Privacy Policy

Effective date: August 21, 2026

Who we are

Sick Quiver is a public catalog and community for skateboard and longboard setups. Riders create profiles and post real board setups — components, photos, video links, and notes — and visitors can browse, search, and discover what other riders actually use. The service is published by Lazar Nikolov as an individual. If you have any questions about this policy or your data, contact us at hey@sickquiver.com.

Information we collect

Information you give us. When you create an account and use Sick Quiver, we collect your name, email address, and (if you sign up with a password) a securely hashed password. We never store your password in plain text. We also store the profile and content you choose to add: your handle, display name, bio, location text, avatar, website and social links (Instagram, YouTube), riding stance, rider weight and height, skill level, the setups you publish, the photos you upload, and the comments you write.

Information from Google sign-in (optional). If you choose to sign in with Google, Google shares your email address, name, profile picture, and Google account identifier with us. We also store the OAuth tokens Google issues so we can keep you signed in. We only request basic profile and email information.

Information we collect automatically. For each signed-in session we store your IP address and browser user-agent string to keep your account secure and detect suspicious activity. We use your IP address and account identifier to rate-limit requests and prevent abuse, and we use a bot-protection challenge (Cloudflare Turnstile) on sign-up and comments.

Aggregate traffic analytics. For all visitors — whether or not you have an account — we measure anonymous, aggregate usage such as page views, which pages are visited, and the site that referred you, using a privacy-friendly analytics service (Fathom Analytics). This does not use cookies, does not store your IP address as part of your analytics data, and does not track you across other websites or build a profile of you.

What is public and what is private

Sick Quiver is a public, search-indexed setup database. The following are public and may be indexed by search engines and viewed by anyone: your rider profile, the setups you publish, the photos attached to them, your comments, and your likes, saves, and follows. Setups you keep as drafts or mark unlisted are not shown in public listings.

The following are private and are not shown to other users: your email address, your password, your IP address and session details, your Google OAuth tokens, your notifications, and any reports you submit.

How we use your information

To provide the service and let you create and manage your setups.
To authenticate you and keep your account secure.
To send transactional email such as email verification and password reset messages.
To notify you about activity on your account, and occasionally about new features on Sick Quiver. Every one of these has a one-click unsubscribe link, and you can turn each category off at any time under Settings → Notifications. We never send marketing email and we never sell or share your address.
To prevent spam, abuse, and fraud, and to enforce rate limits.
To diagnose and fix errors and improve reliability.
To understand, in aggregate, how the service is used (such as active users and feature usage) so we can improve it.
To moderate content and respond to reports.

Service providers we share data with

We rely on a small number of trusted providers to run Sick Quiver. Each receives only the data needed for its function:

Railway: hosts our database, where your account, profile, and content are stored.
Cloudflare: hosts the application, stores uploaded images (R2), and provides bot protection (Turnstile) and rate limiting.
Resend: delivers our email (verification, password reset, activity notifications, and feature announcements).
Sentry: error, performance, and product-usage monitoring. To understand how the service is used in aggregate (for example, how many people are active and which features they use), we attach your pseudonymous account identifier — a random internal ID — to this telemetry. We do not send your name, email address, or password to Sentry, and we redact tokens and other sensitive fields. As with the rest of our infrastructure, Sentry may also process your IP address as part of standard request telemetry.
Fathom Analytics: privacy-friendly, cookieless website analytics. It gives us aggregate visitor counts and page/traffic-source statistics without using cookies, without storing your IP address as part of that data, and without tracking you across sites or building a profile. It routes EU visitors' traffic through EU-based infrastructure, and does not receive your name, email, or account details.
Google: provides optional sign-in, if you use it.

We do not sell your personal data, we show no ads, and we set no advertising or cross-site tracking cookies. The only usage analytics we keep are aggregate and privacy-respecting: pseudonymous product metrics via Sentry (described above) and cookieless, anonymous traffic statistics via Fathom Analytics.

Embedded third-party content

Riders can attach Instagram, TikTok, and YouTube links to their setups, which we display as embedded posts and players. These embeds load directly from Instagram (Meta), TikTok (ByteDance), and YouTube (Google). When you view a setup containing one, your browser contacts those platforms, which may receive your IP address, user-agent, and referring page, and may set or read their own cookies under their respective privacy policies. We use YouTube's privacy-enhanced (no-cookie) mode, but we have no control over the data these platforms collect through their embeds.

Buy links and affiliate commission

Part and complete pages list places to buy the item: the manufacturer's own store and, increasingly, independent retailers and skate shops. Some of these are affiliate links: if you buy after following one, we may earn a commission from that retailer at no extra cost to you. This helps keep Sick Quiver running and free to use. It never changes which links we show you or the order they appear in. That order is based on where you appear to be and where each shop ships, nothing else. To work it out we use the country that Cloudflare derives from your connection, never anything more precise than that, and we do not store it.

Buy links pass through a redirect on our own site before sending you to the retailer. When you follow one we record the time of the click, the link that was clicked, and the two-letter country code our hosting provider (Cloudflare) derives from your connection. We do not record your IP address, your account, a session identifier, or a cookie, so these records cannot be linked back to you or to each other. We use them to understand which shops are useful to riders and to reconcile commission statements. We keep the individual records for 90 days, after which they are reduced to daily totals.

Once you arrive at the retailer's site you are subject to their privacy policy, not ours. The retailer (and any affiliate network they use) will see that you came from sickquiver.com and may set their own cookies to attribute the sale. We have no control over the data they collect.

Cookies and local storage

We use a single essential, HttpOnly session cookie to keep you signed in. We do not set any tracking or advertising cookies of our own. We also store your pseudonymous account identifier in your browser's local storage so that, if something goes wrong, we can attribute the error to your account in our monitoring tool (Sentry); it is never used for advertising or cross-site tracking and is cleared when you sign out.

Setups may contain embedded posts from Instagram, TikTok, and YouTube; when a page with an embed loads, your browser connects directly to those services, which may set their own cookies and receive your IP address and device information, governed by their own privacy policies.

Data retention

We keep your account and content for as long as your account is active. Sessions expire automatically. If you ask us to delete your account, we will remove your personal data and content; some records may be retained where required to comply with legal obligations or to prevent abuse.

Your rights

Depending on where you live, you have rights over your personal data. Under the GDPR (for users in the EU and UK), you have the right to access, correct, export, and delete your data, and to object to or restrict certain processing. We process your data to perform our agreement with you (providing the service), based on our legitimate interest in keeping the service secure and abuse-free, and — for optional Google sign-in — based on your consent.

Under the CCPA (for California residents), you have the right to know what personal information we collect and to request its deletion. We do not sell your personal information.

To exercise any of these rights, email us at hey@sickquiver.com and we will handle your request.

International data transfers

Our providers process data in the United States (Railway, Resend, Sentry, and Fathom Analytics for non-EU visitors), in the EU (Fathom Analytics routes EU visitors' traffic through EU-based infrastructure), and on Cloudflare's global network. Where data is transferred internationally, we rely on these providers' safeguards to protect it.

Children

Sick Quiver is intended for users aged 16 and older. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date shown at the top of this page.

Contact

Questions about this policy or your data? Email us at hey@sickquiver.com.