Privacy policy

Last updated: 6 October 2026 · Geomo · Wersja polska · Terms of service

1. Data controller

Arabean — Maciej Duszak

Sole proprietorship registered in Poland · VAT ID: PL6912271890

The controller of your personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) is Maciej Duszak, operating under the Geomo brand.

2. What data we process

2.1 Data you enter

Geomo only processes data that you enter yourself:

Height and inseam (in centimetres)
Body mobility ratings (values 1–5 for 4 parameters)
Preferred riding position
Geometry of your benchmark bike (stack, reach, size)
Bike models added for comparison

Without an account, this data is stored only locally in your browser (localStorage) and is not sent to our servers.

2.2 User account (optional)

If you choose to sign in (with a link sent by email or with a Google account), we additionally process:

Your email address and account identifier
When signing in with Google — first name, last name and profile picture URL, which Google provides automatically; they are stored in the sign-in system but not used by the app
A copy of the data from section 2.1 (profile, benchmark bike, bikes, collections) — to sync it between your devices
The date of the last sync

Account data is stored in a Supabase database on servers in the European Union (Frankfurt, Germany). Only you can access it — database security rules prevent other users from reading your data.

2.3 Contact form

If you write to us using the “Contact” form, we process the name or nickname, email address and message you provide — solely to reply to you. The message first goes to our function on Supabase servers (EU), which checks the spam protection, and is then forwarded by email via the Formspree service.

We do not use a third-party captcha for spam protection: your browser solves a short computational task in the background, and to limit the number of messages we use a one-way hash of your IP address — the IP address itself is not stored.

2.4 Data collected automatically (only with your consent)

If you consent to analytics cookies, we collect anonymous data about how the app is used through analytics tools (Google Analytics 4, Microsoft Clarity). This includes:

An anonymous session identifier
Device and browser type, screen resolution
Country/region (based on your IP address, which is not stored)
Session duration and number of pages visited
In-app events (e.g. adding a bike, calculating fit, opening a comparison)
Session recordings (anonymous, with form fields masked) — Microsoft Clarity

2.5 Data we do NOT collect

First and last name (except data provided by Google when you sign in with Google or entered in the contact form)
Email address (unless you create an account or contact us yourself)
Payment data
Precise GPS location
Health data within the meaning of Art. 9 GDPR

3. Legal basis for processing

Purpose	Legal basis (GDPR)
Operating the app (localStorage)	Art. 6(1)(b) — necessary to provide the service
User account and data sync	Art. 6(1)(b) — necessary to provide the service you chose to use
Analytics and session recordings	Art. 6(1)(a) — your consent (you can withdraw it)
Replying to contact form messages and email enquiries	Art. 6(1)(b) — necessary to handle your request
Direct marketing (if launched)	Art. 6(1)(a) — separate marketing consent

4. How long we keep data

Type of data	Retention period
Data in localStorage (profile, bikes, settings)	Until you clear it or delete your browser data
Account data (email, synced profile, bikes, collections)	Until the account is deleted — immediately when you delete it in the app, within 30 days when requested by email
Analytics data (GA4)	14 months (Google Analytics default)
Session recordings (Clarity)	30 days
Contact form messages and email correspondence	Up to 3 years from the last contact

5. Your rights

Under the GDPR you have the following rights:

Right of access — you can request information about the data we process
Right to rectification — you can correct your data in the app settings
Right to erasure — delete local data in settings (⚙ → “Delete my local data”); delete your account together with the data stored in the cloud yourself in the account menu (your initials in the top-right corner → “Delete account”) or by emailing us from the address linked to the account
Right to data portability — on request we will send you a copy of your account data in JSON format
Right to restrict processing — you can withdraw your analytics consent at any time (privacy settings)
Right to withdraw consent — withdrawal does not affect the lawfulness of processing before it
Right to lodge a complaint — with the Polish data protection authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority in your country of residence

To exercise your rights, contact: [email protected]
We respond within 30 days of receiving your request.

6. Cookies and localStorage

Strictly necessary

The following data is stored in localStorage and cannot be disabled — it is required for the app to work:

Key	Purpose
`bgc-theme`	Remembers the selected theme (light/dark)
`bgc-profile-v15`	Rider profile (height, mobility, position)
`bgc-benchmark-v15`	Current benchmark bike
`bgc-bikes-v18`	Bikes in the comparison list
`bgc-onboarding-v1`	Whether the setup wizard has been completed
`bgc-landing-seen`	Whether the welcome page has been shown
`bgc-cookie-consent`	Remembers your cookie choice
`sb-…-auth-token`	Sign-in session (only if you create an account)

Analytics (require consent)

Tool	Purpose	Provider policy
Google Analytics 4	Traffic statistics, in-app events	Google Privacy Policy
Microsoft Clarity	Session recordings, heatmaps	Microsoft Privacy Policy

7. Data processors

We use the following processors:

Supabase Inc. — user account database and sign-in (servers in the EU — Frankfurt; data processing agreement)
Cloudflare, Inc. — website hosting, domain name service (DNS), content delivery network and attack protection; also serves the React library (IP address processed on every page view; global server network including the EU; data processing agreement and SCCs)
GoDaddy Operating Company, LLC — sending sign-in link emails from [email protected] (recipient email address; SCCs)
Google LLC — sign-in with Google (only if you choose this option)
Formspree, Inc. — forwarding contact form messages by email (US servers; Standard Contractual Clauses)
Google LLC — Google Analytics 4 (EU/US servers; Google applies Standard Contractual Clauses)
Microsoft Corporation — Microsoft Clarity (EU/US servers; SCCs)
Google Fonts / fonts.googleapis.com — font loading (your IP is sent to Google on first load and is not stored by us)

8. Data security

Geomo is served over an encrypted HTTPS connection. Without an account, your rider profile is stored only locally in your browser. After you sign in, a copy of your data is stored in a database in the EU, where each user can access only their own data (row-level database security), over an encrypted connection.

We do not process health data within the meaning of Art. 9 GDPR. Anthropometric data (height, inseam) is treated as ordinary personal data and protected with standard security measures.

9. Changes to this policy

We may change this policy. We will inform you about significant changes with a notice in the app. The date of the last update is shown at the top of this document.

10. Contact and data protection officer

For privacy matters:

Arabean — Maciej Duszak
Email: [email protected]
We respond within 30 calendar days.

As a sole proprietorship we are not required to appoint a Data Protection Officer (DPO); please send all data protection matters to the email address above.

In case of any discrepancy, the Polish version prevails.