Privacy

• Your account. Email address, a hashed password (bcrypt — we never hold the password itself), your username and display name, and whether two-factor is switched on.
• Your cars. Make, model, year, generation, trim, mileage, and any nickname. If you add a car by VIN we keep what the VIN decodes to, not the VIN itself.
• Your reports. What you paid, where, on which car, when, the mileage, and your ratings. These are shown publicly, attributed to your display name.
• A profile photo, if you upload one.
• An audit record of security actions — signing in a second factor, a role change, a document being viewed — so a compromise can be traced.
• One IP address, briefly. The address that asked for a password reset is kept with that reset token so abuse can be spotted. It goes when the token does.

• Receipts. A receipt is checked and then destroyed. It is never kept after a decision. The receipt policy sets out exactly how.
• Card details. Payments go to Stripe. We never see or hold a card number. All we keep is the customer and subscription reference Stripe gives us.
• Your location history. When you search near you, the coordinates are used for that search and not written down against your account.
• Tracking or advertising cookies. The only cookie is the one that keeps you signed in.

We do not sell your data and we do not share it for advertising. It reaches other companies only where they do a job the site needs:

• Stripe — payments and subscriptions.
• OpenStreetMap and Nominatim — map tiles and turning an address into a pin.
• Our hosting and database providers — running the site.
• An email provider — sending password reset links.

Your reports are public by design. That is the point of the site: other owners can see what work cost. Your email address is never shown.

You can delete your account from settings at any time. That removes your profile, your cars, and your saved searches.

Your reports are withdrawn with it. They stop being shown to anyone, so the prices you contributed leave the site along with your account. We keep the rows rather than erasing them outright, so that a report removed by mistake can be restored and so a fraud investigation has something to look at; nobody browsing the site can see them.

You can also ask for a copy of what we hold about you, or ask us to correct it.

Two steps run without a person. A receipt you upload as proof is read by text recognition and compared against the shop name and total you entered, which decides whether your report is marked confirmed. Text you post is screened for abuse before it appears.

The receipt image is destroyed once it has been read; only the outcome is kept. Neither check is perfect, and you can ask a person to review either decision.

The software itself was written with substantial help from AI coding tools. That has no bearing on what we collect, but you should know how the thing holding your data was made.