Garage — Privacy Policy

Last updated: 2026-09-19

Garage ("the app") is a shared vehicle-upkeep app: fuel logging, a maintenance calendar, and smart maintenance bundling, shared across the members of a garage. This policy explains what data the app processes, why, and the choices you have. It is written to be accurate to how the app actually works.

Who is responsible

The data controller is Karlo Hrvačić, who runs garage.hrva.cc. For any privacy request, contact garage@hrva.cc.

What the app collects

The app only stores what you enter or what is needed to run your account:

• Account: your email address and a display name.
• Vehicles: nickname, and any optional details you add — make, model, year, trim, licence plate, VIN, vehicle type, timing drive, gearbox and final drive type, and a photo.
• Fuel entries: date, odometer, volume, price, total, station, and notes.
• Service and maintenance: dates, odometer, service types, cost, shop, notes, and the reminder intervals you set.
• Garage: which garage you belong to and your role in it.
• Company garages: if your garage is on the company plan, which cars were handed to you on which days and the odometer readings at each handover, whether you confirmed a handover, how an entry was paid (company card, company cash, your own money) and when the company paid you back, and any incident you or an administrator record — what happened, when, the amount if there is one, and a photo if one is attached. The company's own name, OIB and address, if an administrator enters them, are printed on the accountant pack.
• Cost entries: date, category, amount, odometer, and notes.
• Income entries: date, kind, amount, odometer, and notes — including what a vehicle sold for, if you record it.
• Odometer readings: date and reading, when you log one on its own.
• Trips: date, distance, how long it took, whether it was private or business, the place names you type for where a journey started and ended, and optionally the name of the driver. Those are text you write, not a position the device measured — the app never records where you have been. If you write down someone else's name as the driver, you are recording another person's data in your garage: only the members of that garage can see it, and it is deleted with the trip, the vehicle, or the garage.
• Tyre sets: a name, season, size, where a set is stored, which set is on the vehicle, when it was made, and the tread depths you measure, with the date and odometer of each measurement.
• Documents: the paperwork you record for a vehicle — which kind it is (registration, roadworthiness, insurance, green card), the number and issuer written on it, the dates it was issued and runs out, and your notes. A photo or scan you attach to one is stored the same way any other attachment is.
• What a vehicle is worth: if you enter your own estimate of a vehicle's current value, we store that figure and the date you entered it.
• Attachments: any receipt, invoice, or document you choose to attach to an entry, along with its file name and size. Files are stored in a private bucket and are only reachable through short-lived links issued to members of your garage.
• API keys and webhooks: if you create them (More → Your data → API access), we store a name, a hash of the key — never the key itself — when it was last used, and any webhook URL you register with the secret used to sign calls to it, the name you gave the webhook, the vehicles and events you chose for it, and the language of its messages.

Kept on your device

Some things are stored on the phone or browser itself, never on our servers:

• A copy of your garage, so the app can open on something rather than on a spinner while it checks for changes. It holds the same garage and vehicle details listed above, it is refreshed every time the app opens, and signing out deletes it. Another account signing in on the same device is never shown it.
• A copy of your cars' entries and reminders, so the app can show them when there is no signal. It holds the cars' entries, reminders, documents, tyres, parts, named routes, guest passes and the garage's member names. It is refreshed every time it can be, marked as old on screen when it cannot, and signing out, or deleting your account, deletes it.
• Entries you make with no signal, until they can be sent. More → Waiting to sync lists them.
• Your own trip checklist, your chosen garage, units, and screen preferences.
• Which reminders this device has already shown you, so that each one is shown once rather than again every day. Only where the app shows reminders itself instead of receiving them from us.

Signing out deletes the copies of your garage and of your cars' entries, as above. Clearing the app's data, or uninstalling it, removes all of these.

VIN lookups (only when you ask for one)

The vehicle form has a Look up button next to the VIN field. Pressing it sends that VIN — and nothing else — to the United States NHTSA vPIC registry (vpic.nhtsa.dot.gov), a free government service, to fill in make, model, and year. This is a transfer outside the EU, it happens only when you press the button, and no account data accompanies it. Leave the button alone and no VIN ever leaves your device.

The vehicle's Car tab has a Check for recalls button. Pressing it sends the make, model, and year — and nothing else — to the same registry (api.nhtsa.gov) to look for open safety recalls. This is also a transfer outside the EU, it also happens only when you press the button, and it is asked for once per visit rather than remembered. The registry is American, so a European vehicle may have recalls that never appear there and a match may not apply to a European build; the app says so beside the button.

Webhooks (only if you register one)

If you register a webhook, what happens in your garage is posted to the URL you chose, signed with that webhook's secret: an entry as it was saved, edited or deleted; a vehicle added, archived, restored, lent, returned or handed over, by name and without its plate or VIN; a member joining or leaving, by display name; and the kinds of work and the day they fall due. A chat service such as Discord, Slack, Teams or Telegram gets a readable summary instead, in the language you chose for the webhook, which for an entry includes the station, the amounts, the note and the display name of whoever logged it. You are choosing where that data goes; we deliver it to that address, retry for about an hour if it does not answer, and keep what was sent, when, and whether it arrived for 30 days, so your garage can see its webhook working.

Location (fuel stations, and filling in a fill-up)

If you grant the location permission, your device position is used on the device only, for two things: sorting nearby fuel stations by distance, and — when you are recording a fill-up at a station — filling in that station's name and its currently posted price for your fuel. The station list and its prices are already on your phone; matching your position against them happens there.

Your location is never sent to our servers and never stored. If you decline the permission, both features simply do nothing and the rest of the app works unchanged. The permission is requested only from the Fuel stations screen or from the control in Settings that explains it, never in the background.

Push notifications (only if you enable them)

If you allow notifications, Firebase Cloud Messaging issues your device a registration token. We store that token, and which account it belongs to, so a reminder that becomes due can be sent to the right devices. It is a device identifier: it identifies the installation, not you personally, and it changes if you reinstall the app or clear its data.

Google acts as a processor for delivery (see below). The message itself carries only what the reminder says — a vehicle's name and what is due. In a company garage an administrator can also ask the app to remind a driver that a receipt is missing; that is a push to the driver's own devices, sent once per request, carrying the vehicle's name and the entry's date. Signing out deletes the token for that device, and deleting your account deletes all of them.

What the app does not collect

• No location data stored or transmitted to our servers (see the location note above for on-device use).
• No advertising identifiers, and no ads.
• No third-party analytics or trackers.
• No cross-app or cross-site tracking of any kind.

Who processes your data

• Supabase acts as our data processor and hosts the database, authentication, and file storage in the EU (Stockholm) region. Your data stays in the EU.
• Cloudflare serves the web app, this policy and the other pages at garage.hrva.cc. Like any web host it sees the IP address of whoever asks for a page, and the address of the page, which for an invite or a confirmation link includes the code in it. It is a US company with a worldwide network, so that request may be answered outside the EU. Nothing you log passes through it: the app talks to Supabase directly.
• Google is involved in two optional places. If you choose "Continue with Google" to sign in, Google authenticates you and returns a token; sign in with email and password and it is not involved. If you allow notifications, Google operates Firebase Cloud Messaging, which delivers the push to your device and therefore processes the device's registration token and the message contents. Decline notifications and no token is ever created.
• mzoe-gor.hr (Croatian Ministry of Economy) provides the public fuel-price dataset shown on the Fuel stations screen. Your device requests the dataset directly from their server when that screen loads, when you log a fill-up (to offer today's posted price and to note the cheapest station nearby), and, for a garage in Croatia, when Statistics loads (to count fill-ups saved under a station's older name under its brand). Like any web request, that exposes your IP address to them. No account data is included in the request.
• NHTSA (US Department of Transportation) decodes a VIN when you press Look up on the vehicle form, and looks for open safety recalls when you press Check for recalls on the Car tab. Both only on a press. See the VIN section above.
• Anywhere you point a webhook. A webhook you register sends your own garage's entries, vehicles, loans, members and due reminders to a server of your choosing; that server is outside our control and governed by whatever policy applies to it.

Your data is transmitted over encrypted connections (HTTPS/TLS).

How your data is shared

Your vehicle, fuel, and maintenance data is visible to the other members of your garage — that is the whole point of sharing one. It is never visible to any other garage, or to anyone outside yours. Access is enforced at the database level by row-level security, not only in the app.

Lending a car to someone outside your garage

You can give somebody a guest pass: a code that lets them log against one of your vehicles, for a set number of days, without joining your garage. This is what happens to their data and to yours.

• They see one car, not your garage. A pass covers the single vehicle it was issued for. Your other vehicles, your costs and the people in your garage stay invisible to them.
• They always see what a driver needs to know. Whoever holds a pass sees the car's own record (its name, type, make, model, year, trim, plate, VIN, the fuels it takes, tank size and drivetrain), its current odometer reading, when its insurance, green card and roadworthiness run out, the problems still open on it with the note you wrote, and the tyres it is on. They never see what you paid for the car or what you say it is worth, none of your costs unless you allow them, no document numbers and none of your attachments.
• They do not see the rest of your history unless you say so. Beyond that short list, a pass holder sees only the entries they wrote themselves. Letting them see the car's earlier history is a switch you turn on when you create the code, and what the work cost is a second one.
• What they log stays with the car. Fill-ups, drives and costs a pass holder records become part of that vehicle's history and remain there after the pass ends, recorded against their name. This is so the car's record stays true; it also means their entries are visible to the members of your garage indefinitely.
• Access ends, data does not. When a pass expires, when you withdraw it, when the holder gives the car back, or when you sell the car to another garage, the holder immediately loses access. Nothing they logged is removed.
• If you hold a pass, the entries you create are visible to the garage that owns the car. The owner can see what you logged, and when.

Enforcement is at the database level by row-level security, not only in the app.

Company garages: an administrator and drivers

A garage on the company plan is a company's fleet, and the people in it are its employees. This is what each of them sees.

• An administrator sees every entry on the garage's cars — fill-ups, drives, services, costs, incidents — together with who had which car on which day, which is read from the handover log rather than from who typed the entry. That is the point of the plan: a company has to know who was responsible for a car.
• A driver sees the cars handed to them, and nothing else. Not the other cars, not the garage's costs, not the people's spending. Enforcement is at the database level by row-level security, not only in the app.
• The app records the places you type, never a position. A drive is a date, a distance and the place names written into it; the phone's location is used only on the device, as described above.
• The company is the controller of its employees' data and the app is its processor. A data-processing agreement is part of the company plan's terms and is provided before a garage is put on the plan. Questions about what your employer can see are for your employer; questions about the app are for garage@hrva.cc.

A driver is told this in the app the first time "My cars" opens.

Retention and deletion

• Your data is kept until you delete it.
• Attachments are deleted with the entry they belong to, with the vehicle, and with the garage — the file is removed from storage, not just its record.
• Deleting your account (More → Settings → Delete account) removes your account immediately. If you are the last member of a garage, that garage's vehicles and all their history are deleted along with it.
• Leaving a garage removes your membership; a garage with no members left is deleted automatically.
• In a company garage, the handover log keeps which car was handed over on which days after you leave, and keeps the dates without your account after you delete it; the entries you logged stay with the car, as in any shared garage.

Your rights (GDPR)

• Access and portability: export all your vehicle, fuel, and service data as spreadsheets from More → Your data → Export as spreadsheets (a zip of CSV files), at any time, without needing this app. More → Your data → Back up everything writes the whole garage — every kind of entry — as a JSON file you keep, and which the app can read back. A read-only API (More → Your data → API access) gives the same data as JSON on demand, so your records stay usable outside this app by design.
• Erasure: delete your account in-app, as described above.
• Other requests (rectification, restriction, objection, or a copy in another form): contact garage@hrva.cc.

Children

The app is not directed at children and does not knowingly collect data from them.

Changes to this policy

If this policy changes, the updated version will be posted at garage.hrva.cc/privacy with a new "last updated" date.