Privacy & cookie policy no tracking, promise ✕
Last updated: 28 July 2026
This policy explains what personal data is involved when you use ToastBikes, why, and the rights you have. We have written it in plain English and kept it honest: ToastBikes is a UK street-trials site with a members-only spot map, rider accounts, group rides, bike-park pages, a photo gallery with a “toast” rating feature, and a browser game (Toast Trials). Most of it you can read without an account; the spot map deliberately needs one.
The most sensitive thing here is location data — where riding spots are, and which of them you have said you visited or are riding to. That is why exact spot locations are shown only to signed-in riders. There is no advertising, no marketing and no analytics or tracking of any kind, and we do not build profiles of visitors.
1.Who we are (controller & contact)
ToastBikes is run by Matt Spencer, based in Portsmouth, United Kingdom (“ToastBikes”, “we”, “us”). For the personal data described here — including player accounts and the leaderboard — we are the data controller under the UK General Data Protection Regulation (UK GDPR) and, where it applies, the EU General Data Protection Regulation (EU GDPR).
You can reach us about privacy at: [email protected]
If you contact us, we will only use what you send us to handle your request.
2.What we process and why
We deliberately collect as little as possible. The table below lists everything that is processed when you use the site.
| Data | Why | Personal data? |
|---|---|---|
| Security logs — your IP address and standard request metadata (e.g. time, page requested, browser/user-agent), captured by our content delivery network (Cloudflare) and our origin web server. | To keep the site online, secure and available — for example detecting and blocking abuse, attacks and excessive automated traffic. | Yes — an IP address can be personal data. |
| Where you ride — the coordinates of any spot you add, and a record that you marked a spot as visited or said you are coming to a ride. Rides carry a meet point and a time. | To run the spot map and group rides. Exact locations are released only to signed-in riders; signed-out visitors see coarse area clusters and no precise pins. | Yes — this is location data about you, and it is the most sensitive thing on the site. We do not track your position: nothing is recorded unless you tap something. “Near me” reads your device location in your browser to centre the map and is never sent to us or stored. |
| What you write — spot names and notes, reviews, ride details, and direct messages to other riders. | To let riders share what a spot is like and arrange to ride together. | Yes. Direct messages are readable by you and the rider you sent them to. They are not end-to-end encrypted — they sit in our database, and the person who runs the site could technically read them. We do not, but you should know that rather than assume otherwise. |
| Photos — any picture or 360° panorama you upload for a spot. | To show riders what a spot actually looks like. | Yes, if you are identifiable in one. Location data embedded by your camera (EXIF GPS) is stripped during processing and never stored — we tested this by putting a GPS-tagged photo through the upload pipeline and confirming nothing survives. |
| Your rider account — your email address, your password (which we never see — see section 5), your rider name, your points tally, and any bike spec you choose to add to your profile. | To run accounts, the spot map, rides and the leaderboard. | Yes. Your rider name and bike spec are public — they appear on spots you add, reviews you write, rides and the leaderboard. Your email address is not public. |
| Telegram — only if you choose to link the notifications bot: the Telegram identifier needed to send you a message. | To send you the alerts you opted in to. | Yes. Unlink it and we delete it. If you never link it, we hold nothing. |
Functional local storage (gallery) — two first-party items saved in your own browser: tb_rated (which images this browser has already rated) and tb_rated_pick (the score you gave each image, so we can highlight your own pick). |
So the rating feature knows what you have already toasted and does not prompt you twice on the same device. | It stays on your device. We do not read it from, or send it to, our servers. |
Functional local storage (game) — three first-party items saved by the Toast Trials game in your own browser: tb_user (a nickname you can choose to type in), tb_scores (your score history) and tb_best_guest (your best run). |
So the game can greet you by the name you picked and show you your own past scores on this device. | It stays on your device. We do not read it from, or send it to, our servers. |
| Account & leaderboard data — only if you choose to create an account: your email address, your password (which we never see — see section 5), your chosen display name and the scores you post. | To run the game’s optional player account and its public leaderboard. | Yes — see section 5 for the full picture. |
| Ratings — when you rate an image, our ratings endpoint updates an aggregate count/total for that image only. | To show how many “toasts” each photo has received. | No. We store only per-image totals. We do not store your IP address, an identifier, or anything that could identify you with a rating. |
That is the complete list of what we process. We do not run analytics, advertising, marketing emails, social-media tracking pixels, or always-on third-party embeds, and we do not build profiles of visitors. (Our Films page loads a YouTube player only if you choose to press play — see section 6.)
3.Lawful bases
- Security logs (IP & request metadata): our lawful basis is legitimate interests (Article 6(1)(f) UK/EU GDPR) — specifically our interest, and yours, in keeping the site secure, available and protected from abuse. We use this data only for security and abuse-prevention and keep it briefly (see Retention). You can object to this processing (see Your rights).
- Functional local storage (
tb_rated,tb_rated_pick): this is strictly necessary to provide a feature you actively use (the rating tool), and the data never leaves your device. - Game local storage (
tb_user,tb_scores,tb_best_guest): the same position — strictly necessary to provide a feature you actively use (playing the game and seeing your own scores), and the data never leaves your device. - Player accounts & leaderboard: our lawful basis is contract (Article 6(1)(b)) — when you create an account you are asking us to provide the account and leaderboard service, and we need this data to provide it. We also rely on legitimate interests (Article 6(1)(f)) for preventing abuse of the leaderboard — for example blocking impossible scores or offensive display names.
- Ratings: these involve no personal data — we store only aggregate per-image totals — so data-protection law does not require a lawful basis for them.
4.Cookies & local storage
ToastBikes sets no cookies of its own, and uses no tracking or advertising cookies whatsoever.
The only browser storage we use is first-party localStorage — the items below, all created and read in your browser and never used to track you across sites:
tb_rated — records which images this browser has rated, so you are not asked to rate the same image twice.
tb_rated_pick — remembers the score you gave each image, so the page can highlight your own pick when you come back.
tb_user — the nickname you can choose to give yourself in the Toast Trials game. Entirely optional; make one up.
tb_scores — your game score history, so the game can show you how you have been doing on this device.
tb_best_guest — your best run in the game, so it can be displayed as your personal best.
sb-…-auth-token — only if you sign in to a player account: your Supabase sign-in session, so you stay signed in between visits. Sign out and it is removed.
You can clear any of these items at any time by clearing your browser’s site data for ToastBikes, or by using your browser’s private/incognito mode. Doing so means the rating feature and the game will treat your browser as new, and you will be signed out of your account if you had one. Your local score history is lost (we never had a copy); your account and leaderboard scores are unaffected until you delete the account itself.
5.Player accounts & leaderboard
You can play Toast Trials as a guest forever — nothing is collected and nothing leaves your device. A player account exists for exactly one reason: posting your scores to the public leaderboard under a display name you choose. ToastBikes (Matt Spencer — see section 1) is the data controller for account and leaderboard data.
What we collect when you create an account:
| Data | Notes |
|---|---|
| Email address | Used to sign you in and for essential account messages only (e.g. confirming your address, resetting your password). Never for marketing — we send no marketing emails at all. |
| Password | We never see it. Your browser sends it directly to Supabase (our authentication provider) over an encrypted connection, where it is stored only as a salted hash. It never touches our own servers. If you sign in with Google instead, no password is involved at all. |
| Display name | Chosen by you. This is the name shown publicly on the leaderboard — it does not need to be, and probably should not be, your real name. |
| Game scores | The scores you choose to post, with the time they were set. |
Signing in with Google (optional). If you choose “Sign in with Google” instead of email and password, Google handles the sign-in and tells us your email address so we can create your account. For its own sign-in service, Google acts as an independent data controller under its own privacy policy. If you never use it, Google is not involved in your account at all.
Where the data lives. Account and leaderboard data is stored by Supabase, our data processor, in a database hosted in AWS London (eu-west-2), United Kingdom, encrypted at rest, under a data processing agreement — see sections 6 and 7.
Deleting your account. Your account lasts until you delete it. You can delete it yourself in the game, or ask us (section 1). Deletion is immediate and cascading: your account, email address, display name and all your leaderboard scores are erased together. Guest play keeps working afterwards, because it never needed the account in the first place.
Age. Accounts are for players 13 and over. Younger players can play as guests — no account needed, and nothing leaves the device.
And to be explicit about what we do not do with account data: no marketing emails, no profiling, no ads, no selling or sharing, no tracking across sites. The account does one job.
6.Third parties
We keep third parties to the absolute minimum:
| Who | What they do for us | Their role | Where your data lives |
|---|---|---|---|
| Cloudflare | Content delivery network (CDN), hosting-edge and security/anti-abuse protection. Processes connection data such as your IP address and request metadata. | Our data processor, acting on our instructions. | Global edge network — see section 7. |
| Supabase | Hosts the player-account and leaderboard database, including sign-in (authentication). Handles your password so that we never see it. | Our data processor, under a data processing agreement (DPA). | AWS London (eu-west-2), United Kingdom. Encrypted at rest. |
| Google Sign-In | Optional “Sign in with Google” for player accounts. Only involved if you choose it. | Independent controller for its own sign-in service, under Google’s privacy policy. | Per Google’s own policy. |
| YouTube / Google | Video player on the Films page — but only if you press play. Thumbnails are hosted by us, so nothing loads from YouTube when the page opens. The player uses youtube-nocookie.com (privacy-enhanced mode). |
Independent controller from the moment you press play, under its own privacy policy. | Per Google’s own policy. If you never press play, YouTube is never contacted. |
We do not sell, rent or share personal data with anyone for marketing, advertising or any unrelated purpose.
7.International transfers
Account and leaderboard data stays at rest in the UK — Supabase hosts it in AWS London (eu-west-2). In limited cases, Supabase support staff or sub-processors outside the UK/EEA may access data to keep the service running; those transfers are covered by the safeguards in Supabase’s data processing agreement — the UK International Data Transfer Addendum (IDTA) and/or the European Commission’s Standard Contractual Clauses (SCCs).
Cloudflare operates a global network, so your request may be handled by servers outside the UK and the European Economic Area (EEA). Where personal data is transferred outside the UK/EEA, it is protected by appropriate safeguards as required by UK and EU GDPR — for example the UK International Data Transfer Addendum and/or the European Commission’s Standard Contractual Clauses, as implemented by Cloudflare. If you would like more detail on these safeguards, contact us using the details in section 1.
8.Retention
- Security logs (IP & request metadata): kept only for a short period for security monitoring and abuse-prevention, then deleted or aggregated. We (and Cloudflare) do not retain these logs longer than needed for those purposes.
- Functional local storage (
tb_rated,tb_rated_pick,tb_user,tb_scores,tb_best_guest,sb-…-auth-token): stays in your browser until you clear it (or sign out, for the sign-in token). We hold no copy. - Account & leaderboard data: kept for as long as your account exists. Delete your account (in-game or by asking us) and it is all erased immediately — account, email, display name and scores together.
- Aggregate ratings: retained for as long as the gallery is published, but these are anonymous per-image totals and are not linked to you.
9.Your rights
Under the UK GDPR and EU GDPR you have rights over your personal data. In practice the personal data we deal with is the short-lived security-log data described above and, if you created one, your player account. Where the data we hold relates to you, you have the right to:
- Access — ask whether we hold personal data about you and get a copy;
- Rectification — ask us to correct inaccurate or incomplete data (you can also change your display name yourself);
- Erasure — ask us to delete your data (“right to be forgotten”) — for accounts, the in-game delete button does exactly this, immediately;
- Restriction — ask us to limit how we use your data;
- Objection — object to processing based on legitimate interests, including our security logging and leaderboard abuse-prevention;
- Portability — receive certain data in a portable, machine-readable format. For accounts this includes your scores: ask us and we will send you your score history as a machine-readable file.
To exercise any of these, email us at [email protected]. We will respond within the timeframes the law allows (normally one month) and we will not charge you in normal cases.
A practical note: because security logs are kept only briefly and are not indexed by name, and because ratings and the on-device tb_* items contain no information that reaches us, we may be unable to single out that data for a specific person. Account data is different — it is tied to your email address, so we can always find, correct, export or delete it for you.
10.Complaints (ICO & EU authorities)
If you are unhappy with how we have handled your personal data, you can complain to a data protection regulator. We would, of course, welcome the chance to address your concerns first.
- UK: the Information Commissioner’s Office (ICO) — ico.org.uk.
- EU/EEA: you may complain to the data protection supervisory authority in your country of residence, work or where the issue occurred.
11.Children’s privacy
ToastBikes is a general-audience photo gallery with a browser game. Accounts are for players 13 and over; younger players can play as guests — no account needed, and nothing leaves the device when playing as a guest. We do not profile players of any age, we send no notifications, and there are no tricks to nudge anyone into creating an account — guest play is the default and stays fully featured. Display names on the leaderboard are freely chosen, and we suggest not using a real name. If you believe a child under 13 has created an account, or a child’s personal data has otherwise reached us, contact us and we will delete it.
12.Changes to this policy
If we change how the site works in a way that affects this policy, we will update this page and revise the “Last updated” date below. Material changes will be reflected here; please check back from time to time.
Last updated: 4 July 2026