Privacy Policy

Last updated: April 2026

opencargo.bike is operated from Copenhagen, Denmark. We take privacy seriously — this policy explains exactly what data we collect, why, and what we do with it.

What we collect

1. Contribution form submissions

When you submit a maker, product, or request via the /contribute page, we store the information you provide (maker name, website, description, etc.) in our database. The form optionally collects your name and email address — these are used only to follow up on your submission if needed. You can submit without providing either. Submissions are stored in Supabase (EU) and reviewed before publishing.

2. Community photo submissions

When you submit a photo of a product in use, we collect your name, city, and uploaded image. Approved photos, your name, and city are displayed publicly on product pages. Photos are stored in Supabase Storage (EU). You can request removal of your photo and personal details at any time by emailing hello@opencargo.bike.

3. Rate limiting

To prevent spam and abuse, we temporarily process your IP address in server memory for rate limiting on the contribution form (5 per hour), community photo uploads (10 per hour), and outbound click tracking (30 per 15 minutes). IP addresses are not stored in any database and are discarded when the server restarts.

4. Analytics

We use three analytics tools to understand how the site is used:

• Vercel Analytics & Speed Insights — cookieless, anonymous page view and performance data. No personal data collected. See Vercel's analytics privacy policy.
• PostHog — product analytics to understand how visitors navigate the site. PostHog collects page views, click events, and device type. We use PostHog session recording to understand how visitors navigate the site — session recordings capture mouse movements, clicks, and page content. All text input fields are masked (we cannot see what you type). PostHog uses your IP address transiently to determine your approximate location (country/city) — IP addresses are discarded after geolocation and are not stored. PostHog is proxied through our domain (no third-party cookies). PostHog only activates after you accept analytics cookies — you can decline via the cookie consent banner. See PostHog's privacy policy.
• Supabase click & search tracking — when you click an outbound link to a maker's website or use the search function, we log the event (destination URL or search query) to understand which products and makers are most useful. No personal identifiers are stored.

5. Hosting logs

Our hosting provider (Vercel) may collect standard server access logs including IP addresses, browser type, and pages visited. These are managed by Vercel under their privacy policy.

6. Maker portal accounts

If you are a maker and claim your profile via the maker portal, we collect your email address (for magic link authentication), your name, and a verification note explaining your connection to the maker. This data is used solely to verify your identity and manage your product listings. We do not store passwords — authentication is via magic link only. You can request deletion of your account by emailing hello@opencargo.bike.

7. Cookie consent preference

We store a single cookie (oc_consent) to remember your cookie preference. It contains no personal data — just the value "accepted" or "rejected" and an expiry date. If you decline analytics cookies, PostHog does not load and no analytics data is collected. The site works normally either way. No other cookies are set by this site.

What we don't collect

• No user accounts for browsing (maker portal accounts are opt-in, see above)
• No personal profiling or individual tracking
• No advertising or marketing trackers
• No third-party ad scripts — fonts are self-hosted
• No fingerprinting or cross-site tracking

Third-party services

Supabase (database) — stores product, maker, and submission data. Hosted in the EU. No personal data is stored except voluntarily submitted form content.

Vercel (hosting) — serves the website. May process server logs. See Vercel's privacy policy.

PostHog (analytics) — product analytics, proxied through our domain. See PostHog's privacy policy.

No data is shared with advertisers or social media platforms.

Your rights (GDPR)

Under the General Data Protection Regulation, you have the right to access, correct, or delete any data we hold about you. Since we collect almost no personal data, this mainly applies to contribution form submissions. To make a request, email hello@opencargo.bike.

Legal basis

We process the limited data described above under Article 6(1)(f) GDPR (legitimate interest) for rate limiting and click/search tracking, Article 6(1)(a) (consent) for analytics cookies and session recording, and Article 6(1)(b) (contractual necessity) for maker portal accounts. Contribution form submissions and community photo uploads are processed under Article 6(1)(a) (consent).

Questions? Email hello@opencargo.bike