Privacy

BikeHQ keeps as little about you as it can, and this page lists all of it. Updated 26 September 2026.

Reading the site

Reading the site sets no cookies, and BikeHQ runs no advertising network. Fonts, styles and icons come from bikehq.ca. The site is delivered by Cloudflare, which sees your IP address in order to deliver pages. BikeHQ keeps no log of requests, so it does not store your IP address.

  • Visit counts. Cloudflare Web Analytics counts page views. It uses no cookies and no fingerprinting, and shows BikeHQ totals only: pages, referring sites, browser and device types, countries, and how fast pages loaded. It cannot tell BikeHQ who you are.
  • Maps. The map on an event page is drawn from OpenStreetMap data by BikeHQ's own map server. Your browser gets it from bikehq.ca and never contacts OpenStreetMap or any other map company, unless you follow the link to OpenStreetMap's site.
  • Places to stay. An upcoming event's page carries a list of places to stay for the night before, in a frame from Stay22, a Montreal company that searches Booking.com, Expedia, Hotels.com and Vrbo. The frame loads only when you scroll down to it, and inside it Stay22 and the booking sites set their own cookies under Stay22's privacy policy (opens in a new tab). BikeHQ earns a commission on a booking made through it and learns nothing about who booked.
  • Bot check. When you start filling in a form, the page loads Cloudflare Turnstile, which looks at your browser to tell a person from a bot. Reading pages never loads it.

Your browser may keep copies of pages you opened so they work offline; those stay on your device.

The contact form

A message sent through the contact form is not stored on the site. It is emailed to BikeHQ through Resend, an email delivery service, with your address as the reply-to. Resend keeps a record of the email under its own policy. The message arrives in BikeHQ's mailbox, hosted by Purelymail, and stays there while it is needed to answer you. Ask and it is deleted.

Accounts

You need an account to keep a calendar or to correct a listing. Supabase Auth holds your email address, when the account was made and when you last signed in. BikeHQ stores your role (rider or organizer), your home province if you set one, the events you save and when you saved each, a random token that names your private calendar address, a username, and every correction you make, with your account's id, the field, the old and new value, and the time.

Your username is public where you edit. A correction shows on the listing with your username and the date, and each listing has a page of its changes. Your email address is never shown, and nobody can list the members: a username is readable only on the listings its owner corrected. Until you pick one, your account has a neutral name like rider-4821, and you pick your own before your first correction. You can change it once every 30 days. Changes made by BikeHQ show as BikeHQ. No IP address is stored by BikeHQ.

Signing in sets two cookies: one keeps you signed in for up to 30 days and is unreadable by scripts; the other lists the ids of the events you saved, so an event page can show Remove instead of Save without asking the server who you are. Two more last an hour at most, and only while you are signing in: one remembers the page to return to, the other the event you pressed Save on. There are no others, and all four go when you sign out.

Your calendar address is private to you. Anyone who has it can read your list of saved events, and nothing else. You can reset it from your calendar page; the old address then returns an empty calendar.

You can delete your account yourself from your account's settings. Your sign-in, profile, username and saved events go at once. Corrections stay on the listings, credited to a former member, because other readers rely on them.

Where it is kept

Accounts, saved events and corrections live in a Postgres database hosted by Supabase. The site runs on Cloudflare. Sign-in emails and contact messages go through Resend. Contact messages are read in a mailbox at Purelymail. All four are service providers that may process data outside Quebec and outside Canada. Access to the data is limited to the one person who runs BikeHQ.

How long

An account is kept until you delete it. A contact message is kept while it is needed to answer you, and deleted when you ask.

Your rights

Under PIPEDA, and under Quebec's Law 25 if you live in Quebec, you can ask what BikeHQ holds about you, have it corrected, withdraw your consent, or have it deleted. Use the contact form or write to developer at bikehq dot ca. The person who runs BikeHQ is the person responsible for the protection of personal information and answers within 30 days. If the answer is not good enough, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.