Privacy policy
Current as of 12 October 2026. French law applies, and the French version is the one that prevails.
Your photos, your numbers and your theft file serve one purpose: finding your bike. Nothing is sold, nothing is published, nothing feeds advertising. You can request erasure, subject to the statutory retention and necessary evidence described below.
1. Who processes your data
The controller is Retrace, 5 parvis Alan Turing, 75013 Paris, France (see the legal notice).
Contact for any question or request about your data: contact@retrace.bike.
No data protection officer is appointed at this stage: the activity does not require one. The address above is the point of contact.
2. What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Account: email, password (never in clear text) or Google, Apple or Facebook sign-in, name if you give one, language, country | Create and secure your access | Performance of the contract |
| Bike: photos, description, brand, model, size, serial number, marking number, distinguishing marks | Build the record, compare it to adverts | Performance of the contract |
| Theft: date, place, account of what happened, status of the complaint, complaint or receipt number, station involved | Declare the theft, prepare the file, aim the search at the right area | Performance of the contract |
| The bike's address (optional) | Look close to home first | Performance of the contract |
| Phone number | Send the SMS alert when an advert stands out | Performance of the contract, SMS alert switched on by you |
| Payment: Stripe customer and subscription ids, amounts, dates, invoices | Collect the subscription, keep the accounts | Contract, legal obligation |
| Immediate-start request: confirmed wording, withdrawal and proportional-cost notice, language, terms version, payment session or subscription identifier and creation date | Record your request before payment and keep evidence of the information provided | Contract, legal obligation; legitimate interest in establishing and defending contractual rights |
| Withdrawal: name, chosen email, contract reference, declaration, identifier and receipt date and time, verified account or search association, search stop, acknowledgement delivery records, handling status and notes | Receive your declaration, send acknowledgement, process stopping and refunds, keep evidence of handling | Legal obligation, performance of the contract; legitimate interest in establishing and defending contractual rights |
| Technical logs: IP address, date, browser, actions in the account | Security, evidence, diagnosing failures | Legitimate interest, legal obligation |
| Audience measurement: page views, aggregated, no cookie | Know what is useful and what is not | Legitimate interest |
Optional fields are marked as such in the application. The others are necessary: with no photo and no number, there is nothing to compare.
Signing in with Google, Apple or Facebook
You can sign in with your Google, Apple or Facebook account instead of a password. We then receive only:
- your email address;
- your name and profile picture, if that account shares them;
- a technical identifier for that account.
We ask for access to nothing else: no contacts, no calendar, no files, no posts.
This data is used to create your account, sign you in, and write to you about your account and your alerts. It is kept as long as the account exists. It goes only to the providers in point 6 that need it: Supabase for sign-in, Brevo for emails. It is never sold, never used for advertising, and never used to train an artificial intelligence model.
Retrace's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can withdraw this access at any time in your Google, Apple or Facebook account settings, and ask for your Retrace account to be erased (point 8).
3. Data about the offence
The account of the theft, the complaint number and the station involved are data relating to a criminal offence. They are processed only to let you prepare, bring and follow your action as a victim, within the meaning of article 46 of the French data protection act of 6 January 1978. They stay in your file, are passed to no one but you, and are never used to build a file on any person.
4. How the comparison works
Your photos are analysed component by component (frame, wheels, drivetrain, brakes, saddle, accessories). Each component becomes a numerical signature. Adverts analysed go through the same treatment, and a resemblance score is computed, then corrected by price, area and date.
The score only decides whether to alert you. No decision with legal effect is taken automatically. You look at the advert, you decide, and the police act.
5. Adverts and sellers
To find your bike, Retrace analyses adverts published publicly on marketplaces, and keeps the title, description, price, photos, area, date, the advert's address, and the public elements of the seller's account (username, how long they have been a member, rating, profile link).
This processing rests on the legitimate interest of the person robbed in getting their property back, and on ours in providing that service (article 6.1.f GDPR). It does not target people: it targets objects put up for sale.
What we do not do: no reputation file, no blocklist, no identification of the person behind an account, no resale, no marketing, no cross-referencing between users beyond the advert that concerns one particular owner's bike.
Informing each seller individually would mean contacting them, which Retrace refuses to do and which would take disproportionate effort (article 14.5.b GDPR): this page is that information. If you sell a bike and want to know whether your advert was analysed, have it erased, or object to its being analysed, write to the address in point 1 with the advert's address. We answer within one month.
6. Who has access
No one, apart from the publisher and the providers below, each for their own part alone.
| Provider | Role | Where |
|---|---|---|
| Hetzner Online GmbH | Server, database, backups | Helsinki, Finland |
| Cloudflare | Photo storage, site protection | European Union (R2 bucket in Western Europe, WEUR) and United States, standard contractual clauses |
| Supabase | Accounts and sign-in | European Union (eu-west region), US company, standard contractual clauses |
| Stripe Payments Europe Ltd | Payment, invoices, subscriptions, evidence of the immediate-start request | Ireland, transfers to Stripe Inc. under safeguards |
| Brevo (Sendinblue SAS) | Sending emails: sign-in, alerts, account, withdrawal acknowledgements | France |
| Roboflow, Inc. | Locating the components on your photos | United States |
| OVHcloud (planned, not yet activated) | SMS alerts | France, then recipients' mobile carriers |
| Anthropic | Analyse a bike photo and describe it | United States, standard contractual clauses. Your photos train no model |
| Bright Data Ltd | Access to public advert pages | Israel, adequacy decision. Receives none of your data |
| Base Adresse Nationale (DINUM) and Photon (Komoot GmbH) | Complete an address you type | France, Germany |
| Umami, self-hosted | Audience measurement without cookies | Our server |
Your data can also be passed to a judicial or police authority that requests it in the proper legal form.
No data is sold, rented or traded.
7. How long we keep it
| Data | Period |
|---|---|
| Account | While it exists. On closure, erased within 30 days, backups included |
| Bike record and photos | For as long as you keep them. Deleted at once on request, erased from backups within 30 days |
| Theft file (account of the theft, complaint, alerts, reports) | During the search, then 3 years, while it can still serve in a procedure. Can be erased earlier on request |
| Phone number | While the SMS alert is switched on |
| Sending records (type, channel, date, outcome) | While the bike record exists, without copying message content or contact details into this log |
| Adverts analysed and seller accounts | 6 months, then erased. An advert kept as a candidate stays in the file of the bike concerned |
| Invoices and accounting records | 10 years, legal obligation |
| Immediate-start and withdrawal requests, evidence and handling records | For as long as needed to handle them, then to establish, exercise or defend rights under the applicable legal time limits. These records may remain after account or bike deletion. Accounting records follow the 10-year period above |
| Technical logs | 12 months |
| Audience measurement | 25 months, aggregated |
| Path through the app | 90 days |
8. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to give instructions about what happens to your data after your death.
Write to the address in point 1. We answer within one month, and may ask for proof of identity in case of serious doubt.
If our answer does not satisfy you, you can complain to the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.
9. Security
Everything runs over HTTPS. Photos sit in private storage, served through short-lived signed links. Passwords are never stored in clear text. Server access is restricted and key-based. Backups are encrypted.
If a data breach puts you at risk, you will be told, and the CNIL within 72 hours.
10. Cookies and local storage
No advertising cookie, no third-party tracker, no embedded social network. What the site stores in your browser, and why no banner asks for your consent, is detailed on the Cookies page.
11. Minors
The service is for adults. We do not knowingly collect a minor's data; tell us if it happens and we will erase it.
12. Changes
This policy can change. An important change is announced by email to account holders. The date at the top gives the version in force.