Privacy Policy

This policy describes the personal information the TitleVelo bicycle title registry stores, why it is stored, and who can see it. The registry is a private service. It is not a government department of motor vehicles.

Information you provide

• Account: email address, password, and country. The password is stored by the authentication service in hashed form. After the password, sign-in asks for a code by email or from an authenticator app. Adding an authenticator app also requires the email code. This browser can be trusted for 30 days so the code is not asked again on that browser. The country is the one you save on the account. On the registration form it may be suggested from the country of the connection, when the host provides that, or from the language region of the browser. You can change the suggestion before you create the account, and you can change the saved country later. The country is not shown on the public serial lookup. The account also has a role: owner, dealer, or administrator. An approved shop can create employee accounts with their own email and password. The shop owner chooses that password.
• Owner registration: your name, the account email, bicycle make, model, year, color, serial number, and the photos you upload of the serial number and the receipt. Before an administrator reviews those photos, the serial number is checked against the public Bike Index and 529 Garage for a stolen record. No match there does not mean the bicycle was never stolen. An administrator still reviews the photos before the record is marked verified.
• Stolen report: where the bicycle was taken, the ZIP code, an optional photograph, and, if you upload one, the police report. The public record shows the bicycle as reported stolen before an administrator confirms the report. The confirmation badge is added only after that review. The owner can remove the stolen report when the bicycle is found and returned. The public record then shows a verified title again.
• A message about a reported-stolen bicycle: the sender’s name, email, and message. The owner sees that message in the garage. The owner’s email is not shown to the sender.
• Dealer application: business name, employer identification number, physical address, phone, website, and the tax document and utility bill you upload.
• A recorded sale: the buyer’s name, email, and, if provided, date of birth, plus the sale date and the claim code.

Information collected automatically

Signing in places a session cookie in the browser so the account stays signed in. That cookie is required for the account. It is not an advertising cookie. The first visit shows a notice. Choosing Accept stores a notice cookie in this browser for one year so the message stays hidden. That choice is not written to the account and it is not kept as a separate record for each user.

What the public can see

A dealer filing whose serial is listed as stolen on Bike Index or 529 Garage is held for an administrator and is not returned by a public lookup. A lookup by the exact serial number returns make, model, year, color, and status. The same lookup also asks Bike Index and 529 Garage whether that serial is listed as stolen, and shows that status. The search is not saved as a TitleVelo record. Only the stolen-record status is read from those services. For a reported theft it also returns the place, the ZIP code, and whether a police report has been confirmed. Owner name, email, date of birth, dealer documents, serial photos, receipts, police reports, and bicycle photographs are not part of that public result. A partial serial number returns nothing. A visitor can send the owner a message from that card. The message is stored for the owner and a notice is emailed to the account on the title.

Who can see a private record

• The owner can see bicycles registered to that account.
• An approved dealer can see bicycles the shop still holds, including a buyer name entered for a sale that has not been claimed yet. After the buyer claims the bicycle, it leaves the shop inventory. The shop owner keeps a sales list with the sale date, the bicycle, and the serial number. That list does not include the buyer’s account. An employee of that shop can see the bicycles the shop still holds and can register a sale, and does not see the sales list. Each registration and transfer stores the shop and the person who filed it. That person is visible to the shop and to an administrator.
• An administrator can review dealer applications, owner registrations, and stolen reports, and can open the uploaded documents, photos, and police reports. An administrator can also look up a serial number and see its journal: files, upload attempts, owners, transfers, the shop, the employee who filed the record, and checks against Bike Index and 529 Garage.
• A buyer who claims a code becomes the owner of that bicycle record.

Why it is kept

The information is used to create and sign in to an account, to file and show a bicycle record, to issue and accept a transfer code, to collect the owner review fee and the transfer fee, to review a dealer application, and to send account messages such as email confirmation and password reset.

Processors

Accounts, registry rows, and uploaded files are stored with Supabase. Authentication emails, including confirmation and password reset, are sent through that service. Card payments for the $4.99 owner review and the $1.99 fee on a later transfer are processed by Stripe. The first sale from the dealer who filed the bicycle has no fee. The registry stores the payment status and the Stripe session id. It does not store the card number or a promotion code. Stripe receives the account email, the payment details, and any promotion code entered on the card page. The website is delivered by the host that publishes the application. Those providers process the information to run the registry. They are not authorized to use it for their own advertising.

How long it is kept

Account data and bicycle records are kept while the account and the record remain in the registry. A completed transfer stays on the bicycle as history. Uploaded photos and dealer documents stay in private storage until the record is removed.

Security

Private files are stored in non-public buckets and are opened with a short-lived signed link for the account that is allowed to see them. Database access is limited by row policies. No method of storage is perfect. Do not upload a document you are not prepared to file in the registry.

Your choices

From the account page you can change the sign-in email and password. Changing the email takes effect after you confirm the message sent to the new address. The registry is not directed at children under 13, and an account should not be created for a child.

Changes

A revised policy is posted on this page with a new date. The Terms of Service explain the rules for using the registry.