Privacy Policy

Who we are

Throttle is run by Throttle. We are the controller of the personal data described in this policy, which means we decide how and why it's used.

You can contact us about anything in this policy at [email protected].

This policy explains what personal data we collect when you use Throttle, how we use it, who we share it with, how long we keep it and the rights you have. It applies to riders with an account and to people who visit without one.

The information we collect

Information you give us

• Your account: your name, username, email address and password. We never store your password itself, only a secure one-way hash of it.
• Your profile: profile and cover photos, bio, location, website, riding style and the year you started riding, if you add them.
• Your garage: the bikes you add, with photos, specifications, mileage and modifications.
• What you post: posts, comments, photos, videos, the location you add to a post, ride distances, hashtags and mentions, plus your likes, reposts, bookmarks, follows, blocks and mutes.
• Direct messages: the messages and photos you send, your reactions, and whether messages have been read (unless you turn read receipts off).
• Clubs: clubs you create or join, your role and officer title, membership number, subs status, your answers to a club's joining questions and when you accepted its rules.
• Marketplace: your listings and their photos, the offers you make and receive, reviews, saved listings and saved-search alerts.
• Support requests: what you tell us when you contact us, any screenshots you attach and details such as reference numbers. If you contact us without an account, we also keep your name and email address so we can reply.
• Reports and appeals: what you tell us when you report something or appeal a decision.
• Security settings: if you turn on two-factor authentication, the secret your authenticator app uses (stored encrypted) and your recovery codes (stored only as hashes).

Information we collect automatically

• Sign-in and security information: when you sign in, change your password or use two-factor authentication, we record what happened, the time, a description of the device and browser (such as "Chrome on Windows") and the IP address. You can see this in Settings → Security.
• IP addresses: we store the IP address you signed up from and the one you last used, to help us spot abuse, such as banned riders creating new accounts.
• Activity: when you were last active (used for your online status, which you can hide), the notifications we've sent you and whether you've read them.
• Push notifications: if you turn them on, the push subscription your browser gives us, which lets us send notifications to that device.
• Server logs: like every website, our servers keep short-lived technical logs of requests (such as IP address, page requested and browser type) to keep the service running and secure.

Photo and video metadata. Photos and videos often contain hidden information, such as the GPS location where they were taken. We remove this metadata when you upload them, before anyone else can see them.

Information from other people

Other riders may mention or tag you, add you to a club roster, review you after a sale, or report you. Our moderators may add notes to reports and decisions.

We don't ask for special categories of personal data (such as health, religion or ethnic origin). Please think carefully before sharing that kind of information publicly.

How we use your information

Data protection law requires us to have a lawful basis for each way we use personal data. These are the ways we use it and our basis for each:

Where we rely on legitimate interests, we've balanced them against your rights and you can object. Where we rely on consent, you can withdraw it at any time.

We don't make decisions about you that have legal or similarly significant effects based solely on automated processing. Ranking the feed and our automatic language filter are automated, but decisions to restrict or suspend accounts are made by people.

What other people can see

• Public accounts: your profile, garage, posts and the clubs you're in can be seen by other riders and by people who aren't signed in, including search engines.
• Private accounts: only followers you approve can see your posts. Your name, username and profile photo are still visible, so people can find you and ask to follow.
• Your controls: in Settings → Privacy you can make your account private, hide it from search, stop it appearing to signed-out visitors and search engines, choose who can message, reply to or mention you, and hide your online status and read receipts. You can also block or mute anyone.
• Direct messages are only visible to the people in the conversation, and to moderators if a message is reported.
• Private clubs are only visible to their members. Club officers can see members' details, joining answers and subs status.
• Listings are public unless a club makes them members-only. Reviews you leave or receive appear on seller profiles.

Who we share information with

We don't sell your personal data, and we don't share it with advertisers. We share it only in these situations.

Companies that help us run Throttle

These providers only use your data to provide their service to us:

• Hosting: our hosting provider runs the servers and database Throttle lives on.
• Cloudflare stores uploaded photos, videos and files in its R2 storage service and delivers them through its content delivery network.
• Google Fonts: the fonts on Throttle are loaded from Google's servers, so your browser sends Google your IP address and browser details when it fetches them. Google doesn't set cookies for this.
• Place search: when you search for a location to add to a post, what you type is sent from our servers to the Photon place search service run by komoot, which uses OpenStreetMap data, to find matching places. Your IP address isn't shared with it. If you choose "Use my current location", your browser shares your position with us, and we send only an approximate version (to about 1km) to look up the name of the town or area. We don't store your position.
• Postcode lookups: to place marketplace listings and distance searches on the map, our servers send the first part of the postcode (for example LS6) to postcodes.io, run by Ideal Postcodes. If you choose "Use my location" on the marketplace, we send only an approximate version of your position (to about 1km) to find your postcode district, and we don't store it. Your IP address isn't shared.
• Push services: push notifications are delivered by the service built into your browser or device (for example Google, Apple, Mozilla or Microsoft). The content of each notification is encrypted so that these services can't read it.

Other organisations

• Other riders, as described in What other people can see, and in line with your settings.
• The police, regulators and other authorities, when the law requires it, or when we believe in good faith that sharing information is necessary to prevent serious harm to someone or to investigate crime.
• Professional advisers, such as lawyers and accountants, where we need their advice.
• A new owner, if Throttle or the organisation that runs it is sold or merged. They would have to keep using your data in line with this policy, and we'd tell you before your data became subject to a different policy.

International transfers

Some of the providers above, including Google and Cloudflare, process data in the United States and other countries outside the UK and the European Economic Area. When your data is transferred outside the UK or EEA, we make sure it's protected, for example because the country has been found to provide adequate protection (including the UK-US Data Bridge for certified companies), or by using the standard contractual clauses approved for that purpose.

How long we keep information

We keep personal data only for as long as we need it:

When you delete your account, your profile and everything you created are deleted straight away, including your posts, comments, photos, videos, garage, listings and the messages you sent. A small amount of information may be kept for longer where we need it: copies in backups until they're overwritten, records we must keep by law, and information needed to stop riders who were banned from simply signing up again (such as a blocked email address).

Your rights

You have these rights over your personal data:

• Access: you can ask for a copy of the personal data we hold about you. The quickest way is Download your data in Settings → Privacy, which gives you a file of everything linked to your account.
• Correction: you can correct most information yourself in Settings, or ask us to correct it.
• Deletion: you can delete content at any time and delete your account in Settings → Account, or ask us to delete your data.
• Restriction: you can ask us to stop using your data while a concern is looked into.
• Objection: you can object to us using your data on the basis of legitimate interests. You can also stop your profile appearing to visitors and search engines in Settings → Privacy.
• Portability: you can get the data you gave us in a machine-readable format (the download in Settings → Privacy) and take it elsewhere.
• Withdraw consent: where we rely on your consent, such as for push notifications (turn them off in Settings → App or in your browser), you can withdraw it at any time.

To use any of these rights, contact [email protected]. We may need to check it's really you. We'll respond within one month, and there's normally no charge. Some rights have limits; if we can't do what you ask, we'll explain why.

If you're unhappy with how we've handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/.

How we protect your information

We use appropriate technical and organisational measures to protect your data, including:

• storing passwords and recovery codes only as secure hashes, and encrypting two-factor secrets and service credentials;
• two-factor authentication, sign-in throttling and alerts about unusual activity;
• protection against cross-site request forgery on every form, and encrypted connections (HTTPS);
• removing hidden metadata, including location, from uploaded photos and videos;
• limiting who on our team can see personal data, and logging what moderators and admins do.

No system is completely secure. If a security breach is likely to put your rights at risk, we'll tell you and the regulator as the law requires.

Children

Throttle is not for children under 16. If you're under 18, you need a parent or guardian's permission to use it. If we learn that someone under 16 has an account, we'll delete it. If you think a child under 16 is using Throttle, please contact us at [email protected].

Cookies

We use a small number of cookies and similar technologies to keep you signed in and remember your preferences. Our Cookie Policy lists them and explains your choices.

Changes to this policy

We'll update this policy when we change how we use personal data or when the law changes. Every version is dated and numbered, and the version history at the end of this page lists what changed. If we make a significant change, we'll let you know on Throttle before it takes effect.

Contact us

For any question about this policy or your personal data, contact [email protected].