Privacy Policy

Last updated: November 2, 2026

AutoTrack ("we," "us," "our") provides a vehicle maintenance tracking service at autotrackbay.com. AutoTrack is operated by [Operator name — to be added], which is the data controller for the personal data described here. This policy explains what we collect, why, how long we keep it, and what control you have over it.

Preview: AutoTrack is currently a view-only preview, not for real use. Data you enter may be reset or deleted without notice during the preview, in addition to the deletion rules below. Please don't enter information you aren't comfortable losing, and export anything you want to keep. See the preview notice in the Terms.

What we collect

• Account details: your first name, last name, and email address, and your password. Your password is never stored in plain text. It is hashed with bcrypt before it is saved, so we can't see it.
• Vehicle data you enter: VIN, year, make, model, trim, color, license plate, purchase date and price, and any nickname you give a vehicle.
• Records you log: maintenance records, mileage and fuel logs, costs, locations and notes you type in, and any receipt photos or PDFs you upload.
• Dates, documents and specs you add: renewal dates (registration, inspection, insurance), photos or PDFs of papers such as a title or insurance card, and optional details such as tire size, oil type, and insurance company, policy number and phone numbers. These are optional, visible only to you, and deleted when you delete the item, the vehicle or your account.
• Shops and budget: repair shops you save (name, phone, address, specialty and notes) and the monthly budget you set.
• Data you import: rows from a CSV file you import are stored exactly like records you type in. The file itself isn't kept.
• Share links you create: which vehicle, what you chose to show, when the link expires, how many times it was opened and when it was last opened. We don't record who opened it.
• Preferences: units, currency, reminder timing, and your email notification setting.
• Security logs: each login attempt (the email entered, whether it succeeded, the IP address, and the time), used to detect and stop password-guessing attacks. They are kept for 24 hours.
• Web server logs: our proxy logs each request to the site (the page address, time, response code and browser type) for troubleshooting and abuse prevention. These logs don't contain your IP address and are deleted after 24 hours.
• Session data: when you log in, we issue a session token that expires after 8 hours. It is kept in your browser's local storage. Our server also records a hashed session entry so sessions can be revoked.
• Timestamps: when your account and records were created or updated.

Vehicle details like a VIN, license plate, and purchase information can be linked to you personally, so we treat them as personal data. We never share them with anyone except as described under "Third parties" below.

Why we use it (legal basis)

• To provide the service you signed up for (performance of a contract): your account, vehicles, records, receipts, and preferences.
• To keep the service and your account secure (our legitimate interest in preventing abuse): login-attempt logs, web server logs, session tokens, and rate limiting.
• To share your vehicle history when you ask us to (performance of a contract): share links you create.
• To send you emails you've chosen to receive (your consent), such as maintenance reminders. You can turn these off at any time in Settings.

What we don't do

• We don't sell or rent your data to anyone.
• We don't run ads or ad-tracking scripts.
• We don't use analytics, analytics cookies, or third-party tracking pixels.
• We don't load fonts, scripts or images from other companies' servers. Everything on our pages comes from autotrackbay.com.
• We don't send marketing email unless you explicitly opt in.

Cookies and local storage

AutoTrack itself doesn't set cookies. It uses your browser's local storage to keep you logged in (the session token described above) and to remember basic app state. This storage is strictly necessary for the app to work. Logging out clears it. Cloudflare may set a strictly necessary security cookie to protect the site from bots. It isn't used for tracking or advertising.

Emails we send

AutoTrack does not currently send any email. When email features launch, we will only send emails related to your account: verifying your address, resetting your password, and maintenance reminders. Reminder emails are off until you turn them on in Settings. We will not send marketing email unless you opt in.

Third parties

A few features send a narrow slice of data to outside services in order to work:

• NHTSA (vpic.nhtsa.dot.gov): when you decode a VIN, your browser sends that VIN directly to the U.S. government's public vehicle database to look up the year, make, and model. The request comes from your browser, not our server, and carries no account information.
• NHTSA recalls (api.nhtsa.gov): to show safety recall notices, our server looks up recalls for each vehicle's make, model and year, and keeps the answer for 24 hours. Your VIN, plate, name and email are never sent. The notices you mark as fixed or not applicable are stored with your account.
• TomTom: if you use the nearby gas station lookup, your browser first asks your permission to share your device's location. If you allow it, those coordinates are sent through our server to TomTom's API to find nearby stations and prices. We don't store or log your location. If you decline, the rest of the app works normally.
• Cloudflare: our network and security provider. It handles every request to the site and sees standard connection data (like your IP address), as any hosting provider would. Cloudflare also forwards email sent to support@autotrackbay.com to our inbox. Cloudflare processes this data for us under its data processing terms.
• People you share a link with: when you create a share link, anyone who has it can see that vehicle's history until the link expires or you revoke it. Your name and email are never shown. The full VIN, costs, locations and notes appear only if you tick them. You can revoke a link at any time from Vehicles → Share history.

Where your data is stored

AutoTrack runs on servers we operate in the United States. If you use AutoTrack from outside the U.S., your data is transferred to and stored in the U.S.

How long we keep it

• Your account data is kept for as long as your account exists, or until the preview data is reset, whichever comes first.
• Login-attempt logs (email and IP address) are automatically deleted after 24 hours. After that we keep only a daily count of successful and failed sign-ins, which can't be linked to anyone.
• Web server logs are deleted after 24 hours.
• Share links are kept until they expire, you revoke them, or you delete the vehicle or your account.
• Sessions expire after 8 hours. They end on every device immediately when you use "Log out of all devices" or change your password. Hashed session records are kept for up to 7 days.
• When you delete your account, everything linked to it is deleted from our live systems immediately, from Settings: your profile, vehicles, maintenance records, mileage logs, dates, documents, specs and insurance details, shops, budget, share links, uploaded receipts and files, and login history. You don't need to send a request or wait.
• Backups: we make a nightly backup of the database and uploaded files so your data can be recovered after a failure. Each backup is kept for 14 days (never more than 30), then permanently deleted. Deleted data may remain in a backup until then, but it is never restored into the live service.

Your rights

You can access, correct, export, or delete your data at any time without contacting us:

• Access and correction: edit your profile, vehicles, and records directly in the app.
• Export: download a CSV of everything stored in your account from Settings → Export Your Data: profile and settings, vehicles, records, logs, dates, documents list, specs and insurance, shops, budget, share links and recall notes. Receipts and document files open from each record.
• Deletion: permanently delete your account and all associated data from Settings → Danger Zone.

If you're in the EU/EEA or UK, these tools cover your GDPR/UK GDPR rights of access, rectification, erasure, and portability. You also have the right to object to or restrict processing, and to complain to your local data protection authority. If you're in California, they cover your CCPA/CPRA rights to know, delete, and correct your data. We don't sell or share personal information as those laws define it. For help exercising any right, email support@autotrackbay.com.

Security

Passwords are hashed with bcrypt. All traffic to the site is encrypted with HTTPS. Sessions can be revoked on every device at once from Settings. Sign-in to an account is temporarily paused after repeated failed attempts. Uploaded receipts are stored under random file names and can only be opened by the account that uploaded them.

If something goes wrong

If we discover a security breach that affects your personal data, we will notify affected users without undue delay. We aim to do so within 72 hours of becoming aware of it, and we will explain what happened, what data was involved, and what you can do. Where the law requires it, we will also notify the relevant authorities.

Children

AutoTrack is not directed at children. You must be at least 16 years old to create an account, and we don't knowingly collect data from anyone younger. If you believe a child under 16 has created an account, contact us and we'll delete it.

Changes to this policy

If we make a material change to this policy, we'll update the date at the top of this page and post a notice on this site. Once email features are available, we'll also email account holders before the change takes effect.

Contact

Questions about this policy or your data: support@autotrackbay.com.