Privacy Policy

Effective date: February 24, 2026

The City and the Bike is a community photo gallery of fender art on shared bikes. This policy describes what information we collect, why we collect it, and how you can control it.

Information we collect

When you create an account we ask for:

Username — displayed publicly alongside your submissions.
Email address — used only for account recovery. It is never displayed publicly.
Password — stored as a one-way hash. We never store or see your password in plain text.

When you use the app we collect:

Photos you upload — before storing a photo we strip all EXIF metadata, including GPS coordinates, timestamps, camera make and model, and device serial numbers. The image is re-encoded so that no hidden data survives. We keep only the date you uploaded it.
Bike QR code — scanned locally on your device to identify the bike. The QR value is sent to our server and linked to your submission.
Captions and tags — any text or tag annotations you choose to add.
Device identifier — an app-scoped identifier for your device, used solely to enforce bans and protect the service from abuse. It is not linked to any hardware serial number and cannot be used to track you across other apps.

Information we do not collect

We do not track your location.
We do not use analytics, advertising networks, or tracking cookies.
We do not collect crash reports or telemetry.

How we use your information

To display your submissions in the public gallery.
To maintain your account and authenticate you.
To calculate community leaderboard scores.
To protect the service from abuse (rate limiting and failed-login tracking).

What is visible to others

Your username, photos, captions, tags, and leaderboard score are visible to everyone. Your email address is never shared or displayed publicly.

Keep in mind that someone could still identify you based on the content of your photos or the locations where bikes appear. Consider this when uploading.

Third-party services

We use Google Cloud Storage to store uploaded images. Google acts as a data processor on our behalf and does not use your images for its own purposes. We do not share your data with any other third parties and we do not sell your data.

Security

Passwords are hashed with bcrypt. Authentication tokens are stored in encrypted storage on your device using AES-256 encryption. All network traffic is transmitted over HTTPS.

Data retention

Your account and submissions are retained for as long as your account exists. Through the app you can permanently delete individual photos, your entire account, and all associated tags and scoring data at any time. When you delete something, it is permanently removed from our servers.

Children's privacy

This app is not directed at children under 13. We do not knowingly collect information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

Copyright

The copyright of all photos you upload belongs to you. By uploading a photo you agree to license it under Creative Commons BY-NC 4.0. This license requires that reusers give credit to the creator and limits reuse to noncommercial purposes.

Your rights

You may request access to, correction of, or deletion of your personal data at any time by contacting us. Depending on your jurisdiction you may have additional rights under applicable data protection laws.

Changes to this policy

If we make material changes we will update the effective date at the top of this page. Continued use of the app after a change constitutes acceptance of the updated policy.

Contact

If you have questions about this policy or your data, open an issue at github.com/bmander/thecityandthebike or email thecityandthebike@gmail.com.