Your data powers your rides, not advertising.

Public Live Bikes searches

You can use Live Bikes without an account. As you type, Bike Beacon sends the partial search to Photon to offer nearby OpenStreetMap address suggestions. A completed manual search is sent to the U.S. Census Geocoder to find coordinates. Bike Beacon then uses the selected coordinates to request nearby station and individually parked e-bike availability from Capital Bikeshare’s public feed. Bike Beacon does not store the address or coordinates from public searches in product analytics. It records only aggregate endpoint operations such as search method, success or error outcome, response time, data-quality state, and result counts. It does not retain the search address, coordinates, IP address, or user agent in that endpoint log. If you choose “Use my location,” your browser asks permission and sends approximate coordinates for that lookup.

If you explicitly choose “Get alerts for this place,” Bike Beacon temporarily encrypts that selected location so it can power a no-account schedule preview and survive Google sign-in. If you generate that preview, Bike Beacon also temporarily encrypts the selected days, time, time zone, radius, and station limit. The setup record expires after approximately 24 hours and its location and schedule draft are removed after you save a reminder.

Privacy-safe product analytics

Bike Beacon records a small set of first-party events, such as page views, referral landings, successful Live Bikes searches, directions clicks, anonymous schedule-preview attempts, onboarding starts, invitation claims, authenticated previews, verification, reminder enablement, and delivery. It may also record the page path, first-touch and last-touch campaign tags, referring website hostname, search method, day-count, data-quality state, and aggregate station count. It does not send raw search addresses, coordinates, exact alert times, phone numbers, Calendar titles, Calendar event identifiers, saved origins, message bodies, or email addresses into analytics views. A random browser identifier is stored on your device and converted to a private, keyed hash before storage; the resulting hash can be linked to activation stages after sign-in without revealing those personal fields. You can reset the browser identifier by clearing site data.

Early-access email and invitations

If you join early access or receive an email-bound pilot invitation, Bike Beacon stores your encrypted email address, a private deduplication hash, the signup or cohort source, and the applicable status and timestamps. Invitation links use random, one-way-hashed tokens and may expire or be revoked. Bike Beacon uses this information only for pilot access and Bike Beacon product communications you requested. Email support@bikebeacon.app at any time to unsubscribe.

Alert-account data

If you create alerts, Bike Beacon stores your Google account identifier, email and display name; the day, time, time zone, and location rules you create; your verified phone number and SMS consent receipt; rider pilot authorization and cohort; activation milestones; and message delivery records. If you choose Calendar alerts, Bike Beacon also stores an encrypted Google OAuth refresh token plus the primary Calendar and event-matching rules you select. It stores limited operational metadata such as scheduler timestamps, rule-check status, retry counts, and error summaries. Operator views mask rider and invitation emails and do not expose Calendar event titles, phone numbers, message bodies, or OAuth credentials.

Shadow evaluation

Before text delivery is enabled, Bike Beacon may run alert rules in shadow mode. Shadow mode calculates when a saved day/time or matching Calendar alert would be due and may check live bikeshare availability. It records an opaque occurrence key, timing, aggregate station and e-bike counts, evaluation outcome, a one-way message fingerprint, an explicit evidence tier, and the deployed Worker version. It does not store a Calendar event title or shadow message body, and it does not call Twilio. Operations compares seven days of expected and observed checks and keeps shadow evidence visibly separate from provider-tested or carrier-confirmed production evidence.

Google Calendar data

Calendar access is optional and restricted to authorized pilot riders. When connected, Bike Beacon uses one read-only permission to view events on the connected account’s primary Google Calendar solely to show upcoming timed events, find events that match notification rules you create, generate previews you request, and evaluate enabled rules. It cannot read events from calendars the account does not own and does not create, modify, or delete calendar events. Google user data is not sold, used for advertising, or used to train AI models.

Mobile information

Bike Beacon does not share mobile information with third parties or affiliates for marketing or promotional purposes. Twilio processes phone numbers, verification requests, messages, delivery status, and opt-out events only to provide the requested SMS service.

Service providers

Cloudflare hosts the application and database. Twilio verifies phone numbers and delivers SMS. Google provides account authentication and, only when selected, Calendar data. Photon provides OpenStreetMap-powered address suggestions, and the U.S. Census Geocoder converts completed public address searches to coordinates. Capital Bikeshare’s public GBFS feed provides live station and individually parked e-bike availability.

Retention and deletion

Configuration, consent, cohort, activation, and delivery records are kept while your account is active and for a limited period needed for operations, compliance, and abuse prevention. Temporary onboarding locations and preview receipts expire automatically. Scheduler heartbeat, rule-check, shadow-decision, and mobility-feed health records are automatically limited to approximately 30 days. Structured SMS status events, event-level activation records, and location-free Live Bikes endpoint operations are limited to approximately 180 days; aggregate rider lifecycle milestones may remain with the account so Bike Beacon can measure pilot activation and retention. Account settings include self-service reminder deletion, Calendar disconnect, and account deletion. Email privacy@bikebeacon.app for additional privacy requests.

Security

Google refresh tokens, early-access and invitation emails, temporary onboarding locations, and temporary schedule drafts are encrypted at rest. Invitation tokens are stored only as one-way hashes. Administrative credentials and operator-access identifiers are stored as hosted secrets and are not committed to source control.

Contact

Bike Beacon is operated by Dylan Elder. Privacy requests: privacy@bikebeacon.app.