not get added back by accident.

If you are just reading the page

Until you answer the banner at the bottom of the page, nothing is measured and no cookie is set. Saying no is a real no: the measurement code never runs, and I do not ask again for six months.

While the page is open it holds a live connection to this site so the little notices in the corner can say that somebody arrived. Other visitors only ever see a two-letter country code worked out from your connection and a face drawn from a random id. Your IP address is kept in memory while you are connected, only so one connection cannot flood the notices, and nothing is written to the database. Close the tab and it is gone.

If you say yes to measurement

Two things start. Google Analytics tells me which sections get read and where people give up. Hotjar records anonymised sessions — cursor movement, scrolling and clicks — so I can see which parts of the page confuse people. Neither is used for advertising, and I do not sell or share any of it.

Three cookies are set, all first-party: your answer to the banner, a random visitor id that lasts two years, and a session id that expires after thirty minutes of inactivity. None of them carries your name or your email address.

The measurement runs in your browser and talks to Google directly, so Google sees your IP address as part of that request. Google Analytics uses it to work out an approximate location and then discards it — it is not stored in the reports I read, and IP-based advertising features are off.

If you pay for a spot, the purchase is recorded against that random visitor id so I can tell which part of the page actually works. It is linked to the payment, not to you.

Changed your mind? Clear this site's cookies in your browser and the banner comes back. I have no way to identify you afterwards, which is rather the point.

Whose data is on the page

The rides, distances, calories and weight measurements are mine. They come from my own Strava account and my own scales, and I publish them on purpose.

Who else sees it

Stripe processes payments and holds the card details — I never see them. Resend sends the emails. Cloudflare sits in front of the site to serve it and keep it up, and keeps the nightly backup copy described below.

Each of these only gets what it needs to do its job. Nobody buys this data, and I do not sell or rent it.

Where it is stored

The database and the uploaded artwork live on a server in Turkey that I rent and run myself. The database is not reachable from the internet — only the site itself talks to it — and nobody else has access to it.

Turkey does not have a UK adequacy decision, which means UK law does not automatically treat it as protecting data to the same standard. I keep the copy there to the minimum the site needs, connections to the site are encrypted, and the server is locked down to me.

Once a night the database is backed up to Cloudflare's storage in the EU, where it is encrypted at rest. Backups are kept for up to sixty days and then deleted.

How long it is kept

Sponsorship and payment records: six years, because tax records have to be kept. Email list: until you unsubscribe. Artwork: while your spot is live, then until the accounting record for it expires.

Your rights

You can ask for a copy of what I hold about you, ask me to correct it, or ask me to delete it. Where the law lets me keep it — payment records, mainly — I will say so rather than quietly ignore the request. Email me at [email protected] and I will answer within a month.

If you think I have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk.