Privacy policy

Data controller

Matthieu Audisio, the site's publisher. For any questions about your data: [email protected]

Data collected

• Email address, display name

  When you create an account

  To identify your account, sign you in and, where necessary, write to you about the service (changes to the terms, end of the service, suspension of your account). No commercial mailings.

• Password

  When you create an account

  Stored only as a hash (bcrypt), never in plain text.

• Bikes, parts, serial numbers, prices, notes, setup, maintenance history

  When you enter them

  The service itself: tracking wear and maintenance.

• Photos of your bikes

  If you upload any

  Shown on your bike pages; metadata (including GPS location) is removed on upload.

• Date of acceptance of the terms of use

  When you create an account, then each time a new version is accepted

  To keep proof of your acceptance.

• Date of last sign-in

  Each time you sign in

  Administration of the service (monitoring its use).

• Bug reports (message, page concerned, page language)

  If you send any

  To fix the site.

• Strava data

  If you connect Strava

  To update your bikes' distance automatically. With your authorisation, Mon Garage Vélo reads your Strava profile (including your list of bikes) and all your activities, including private ones and those of your other bikes. It stores only your athlete ID and name, the access tokens, the ID of the linked Strava bike and, for the rides made with that bike only, their ID, date, distance, duration and elevation gain (no title, no track, no location). Everything else is ignored as soon as it is received; your list of Strava bikes is kept in memory for at most 45 minutes, without being stored, and erased as soon as Strava is disconnected or the account is deleted; the ID of an activity you delete on Strava is kept in memory for at most 1 hour 15 minutes, so that a sync in progress does not re-import it.

• Town or location searched (repairer directory)

  When you search for a repairer, with or without an account

  To show nearby workshops. The town or postcode entered is sent to IGN's geocoder, then kept in the server's memory for at most 24 hours 15 minutes along with its response, not linked to any account, so that the same town is not requested again. The ‘Near me’ location is rounded to about 1 km by your browser; like the town, it appears in the page address, and therefore in your browser history, but is never stored by the server. The last town found is kept in your browser only.

• Workshop listing requests (email, workshop details, message, page language)

  If you send one (‘List my workshop’ form)

  The email and message are used to handle the request and reply to you; the request is deleted 12 months after it has been handled. If a request to add or correct a listing is accepted, the workshop's details (name, address, phone number, website, opening hours, Bonus Réparation (French repair bonus)) are published in the public directory until a removal request is made; the SIRET number is not shown.

• IP address (sign-in, account creation, change of the account's email, listing requests, directory searches) and email entered during sign-in attempts

  At each sign-in attempt, each account creation (or attempt with an email that is already registered), each change of your account's email (or attempt to change it to an email that is already registered), each listing request and each town searched in the repairer directory

  Security: limiting repeated attempts, account creations, email changes, submissions and searches. Kept in memory for at most 2 hours, never stored in the database or in a file.

• Technical logs

  Continuously

  To diagnose server errors. They may contain your account's internal ID, never your password or your IP address.

Only the email address, display name, password and acceptance of the terms of use are mandatory: without them, the account cannot be created. Everything else (bikes, photos, Strava connection, etc.) is optional.

No data is used for advertising purposes, sold or given away.

Mon Garage Vélo makes no automated decisions concerning you and carries out no profiling: the wear gauges are simple calculations based on what you enter.

Legal bases

• Performance of the service (Art. 6(1)(b) GDPR): account, messages about the service, bikes, maintenance, photos, searches in the repairer directory from your account, and Strava rides once imported into your bikes' history.
• Consent (Art. 6(1)(a)): connection to Strava and import of rides. You can withdraw it at any time with ‘Disconnect’ in Settings, or from your Strava account (see ‘Retention periods’).
• Legitimate interest (Art. 6(1)(f)): security of the site (limiting attempts, technical logs), bug reports, date of last sign-in, proof of acceptance of the terms of use, repairer directory (reuse and publication of ADEME's public data, handling of listing requests, searches by a visitor without an account).

Retention periods

• Account and associated data (including the dates of last sign-in and of acceptance of the terms): as long as the account exists. Deleting the account (Settings → My account → ‘Delete my account’) immediately erases the account, bikes, parts, history, rides, setup, photos and the Strava connection (Mon Garage Vélo asks Strava to revoke its access).
• Backups: a copy of the database (not of the photos) is made at every update of the site; each copy is deleted automatically after 30 days at most. Deleted data may therefore remain for up to 30 days in these copies, which are not accessible online.
• Bug reports: kept after the account is deleted, without any link to it, and deleted automatically 12 months after they are sent.
• Repairer directory: a listing from ADEME is kept as long as it appears in ADEME's data, and for at most 6 months after disappearing from them; a listing added on request is kept until a removal request is made. After a removal, only the listing's ADEME identifier is kept, so that the listing does not reappear. Listing requests are deleted 12 months after they have been handled.
• Strava data: imported rides are kept as long as Strava is connected. An activity deleted on Strava is removed from Mon Garage Vélo (and, if the bike is still linked to Strava, from its distance) as soon as Strava reports it, usually within minutes. ‘Disconnect’ (Settings) immediately erases the connection (athlete ID and name, tokens) and all imported rides, and Mon Garage Vélo asks Strava to revoke its access. The same erasure occurs if you remove access from your Strava account or delete that account, as soon as Strava reports it, and in principle within 36 hours at the latest (access is checked every 12 hours), and for the old account if you connect a different Strava account. In these cases, your bikes' distance and hours are kept, like a value entered by hand, and therefore so is your parts' wear, and the Settings page confirms the date of the erasure.
• IP address and email of sign-in attempts (and IP address of account creations, email changes, listing requests and directory searches): 2 hours at most, in memory only.
• Technical logs: limited in size (the oldest are erased beyond a few tens of MB); the app's logs are also deleted at every update of the site. They are not accessible online.

Recipients and processors

• Cloudflare, Inc. (United States): HTTPS relay, protection of the site and audience measurement (see ‘Cookies and local storage’). Transfer governed by the EU–US Data Privacy Framework and by standard contractual clauses.
• Strava, Inc. (United States): only if you connect your Strava account, under its own terms.
• IGN (Géoplateforme, French public mapping service): the town or postcode entered in the directory, and a workshop's address when the publisher checks a request or corrects a listing, for geocoding.
• API Recherche d'entreprises (French government company search service): only the SIRET number of a listing request, when the request is checked.
• There are no other recipients, and no other user sees your data. In the administration interface, the publisher sees the list of accounts (email, display name, role, dates of account creation and of last sign-in) and bug reports with their author's email, as well as listing requests. As the publisher hosts the site themselves, the publisher also has technical access to the database, the photos and the backups, and consults them only for the maintenance of the service or at your request.

Repairer directory

The directory, which is public (accessible without an account and indexed by search engines), reuses the public data ‘Que faire de mes objets & déchets’ (ADEME's repair and recycling directory; Open Licence 2.0): the name, address, phone number, website, opening hours and SIRET number of bike repair workshops (the SIRET number is not shown). For a repairer who is a sole trader, this is personal data, reused and published, as on ADEME's public map, on the basis of legitimate interest (helping cyclists get their bikes repaired). As the listings are imported in bulk, repairers are not informed individually (Art. 14(5)(b) GDPR): this page provides that information instead.

A repairer can at any time access the data in their listing by writing to [email protected], and have it rectified or object to the presence of their listing, using the List my workshop form or by writing to the same address. A removed listing is no longer shown and does not come back with later updates: only its ADEME identifier is kept, so that it can be recognised (a listing added on request is, for its part, deleted entirely).

Cookies and local storage

• Strictly necessary cookies (exempt from consent): sign-in session, protection against forged requests and return after sign-in, temporary cookies for connecting to Strava (including the page language, so as to return to that language after authorisation).
• Display preference cookie (exempt from consent): sections collapsed or expanded on a bike's page, kept for one year on the device used.
• Language choice cookie (mgv-lang, exempt from consent): the language chosen for the site, set only when you choose a language, kept for one year in the browser used.
• Browser local storage: remembering that the ‘Install the app’ banner has been closed, the last town searched in the repairer directory.
• Cookie-free audience measurement (Cloudflare Web Analytics, exempt from consent): number of visits and page views, previous page, country, device and browser type, loading time. No cookies, no storage in your browser, no IP address kept, no tracking from one visit to the next or from one site to another: the statistics are only used to know which pages are viewed.

No other trackers, no advertising cookies.

Your rights

At any time, you can:

• access your data and rectify it (Settings → My account, your bike pages);
• erase it by deleting your account;
• withdraw your consent to the Strava connection;
• request the portability of your data or the restriction of processing, by writing to [email protected] (reply within one month);
• set directives on what happens to your data after your death (Article 85 of the loi Informatique et Libertés (French Data Protection Act)), at the same address;
• lodge a complaint with the CNIL (the French data protection authority, www.cnil.fr/en) or with the data protection authority of your country of residence (in the United Kingdom: ICO, ico.org.uk).

Security

Encrypted connections (HTTPS, TLS 1.2 minimum), passwords stored as hashes, limits on sign-in attempts, sessions of 30 days maximum, signing out of all devices on request or when the password is changed, backups with restricted access.