What we collect

Nobody, unless you decide otherwise. When you first do something worth remembering we set one cookie, sid, holding a random number and a signature. It is not derived from anything about you, it expires after thirty days, and its only job is so that the frame you measured is still there when you come back. No account is required for any part of the product, and none is ever asked for before you have made something worth keeping.

If you do create one, that changes and this page says so rather than pretending otherwise. An account is handled by Clerk, who hold your email address and your password so that we do not; we receive an account identifier from them and store that against your frames, trips and gear in place of the random session number. From that point we can identify your data from your email address, where before we could not. Signing in on a new device brings across whatever the browser you signed in from was already holding.

It is the measurement, so it is the one genuinely sensitive thing here. When you upload it we strip the EXIF metadata — which is where the GPS coordinates of your house usually live — and re-encode the image before storing it. The original, with its metadata, is never written down.

A copy also stays in your own browser so a saved frame can show its photograph without fetching it again. That copy is yours and clearing your browser storage removes it.

Your answers, the kit list they produced, what you own, and the frames you measured. Trips and gear carry the names you gave them. All of it is attached to that random session number and nothing else.

A ride in progress is held in your browser rather than on our servers until you save it, which is why closing the tab does not lose it and why we cannot see it before you do.

If you accepted the banner, we record which parts of the product get used — that a plan was started, that a question was answered, that a link was followed. We use PostHog for this, and it sets its own cookie.

What it never receives: your photograph, the names you typed, or the free text you wrote. Automatic click-capture and session recording are both switched off, specifically because the first records the text of what you click and the second would record the photograph. If you declined, none of it loads at all — no script, no cookie, no request.

Our hosting (Vercel) and our database (MongoDB Atlas) hold the data in order to serve the product. PostHog receives the events described above, and only with your agreement. When you follow a link to a bag maker you are on their site under their terms, and some of those links pay us a commission — which is shown to you on the link itself, before you click it, including when the answer is that it pays us nothing.

Nobody buys this data. There is no advertising network here and no data broker.

Deleting a trip, a frame or an item of gear removes it from your account view. Clearing your browser storage removes the local copies and the session cookie, after which nothing remaining can be connected to you.

If you want everything associated with you erased outright, ask and we will do it. With an account, your email address is the handle and that is enough for us to find it. Without one we hold no email address at all, so the session cookie is the only handle that exists and you have to still be able to supply it.

It describes what the code does today and is updated when the code changes. If something here turns out not to match the behaviour, the behaviour is the bug.