Privacy Policy
Table of Contents
Last updated: October 2026
General Information
Car Service Book is developed and operated by Gabriel Falis. We value your privacy and make decisions in our development to respect it to the best of our ability. This policy applies to our iOS app and web application at carservicebook.app.
What Data We Collect
We collect only what is necessary to provide the service:
- Account data: your email address and, if you sign in with Apple or Google, the name they share with us.
- Vehicle data you enter: make, model, VIN, number plate, mileage, services, fuel logs, expenses, tires, reminders and documents.
- Photos and files you upload (for example car photos, receipts, documents and scans), and the emails you forward to your personal inbox address, including the sender, subject and attachments.
- Recordings of your engine's sound when you use sound diagnosis. They are sent for analysis and are not stored on our servers.
- Messages and photos you send to the AI assistant.
- Trip data, if you turn on trip logging (see “Location and Trip Logging”).
- Your device's push notification token, so that we can send you reminders and alerts.
- Purchase data: your subscription status and purchase history, which RevenueCat keeps under an app user ID that is the same as your account ID.
- Diagnostic data: crash reports and error and performance data from the app, the website and our server.
- Usage analytics: in the mobile app through Google Firebase Analytics, and on the website through Google Analytics only if you consent to cookies (see “Third-Party Services” and “Cookies”).
Storage and Sync
Your data is stored on your device and synced to our backend servers, which are hosted by Railway in its EU West region (the Netherlands). Photos and uploaded files are stored on Amazon Web Services (AWS S3) in the EU. All data is encrypted in transit via HTTPS. Some of the providers listed below are based outside the EU, mainly in the United States (Google, Sentry, RevenueCat, Stripe, Resend, Expo). Transfers to them rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on the Standard Contractual Clauses included in their data processing agreements.
Location and Trip Logging
Automatic trip logging is switched off by default and only starts once you turn it on in the app. Only while it is on does the app use your location, including in the background, to detect and record your drives. While it is on:
- We record the start and end point of each drive, its distance, the time it began and ended, and the route you drove (the GPS track). The route is uploaded to our servers and shown to you on a map.
- Those trips are stored on your phone and synced to our servers in the EU so your mileage log survives a new phone or a reinstall.
- Trip data is used only to build your mileage log, show your drives on a map and create the log's tax export. It is never sold, and never used for advertising or profiling.
- You can turn trip logging off at any time, which stops location collection immediately. You can delete individual trips together with their routes, or delete your account to remove all of them.
- Separately from trip logging: when you open Nearby Services, the app sends your device's current location directly to Google Maps/Places to find services near you. We do not store this location.
Third-Party Services
We use the following service providers to operate the app and the website. Each receives only the data needed for the stated purpose:
- Google Analytics — website traffic analysis, only with your cookie consent
- Google Firebase Analytics — usage statistics in the mobile app (for example which screens and features are used and where a subscription offer was opened). The data is tied to a random identifier of the app installation, not to your account, and is not used for advertising; the app does not use the advertising identifier (IDFA). Because it runs inside the app and does not use cookies, the website's cookie banner does not apply to it, and the app currently offers no setting to turn it off.
- Sentry — crash reports and error and performance diagnostics for the app, the website and the server. Reports are not linked to your account, email addresses are removed from them, and request contents, passwords and login tokens are not sent.
- Railway — hosting of our backend server and database (EU West region, the Netherlands)
- Amazon Web Services (AWS S3) — storage of photos, uploaded files and attachments of forwarded emails
- RevenueCat — subscription management for in-app purchases: subscription status, purchase history, an app user ID that is the same as your account ID, and where a subscription offer was last opened. The payments themselves are processed by Apple (App Store).
- Stripe — payments for business (Fleet) plans purchased on the website. You enter your card details directly with Stripe; we do not receive them.
- Apple Sign-In / Google Sign-In — authentication (receives your email and name)
- Resend — sending emails (verification codes, password resets and notifications) and receiving the emails you forward to your personal inbox address, including the sender, subject and attachments
- Google Gemini API — AI features. Depending on the feature you use, we send the photos or scans you submit (receipts, odometer, registration certificate, service book, tire DOT code, repair quotes, warning lights and photo diagnosis), engine sound recordings, your messages and photos to the AI assistant, attachments of forwarded emails, and the vehicle details needed for the answer. Google processes this data to provide the requested result.
- Google Maps / Places — finding services near you: your device's current location when you open Nearby Services
- Expo (push notification service) — delivering push notifications: your device's push token and the content of the notification
- NHTSA (U.S. National Highway Traffic Safety Administration) — VIN decoding and recall checks: the VIN and the vehicle's make, model and model year, without your name or email address
Data Retention
Your data is retained as long as your account is active. You can delete your account yourself at any time: in the app under Settings → Delete account, or on the website under Settings → Delete account. Deletion immediately removes your account and all associated data from our database, including vehicle records, trips with their routes, and documents; it deletes your uploaded photos and the files in your email inbox from our storage, and it deletes the customer record for your subscription at RevenueCat. Any remaining personal data is permanently removed within 30 days.
What deletion does not cover: Apple keeps records of your App Store purchases, and Stripe keeps records of website payments, under their own terms and legal obligations. Deleting your account does not cancel an App Store subscription; cancel it in your Apple ID settings. Diagnostic and analytics data at Sentry and Google Firebase is not linked to your account and is deleted according to those services' retention periods.
Your Rights (GDPR)
Under GDPR, you have the right to:
- Access your personal data
- Correct inaccurate data
- Delete your account and all associated data (directly in the app or on the website)
- Export your data (available via PDF reports)
- Object to data processing
- Withdraw consent at any time (e.g. cookie preferences)
To exercise any of these rights, contact us at gabrielfalis.codes@gmail.com.
Children's Privacy
Our service is not intended for children under 16. We do not knowingly collect personal information from children. Users must confirm they are at least 16 years old during registration.
Contact
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at gabrielfalis.codes@gmail.com.