Privacy policy
EFFECTIVE 2026-09-29
No ad tech. We don't sell data. Accounts are optional. A shared sheet lives in its link; a published sheet lives on our backend until you delete it.
What reaches us
- Analytics. Google Analytics 4 runs in cookieless mode for visitors in the EEA, UK and Switzerland and whenever your browser sends Global Privacy Control; elsewhere it sets its standard _ga cookies. Advertising features and Google signals are off. No consent banner: where consent would be required, no cookie is set.
- Usage beacon. Our own counter records an event name, the page path, the referring site, a device class, the bike model, the part count and a price band. No cookies or identifiers. Kept as server logs for about 30 days.
- Request logs. Hosting and function logs — IP address, path, browser user agent, timestamp — for about 30 days, used for security and debugging.
- Share links. A share link carries the whole sheet in the URL fragment (#v1.), which never leaves your browser. The part before the # carries only a summary — bike model, part count, total and the sheet title (≤60 characters) — so chat apps can show a preview; that summary reaches our server like any URL and may appear in standard request logs. Nothing from a share link is stored. Your handle and channel link, if you add them, travel in the fragment only.
- Draft. Your in-progress bench lives in this browser's localStorage and never leaves your device.
- Account (optional). Sign in and we store the sign-in identifier — email address or Google account id — with Firebase Authentication. No profile, no mailing list.
- Published sheets. Publish and we store the sheet: title, bike, parts, prices, your links and codes, a readable slug, a timestamp and the owning user id. Public by design — anyone with the link can open it, and the newest appear in the gallery.
- Build-card images. Publishing may upload the card PNG to Cloud Storage; it is publicly readable at its URL.
Delete
- Published sheets. My sheets in the composer: unpublish hides, delete removes.
- Leftovers. A deleted sheet's card image and slug entry can persist — email us and we clear them.
- Accounts. Email hey@unstocked.bike from the account's address; we delete the account and everything tied to it.
- Draft. Clear this site's data in your browser.
Third parties
- Google Cloud / Firebase. Hosting, Cloud Functions, Firestore, Authentication and Cloud Storage are our infrastructure; Google processes requests on our behalf under its cloud terms. Sign-in and publishing may be protected by reCAPTCHA Enterprise (Firebase App Check).
- Google Analytics. As above; Google's privacy policy governs its processing.
- Fonts. Served from unstocked.bike. No request goes to a third-party font host.
- Retailer links. Buy links lead to retailer sites; their policies and cookies apply there, including the ones that attribute an affiliate purchase.
Affiliate disclosure
Some retailer links are affiliate links: buy after clicking one and the retailer may pay Another One, LLC a small commission. Your price does not change. Creator-shared sheets carry the creator's links instead of ours. As an Amazon Associate, Another One, LLC earns from qualifying purchases.
Children
Not directed at children under 13; we do not knowingly collect their data.
Your rights
Access, export or delete anything above: hey@unstocked.bike.
Changes
A new version is posted here with a new effective date.
Who we are
Another One, LLC, a US company · hey@unstocked.bike
Effective September 29, 2026.