# Brand My Bike privacy draft

> The public deployment remains a preview, while the codebase now includes a fail-closed production data layer for accounts, auctions, payments and opt-in city-level map signals.

Production processing remains locked until the real controller, establishment, legal bases, retention, processors and transfer safeguards are approved. Intended providers are Vercel, Supabase, Stripe, the transactional-email provider and the approved print partner. Optional analytics load only after consent. FIT/GPX raw files and full point arrays stay private. A separately approved public route removes at least its first and last kilometre, reduces precision and never shows a home address or live position. Strava is not used for public or sponsor reporting. Stripe’s separate-charge/transfer model is not escrow.

## Links

- [Read the full English draft](https://brandmybike.vercel.app/privacy)
- [Deutsche Zusammenfassung](https://brandmybike.vercel.app/content/de/privacy.md)