Privacy

nobbly asks you for nothing to read a verdict, and holds a little data to make the site better. If you buy a deep check we also hold your email address, because that is what your purchase is kept against. This page describes what, and how you can sidestep some of it.

What we measure

We count page views and a short list of actions, including searches. Anything you type that accidentally carries private data, a postcode or an email address say, is redacted before it reaches us.

This runs on PostHog, a privacy-first analytics service hosted in the EU, working only for us. It runs in cookieless mode: nothing is stored on your device, there is no identifier that follows you across days or other sites, and we never build a profile of you. That is why there is no cookie banner on this site.

Your IP address

Every site sees the IP address of the computer asking for a page. We use it for abuse prevention, and we scramble it first, so what we hold is a fingerprint rather than an address. It is deleted within minutes.

Your location

If you give a postcode or a town to sort by distance, it is cut down to the first half of the postcode, rounded, and kept in a cookie on your own browser for a day so the results stay put while you look. It is never put in the address bar, never sent to analytics, and never stored on our side. Clearing the location removes it.

If you buy a deep check

Buying creates an account. We hold your email address, what you bought and when, which bikes you have run deep checks on, and the Stripe reference for each payment. That is what lets you re-read what you bought and sign in again from another device. Stripe takes the payment itself: your card details go to Stripe and never reach us.

Signing in

There are no passwords. When you ask for a sign-in link, we email it to you. Once you are signed in, a cookie keeps you signed in on that browser for up to 400 days, and signing out removes it. It only exists if you have an account, and the account cannot work without it, which is why there is still no cookie banner.

Feedback you send us

Rating a verdict stores the rating, the reasons you tick and any comment you write, with no IP address and nothing tying it to you. Please don’t put personal details in the comment box: it is a note about a bike, and we’d rather not hold anything else.

Listings

Bike listings come from eBay’s official API. We deliberately hold no eBay account details: no usernames, no seller identities, no contact details. Phone numbers and email addresses are stripped out of listing text before anything is saved or sent to Gemini.

Links to eBay

Links from here to an eBay listing carry our eBay Partner Network tag, so eBay can pay us a commission if you buy. The tag is part of the link itself: nobbly sets nothing on your device for it. Once you are on eBay, eBay records that you came from us, under its own privacy notice and cookie choices, which are eBay’s to explain, not ours.

Who else touches it

These companies process data on our behalf, none of them for their own purposes:

• Vercel hosts the site (servers in London).
• Supabase runs the database, including accounts and purchases (EU).
• PostHog handles the measurement above (EU).
• Resend sends sign-in and purchase emails, so it sees your email address. They are sent from the EU, but Resend is a US company.
• Google’s Gemini reads listing text and photos to write each verdict and deep check. Nothing about you is sent to it.

Stripe takes payments. It sees your email address and card details, and is responsible in its own right for how it handles payment data, as its privacy policy explains.

Resend, Stripe and Gemini can process data outside the UK. For Resend and Stripe that means your email address, under the safeguards UK law requires for transfers.

Why we’re allowed to

For measurement and abuse prevention, our lawful basis is legitimate interests: understanding whether the site is useful and what people are looking for, and keeping it from being abused. It is measurement without profiles, and you can turn it off below.

If you buy a deep check, we hold your account because we need it to give you what you paid for.

How long it stays

Abuse-prevention counters last minutes. Analytics events are counts, not people. There is no profile attached to them: they simply stay in PostHog for trending purposes. Feedback is not about you: there is no name, address or identifier in it, and we keep it because it is how the mechanic’s verdicts get checked.

Listing details come from eBay, and we delete them no later than 60 days after a listing ends. Our own verdict and any deep check on the bike stay.

An account and its purchases are kept for as long as the deep checks in it, which do not expire. Ask us to close your account and we delete your email address and everything attached to it on our side. Stripe keeps its own record of each payment, because tax rules require one.

Opting out

You can turn measurement off for this browser. The choice is remembered in your browser’s own storage.

Your rights

You can ask what we hold about you, ask for it to be deleted or corrected, and object to the measurement above (the button does that immediately). If you have never bought anything there is usually nothing to look up, but ask anyway if you’d like to be sure. If you have, we hold your email address and a record of what you bought, and we will tell you exactly what that is.

If we don’t sort something out to your satisfaction, you can complain to the Information Commissioner’s Office at ico.org.uk.

Who we are

nobbly is run by Duncan Smith, who is the data controller for everything above. Questions about this page, or a request about your own data, go to support [at] nobbly.uk.

Last updated 28 September 2026.