Last updated: 10 August 2026
GarageVivo records the history of a bicycle so that whoever owns it next can read it. This page says what that means for the person using it: what is stored, why, who else sees it, and how to leave. The controller is GMSoft di Gatti Matteo, Cda Ponte Tavole 3/C, Italy.
Application — the GarageVivo mobile application. Service — the Application together with the public passport pages served from garagevivo.com.
Company, we, us — GMSoft di Gatti Matteo, Cda Ponte Tavole 3/C, Italy, the controller of the personal data described here.
User, you — the person using the Application. Personal Data — information relating to an identified or identifiable person. Usage Data — data generated by using the Service.
Passport — the record of one bicycle. Public passport — that record as a stranger sees it, once you switch sharing on.
Your email address and the identity your sign-in provider gives us. GarageVivo has no password of its own: sign-in is Apple on iOS and Google on Android, and what reaches us is what those providers send.
A display name, and a picture if you upload one. Both are yours to change or empty at any time.
Your country and the language you read the Application in.
We do not collect advertising identifiers, we do not track you across other apps or websites, and we do not build a profile of you for marketing.
What you enter: name, brand, model, category, year, frame material and size, weight, colour, serial number and frame number, and the purchase date and price if you record them.
What you attach: photographs, and documents such as invoices, warranties and manuals.
What you record over time: components fitted and removed, battery measurements, maintenance, and the timeline those produce.
A serial number and a frame number are the two fields that identify a specific bicycle rather than describe it. They are never shown on a public passport.
Connecting Strava is optional and nothing about it is stored until you do.
If you connect it we store your Strava user id and username, the access and refresh tokens that let us ask on your behalf, the names of your Strava gear, and your rides: start time, distance, moving time, elevation and sport type.
Disconnecting deletes the tokens and stops the asking. Rides already imported stay on the bicycle they were matched to, because they are part of its usage history.
Contract, for the account and for everything the Service does with what you record. Without it there is nothing to provide.
Consent, for connecting Strava and for publishing a passport. Both are off until you turn them on, and both can be withdrawn without giving a reason.
Legitimate interests, for keeping the Service running, secure and free of abuse.
Legal obligation, where the law requires us to keep or produce something.
Nothing, until you switch a passport on. A bicycle is private when you register it.
A public passport shows the bicycle: make, model, category, its maintenance history, its components, and estimated usage. It never shows your name, your identity, the serial number, the frame number, your documents, or what you paid.
The link is a random 22-character token. Anyone holding it can read the passport; nobody can guess one. Switching sharing off makes the link stop working immediately, and it then answers exactly as an invented link does.
A public passport is readable without an account and may be seen by anyone you give the link to. Give it out accordingly.
Supabase, for the database, authentication and file storage.
Cloudflare, which serves this page and the public passport pages.
Strava, only if you connected it, and only for what that connection needs.
Apple and Google, for sign-in. They tell us who you are; we do not tell them what you do here.
We do not sell personal data and we do not share it for advertising.
Our processors may handle data outside the European Economic Area.
Where they do, the transfer relies on an adequacy decision or on Standard Contractual Clauses, together with the technical measures those require.
For as long as your account exists, and then thirty days.
You can delete your account from inside the Application: Account, then delete your account. Every public passport you published goes dark at that moment, not thirty days later, and the Strava connection is dropped in the same step.
After thirty days your profile is removed permanently. The bicycles you registered keep their history, with your name no longer attached to any of it — a passport is for whoever owns that bicycle next, and it cannot lose its worth because you closed your account.
What remains after that point identifies no one: a bicycle, its services, its components, and the dates they happened.
Access to your data is enforced by the database itself, row by row, rather than by the application asking politely.
Traffic is encrypted in transit, files are stored with access control, and the tokens that let us reach Strava on your behalf are held separately from the rest of your integration.
No system is perfectly secure, and we do not claim otherwise.
Access, rectification, erasure, restriction, portability, objection, and the withdrawal of any consent you gave.
Deletion is in the Application. For anything else, write to support@garagevivo.com and we will answer within one month.
You may also complain to the Garante per la protezione dei dati personali, or to the supervisory authority where you live.
The Service is not directed at children under 14, and an account may not be created below that age.
If you believe someone under 14 has created an account, write to support@garagevivo.com and it will be removed.
The Application can send you to Strava, and a passport you publish may be linked from elsewhere. What those services do with your data is governed by their own policies, not by this one.
This policy may change. The version on this page is the one in force, and the date below says when it last did.
Where a change materially affects you, we will say so in the Application rather than only here.
GMSoft di Gatti Matteo, Cda Ponte Tavole 3/C, Italy.
support@garagevivo.com