Privacy Policy

Cycling Project requires no account, shows no ads, and collects as little data as possible. This page explains, plainly and without fine print, what we process and why.

1. Who we are

Cycling Project (cyclingproject.co, the "Site") is an independent personal media project about road cycling. The Site is run by a private individual, not a registered company:

Chub Vadym, tax resident of Portugal
Email: [email protected]

For the purposes of the EU General Data Protection Regulation (GDPR), this individual acts as the data controller for the Site.

2. What data we process

Technical data (server logs). When you open the Site, our hosting infrastructure automatically processes your IP address, browser and device type, requested pages, and the date and time of the request. This is needed to deliver the page to you, protect the Site from attacks and abuse, and diagnose failures.

Preferences stored in your browser. Your cookie choice and saved cards are stored locally in your browser (localStorage) and are not sent to our servers. The selected interface language is stored in the NEXT_LOCALE cookie — it is sent to the server with every request, because without it the site does not know which language to serve you. We do not log it, associate it with you, or share it with third parties. See the Cookie Policy for details.

Account. If you create an account, we store the email address, name, and profile picture received from Google, together with the identifier of your account in that service. The email address is used to sign you in. We send newsletters only with your separate, explicit consent, which you can give or withdraw at any time; creating an account does not itself constitute such consent.

Correspondence. If you email us, we process your address and the content of your message in order to reply.

Analytics. We use Google Analytics 4 to understand how the site is read: which cards are opened, in which languages, from which countries. Analytics is enabled only after your consent in the cookie banner — before that, no data is sent to Google. We show no ads and do not sell data to third parties.

We do not require accounts, do not collect payment data, do not show advertising, and do not sell personal data.

3. Legal bases

• Performance of a contract (Art. 6(1)(b) GDPR) — account data. When you create an account, we process your email, name and profile picture to provide the service you asked for: sign-in and saved cards. Without this data an account is technically impossible.
• Legitimate interest (Art. 6(1)(f) GDPR) — operating the Site, security, server logs, and replying to your messages.
• Consent (Art. 6(1)(a) GDPR) — analytics. You give it in the cookie banner and can withdraw it at any time via the "Cookie settings" link in the footer. Withdrawal does not affect the lawfulness of processing carried out before it.

4. Who processes data on our behalf

To run the Site we use infrastructure providers (processors) that may technically process the data described in section 2 under our instructions and data processing agreements: hosting and CDN (e.g. Vercel, Cloudflare), database (e.g. Neon or Supabase), error monitoring (e.g. Sentry), and an email provider.

For account sign-in we use Google as the authentication processor, and for analytics — Google Analytics 4 (only after your consent in the cookie banner). In both cases Google processes data under its own privacy policy (policies.google.com/privacy).

5. Transfers outside the EEA

Some of our providers are located in the United States. Transfers to them rely on the European Commission's adequacy decision (EU–U.S. Data Privacy Framework) and/or Standard Contractual Clauses.

6. Retention

• Server logs — short-term, per the providers' policies (typically up to 30–90 days).
• Correspondence — for the duration of the exchange and a reasonable period afterwards.
• Local preferences (localStorage) — in your browser, until you delete them.
• Account data — until you delete your account in Settings.

7. Your rights

Under the GDPR you have the right to access, rectify, and erase your data, to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent. To exercise these rights, email [email protected] — we will respond within one month.

If you have an account, you can delete it at any time in Settings. Deletion is immediate and irreversible: your profile, saved cards, and records of connected services are erased from our database. The same page lets you download all your data in JSON format.

Deleting your account on our side does not revoke the permission you granted the app in Google. You can do that in your Google account settings.

You also have the right to lodge a complaint with a data protection supervisory authority: in Portugal, the CNPD (cnpd.pt), or the authority in your country of residence.

8. Cookies

Cookies and localStorage are covered by a separate Cookie Policy.

9. Children

The Site is not directed at children under 16, and we do not knowingly collect their personal data.

10. External links

The Site links to third-party resources (news sources, official team and manufacturer websites). We are not responsible for their content or privacy practices.

11. Changes to this policy

We may update this policy. The current version is always available on this page with its update date; we will flag material changes on the Site.

12. Contact

For any data-related questions: [email protected].