Privacy policy

1. Who is responsible

mybikes.ge is run by a private individual in Georgia, who decides how the data described here is used.

For anything about your data — a copy of it, a correction, or deletion — use the contact form.

2. What we collect

When you register: your email address, password, name, phone number and date of birth. Passwords are hashed by our authentication provider; we never see them.

When you post a listing: everything you enter in the form, the photos you upload, and the city and price. Your name and phone number appear publicly on the listing.

When you use the contact form: your first name, last name, phone number, subject and message.

When you top up or spend balance: the amount and the time.

Automatically: your IP address, which we use to rate-limit spam and abuse, plus basic technical request data.

We do not collect payment card details, and we do not use analytics or advertising trackers.

3. Why we use it

• to create and run your account
• to publish your listings and let buyers reach you
• to apply and expire paid placement
• to answer your messages
• to stop spam, fraud and abuse
• to keep the site working and secure

4. What is public

A listing is public by design. Anyone, including search engines, can see the bike details, the photos, the city, and the name and phone number attached to it.

Your email address, date of birth and balance are never shown publicly.

5. Who else sees your data

• Supabase — stores the database, the accounts and the uploaded photos
• Vercel — hosts and serves the site

Both are service providers acting on our instructions, and both process data on servers outside Georgia.

Otherwise we do not sell your data and do not share it for marketing. We pass it to anyone else only where Georgian law requires it, for example on a lawful request from an authority.

6. How long we keep it

• account data — for as long as your account exists
• listings — until you delete them, or delete your account
• contact messages — up to two years, so we can follow up on a complaint
• rate-limiting records — short-lived, cleared automatically

Once you ask us to delete your account, we remove your data, apart from anything we are legally required to keep.

7. Your rights

Under Georgian data protection law you can ask what data we hold about you, get a copy of it, have it corrected, ask us to delete or block it, and withdraw consent where we relied on it.

Ask through the contact form. We reply within the period the law allows.

If you believe we have handled your data badly, you can complain to the Personal Data Protection Service of Georgia.

8. Security

Access is enforced by database-level rules, so an account can only reach its own data, and administrator actions are separated from ordinary accounts.

No site can promise perfect security. Use a strong, unique password, and tell us if you think someone else has reached your account.

9. Children

The site is for people aged 18 and over. We do not knowingly collect data from children, and we delete it if we find we have.

10. Changes

If this policy changes, the new version appears on this page with a new date.