BigBikeTrips

Privacy policy

Last updated 17 October 2026.

This policy explains the personal data BigBikeTrips collects on this website, why we hold it, and how long we keep it.

Who is responsible

The controller of personal data on this website is CodeMango OÜ, an Estonian company. BigBikeTrips is a collaboration project of CodeMango and Prendaram.

A collaboration project of CodeMango and Prendaram

What we collect

We only store what you send through a form, plus a small amount of technical data needed to run the site.

Road problem reports

When you report a road problem you give a category, a location (a landmark and/or coordinates), a description, the date you saw it, and an optional photo. Your name is optional and, if you give it, is shown with a published report. Your email is required, stored with the report, and shown only to administrators in the private review tools. It is never published on the public site.

If you attach a photo we store the file as you uploaded it. We do not strip location data a camera may have written into the file. The photo is removed when the report is deleted.

Coordinates are optional. The “Use my location” button reads your position in the browser only if you choose it, then puts the numbers in the form.

After a moderator approves a report, the public site shows the category, location, description, date, optional name, and photo. Approved reports later drop off the public lists when their flag expires. The stored record, including the email, is then deleted on the schedule below.

Weekly Ride Report

The newsletter form stores the email you enter and which page you signed up from. We send a confirmation link to that address (double opt-in). Until you confirm, you are not subscribed. You can unsubscribe from any mail we send. Unsubscribing records the time; the row stays so we do not mail you again. We delete it if you ask.

Shop listings

The “List your shop” form stores the shop name, category, town, province, optional website, optional phone, optional description, a requested listing type, and a required contact email. The contact email is for listing review only and is never shown on the public shop pages. Name, place, website, and, on Featured listings, phone and description may appear once a listing is published. We keep a listing while it is used, and delete the contact email or the row if you ask.

The dealer directory is imported staff data, not a public form. Guests see a shop name, brand, province or city, and outlet type. Address, phone, coordinates, and a manufacturer source link are shown only to signed-in members. Source links to competitor sites are never shown. Notes and dealer emails are never shown.

Accounts

Riders can create a member account with a name, email, and password to see dealer addresses, phone numbers, coordinates, and manufacturer source links. Email verification and password-reset mail is sent only when sending is enabled. Staff accounts used to review reports, and member accounts, are kept until we delete them on request.

Privacy requests

The form on this page stores your name if you give one, your email, and your message so we can answer. Those requests are not published. We keep them until we have finished handling them, and delete them if you ask.

Cookies, sessions, and technical data

The site sets a session cookie, a CSRF (XSRF) cookie, and a locale cookie (`bbt_locale`) so forms work, the server can keep a short-lived session, and the language switcher can send you back to English or Thai. These are first-party cookies from this site. Members and staff who sign in use the same session cookie.

When the session is stored in the database it can include an IP address, a browser user agent, and, if you are signed in as a member or as staff, a user id. Sessions expire after two hours of idle time.

Road-report, newsletter, shop-listing, and privacy-request submissions are rate-limited by IP address so the forms cannot be flooded. The IP is used as a short-lived throttle key. It is not stored as part of your report, subscription, shop listing, or privacy request. Those keys expire with the limiter window (up to one hour). Leftover rate-limit records are removed after 30 days.

The application writes error and bot-check logs (for example a failed Cloudflare Turnstile check). Those logs are for running the site. We keep application and leftover server logs for 30 days, then delete them.

Third parties

Public forms load Cloudflare Turnstile to check that a submission is from a person. Your browser talks to Cloudflare for that check. We send the resulting token to Cloudflare to verify it.

In production, if analytics is configured, the site loads Cloudflare Web Analytics. That beacon is cookieless.

Page fonts are served from this site’s own assets (Fraunces, DM Sans, Noto Sans Thai, Noto Serif Thai). Visitors do not load fonts from Google in the browser.

Dealer map pages load OpenStreetMap tiles through CARTO for signed-in members. Guests do not receive coordinates or map tiles.

Confirmation, newsletter, email-verification, and password-reset mail, when sending is enabled, goes out through the mailer configured on the server we operate. We do not currently send that mail through a named third-party mail processor.

The website is hosted on a server we operate. Cloudflare provides Turnstile and, when configured, cookieless Web Analytics.

How long we keep data

A scheduled command enforces these periods. Photos stored with a report are deleted with that report.

Road reports, including the email stored with them, are deleted 12 months after the report is reviewed and closed (when an approved flag expires, or when we close it).

Rejected or spam reports are deleted 90 days after that decision.

Staff accounts and member accounts are kept until we delete them on request.

Application logs and leftover rate-limit records are deleted after 30 days. Sessions expire after two hours of idle time.

Newsletter rows, shop listings, and privacy requests stay until you ask us to delete them, or until we no longer need them to provide the service (for example, a live shop listing).

Your rights

Under the GDPR and Thailand’s Personal Data Protection Act you may ask us to access the personal data we hold about you, to correct it, to delete it, or to object to or restrict how it is used. You may withdraw consent, for example by unsubscribing from the newsletter. You may also complain to a data-protection authority in your country. Use the form on this page to make a request.

Privacy questions

Write to CodeMango OÜ using the form below. We do not publish a privacy email address. Your request is stored for staff and is never shown on the public site.

Changes

If what we collect or how long we keep it changes, we will update this page.