The short version
Quiver, operated by Quiver Gearworks, LLC, keeps a record of your bikes and publishes research on gear. We collect what we need to run that, and not much else. We do not sell your personal information.We do buy ads, and Google’s advertising cookies tell Google which ad led to a purchase — California law calls that sharing, so we say it plainly. Cookies and advertising explains what it covers and how to switch it off in one setting.
What you publish is public. What’s in your garage — your bikes, parts, notes and rider profile — is private, and is never shown to another rider. We do analyse it: to run your account, and to produce aggregated, de-identified statistics about how gear is owned, paired and replaced. Those statistics never identify you. The section on aggregate insights explains exactly what that can and can’t mean.
You can export or delete your data at any time by emailing auth@quiver.fyi. We’ll action it within 30 days, and usually within 7.
Who this covers
This policy applies to quiver.fyi and everything we do as a business. The controller of your personal information is Quiver Gearworks, LLC, a Delaware limited liability company. Contact us about anything in this policy at auth@quiver.fyi.
What we collect
- Your email — for sign-in (emailed codes or Google OAuth) and account notices. If you commission research without an account, we collect the delivery email you enter at checkout so we can send you the finished page. Never sold, never shared with marketers.
- Sign-in identity — the Google account subject ID, when you sign in with Google. It lets us recognise you across sessions without storing a password.
- Your contributions — the research you commission, products you add, sources you submit, reviews, takes and questions you post, photos you upload, notes you save. Some of this is public by design because you chose to publish it; the rest is private to you.
- Your garage — the bikes you own, their parts and components, serial numbers you choose to record, purchase and warranty details, service history, mileage, and the gear you save or follow. Private by default.
- Ride and device data — mileage and activity summaries from ride files you upload or from a head unit you connect, and battery readings from sensors you scan. We use these to keep wear clocks and battery status accurate.
- Your profile — username, optional bio, optional social handles, and optional rider-profile fields. These can include fitness metrics (FTP, body weight) and injury or physical history. All of it is optional, you enter it yourself, and you control which fields are public or private, one field at a time. See Fitness & injury data.
- Payment records — for a membership or a commissioned research page: what you bought, the amount, the billing email, the subscription status, and any refund. Your card details go directly to Stripe; Quiver never sees or stores your full card number.
- Usage and diagnostics — pageviews and product events via PostHog, Vercel Analytics and Google Analytics, plus a record of completed purchases sent to Google Ads so we can tell which ads work (see Cookies and advertising), plus server logs (including IP address and user agent) needed to serve the site and keep it secure. In production we also record PostHog session replays to find bugs; replays are configured to mask text and form inputs by default, so typed and displayed values are redacted.
What we don’t collect
Precise location. Contact lists. Advertising profiles of our own — we don’t build audience lists, we don’t run retargeting, and nothing from your garage, your rider profile or your research ever reaches an ad network. We don’t buy data about you from third parties, and we don’t build device fingerprints. Two things we don’t control sit next to this: our payment processor collects its own device signals at checkout to prevent fraud, which is its job, not ours, and Google’s advertising cookies record which of our ads led to a purchase — see Cookies and advertising.
Why we use it
- To run the service— sign you in, keep your garage, track wear against your mileage, resolve warranty terms, match safety recalls to the gear you’ve recorded, and deliver research you asked for.
- To take payment — process memberships and one-off research purchases, handle renewals, refunds and disputes, and keep the accounting records the law requires.
- To communicate— sign-in codes, receipts, renewal and price-change notices, safety alerts about your gear, and service messages. We’ll ask separately before sending you anything that’s purely marketing, and you can opt out at any time.
- To keep it working and safe — debugging, performance, abuse prevention, and security.
- To improve the product, in aggregate — see the next section, which is the one worth reading closely.
- To meet legal obligations — tax, accounting, and responding to lawful requests.
Aggregate insights — what we do and don’t do
The most useful thing about a catalogue of real garages is the pattern across them: which components riders actually run with a given frame, what people save as alternatives to a product, how long a chain or a set of pads really lasts. We produce statistics like that, and we use them to improve research, compatibility and wear estimates for everyone.
How that is constrained. These statistics are computed across many riders, with direct identifiers removed, and reported only at a level where no individual rider can be picked out. We do not attempt to re-identify anyone from them. We do not publish an aggregate so thin that it effectively describes one person. And an aggregate is never a route to your garage: nobody gets to see what you own by reading one.
What we never do.We don’t sell your personal information. We don’t show one rider’s garage, notes or profile to another rider. We don’t hand your individual records to brands, retailers or data brokers, and we don’t license your content to third parties for their own marketing. If we ever publish or share aggregate figures outside Quiver, they remain aggregate and de-identified.
And after you leave.Aggregated, de-identified statistics already produced don’t identify you and can’t be reversed into your data, so they survive deletion of your account. Deleting removes you from future aggregates; it doesn’t require us to rebuild past ones.
Fitness & injury data
Some optional rider-profile fields — FTP, body weight, injury or physical history — are health- or fitness-related. We collect them only if you choose to enter them, and we treat them as sensitive.
We use them to personalise your own research and garage. We do not sell them, we do not share them with marketers, and we exclude them from the aggregate statistics described above. Every one of these fields is private by default, you control its visibility individually, and you can leave them blank or delete them at any time. Deleting your account removes them with the rest of your personal data.
Who processes your data
Quiver runs on a small set of third-party services. Each is bound to use your data only to provide its service to us, and each sees only what it needs.
- Supabase — hosts the database. Your account, garage, contributions and profile live here.
- Vercel — hosts and serves the app. Sees request metadata (IP, user agent) for routing and security logging.
- Resend — sends sign-in codes and account email. Sees your email address.
- Google OAuth— verifies your identity if you choose “Continue with Google.” We request only your email and name; we never see your Google password.
- Cloudflare Images — stores avatars and product photos you upload.
- Stripe — processes payments and runs the billing portal where you manage or cancel a membership. Card details go directly to Stripe; we receive a purchase and subscription record, not your full card number.
- Anthropic — powers research generation, product extraction and enrichment. It receives the product and source material being researched. It does not receive your account email, your name, or your rider profile.
- PostHog and Vercel Analytics — product analytics and, in production, masked session replay.
- Google Analytics — traffic and on-site behaviour, on the production site only. Sees pageviews, product events, and — when you buy — what was bought and for how much. It does not receive your name, your email, or anything in your garage.
- Google Ads — tells us which of our ads led to a sign-up or a purchase. Sees that one conversion event: what was bought, the amount, and the Stripe transaction id it belongs to. Not your name, not your email, not your garage. Unlike the others on this list, Google can also read its own cookie on other sites, which is why California treats this as sharing rather than processing on our behalf.
We may also disclose information if the law requires it, to protect the rights or safety of riders or the public, or as part of a merger, acquisition or sale of assets — in which case this policy continues to apply to your data in the hands of the buyer, and we’ll tell you before it transfers.
How long we keep it
Account data lives as long as your account does. Delete your account and we remove your personal data within 30 days — usually within 7 — with three narrow exceptions, all noted elsewhere in this policy: public contributions may be retained in anonymised form so other riders’ pages don’t break; payment records are kept where tax, accounting and dispute-resolution rules require it; and aggregated, de-identified statistics remain because they no longer identify you. Server logs roll off on a short cycle in the ordinary course.
Your choices and rights
Whoever and wherever you are, you can ask us to give you a copy of your data, correct it, delete it, or stop a particular use of it. Email auth@quiver.fyi from the address on your account. We’ll respond within 30 days and won’t charge you or treat you differently for asking.
- Export— we’ll send a JSON copy of your account, garage, contributions and notes.
- Deletion— we’ll wipe your account and personal data, subject to the exceptions above. If you commissioned research anonymously there’s no account to delete, but email us from the delivery address and we’ll remove it from that purchase record.
- Correction — fix anything wrong, in the product or by asking us.
- Field-level visibility — every optional profile field is public or private at your choice, one field at a time.
- Opting out of analytics and ads — we honour Global Privacy Control and browser Do Not Track signals. With either set, the Google Analytics and Google Ads tags are never switched on and PostHog stops capturing, session replay included. See Cookies and advertising.
If you live in California, Colorado, Connecticut, Virginia, or another US state with a privacy law, those laws give you the rights above, plus the right to appeal a refusal and to be free from discrimination for exercising them. To appeal, reply to our decision and say so; a different person will review it. We do not sell personal information. We do shareit for cross-context behavioural advertising, as California defines that term: Google’s advertising cookies tell Google Ads which of its clicks led to a purchase. That began in July 2026; before then we neither sold nor shared personal information, and we have never sold it. You can opt out of the sharing at any time — Global Privacy Control is the fastest way, and Cookies and advertising lists the rest. We don’t use your data for automated decisions that produce legal effects. You may use an authorised agent, and we may ask you to verify your identity before we act.
If you’re in the UK or the European Economic Area, we rely on: performance of our contract with you (running your account and membership); our legitimate interests in keeping the service secure and improving it in aggregate; your consent for optional profile fields, including the fitness and injury fields; and legal obligation for tax and accounting records. You can object to processing based on legitimate interests, withdraw consent at any time, ask us to port your data, and complain to your local supervisory authority. Quiver is operated from the United States, so using it involves transferring your data there; we rely on appropriate safeguards, including the standard contractual clauses where our processors offer them.
Security
We use encryption in transit, access controls, and reputable infrastructure providers, and we keep the number of people who can reach production data small. No service can promise perfect security. If a breach ever affects your personal data, we’ll notify you and any regulator we’re required to, without undue delay.
Children
Quiver is for riders 13 and over, and you must be 18 to buy a membership or commission research. We don’t knowingly collect personal information from anyone under 13. If you believe a child has given us data, email auth@quiver.fyi and we’ll delete it.
Changes to this policy
We’ll update this page when our practices change, and update the date at the top. For material changes — a new category of data, a new processor, or a new purpose such as a change to how aggregate statistics work — we’ll email active account holders at least 30 days before it takes effect.
Questions
Anything unclear, or want to exercise any of the rights above? Email auth@quiver.fyi. Quiver Gearworks, LLC — quiver.fyi.