Privacy Policy

Last updated: September 29, 2026

AutoTrack ("we," "us," "our") provides a vehicle maintenance tracking service at autotrackbay.com. AutoTrack is operated by [Operator name — to be added], which is the data controller for the personal data described here. This policy explains what we collect, why, how long we keep it, and what control you have over it.

What we collect

• Account details: your first name, last name, and email address, and your password. Your password is never stored in plain text. It is hashed with bcrypt before it is saved, so we can't see it.
• Vehicle data you enter: VIN, year, make, model, trim, color, license plate, purchase date and price, and any nickname you give a vehicle.
• Records you log: maintenance records, mileage and fuel logs, costs, locations and notes you type in, and any receipt photos or PDFs you upload.
• Preferences: units, currency, reminder timing, and your email notification setting.
• Security logs: each login attempt (the email entered, whether it succeeded, the IP address, and the time), used to detect and stop password-guessing attacks.
• Session data: when you log in, we issue a session token that expires after 8 hours. It is kept in your browser's local storage. Our server also records a hashed session entry so sessions can be revoked.
• Timestamps: when your account and records were created or updated.

Vehicle details like a VIN, license plate, and purchase information can be linked to you personally, so we treat them as personal data. We never share them with anyone except as described under "Third parties" below.

Why we use it (legal basis)

• To provide the service you signed up for (performance of a contract): your account, vehicles, records, receipts, and preferences.
• To keep the service and your account secure (our legitimate interest in preventing abuse): login-attempt logs, session tokens, and rate limiting.
• To send you emails you've chosen to receive (your consent), such as maintenance reminders. You can turn these off at any time in Settings.

What we don't do

• We don't sell or rent your data to anyone.
• We don't run ads or ad-tracking scripts.
• We don't use analytics, analytics cookies, or third-party tracking pixels.
• We don't send marketing email unless you explicitly opt in.

Cookies and local storage

AutoTrack itself doesn't set cookies. It uses your browser's local storage to keep you logged in (the session token described above) and to remember basic app state. This storage is strictly necessary for the app to work. Logging out clears it. Cloudflare may set a strictly necessary security cookie to protect the site from bots. It isn't used for tracking or advertising.

Emails we send

AutoTrack does not currently send any email. When email features launch, we will only send emails related to your account: verifying your address, resetting your password, and maintenance reminders if you turn them on. We will not send marketing email unless you opt in.

Third parties

A few features send a narrow slice of data to outside services in order to work:

• NHTSA (vpic.nhtsa.dot.gov): when you decode a VIN, your browser sends that VIN directly to the U.S. government's public vehicle database to look up the year, make, and model. The request comes from your browser, not our server, and carries no account information.
• TomTom: if you use the nearby gas station lookup, your browser first asks your permission to share your device's location. If you allow it, those coordinates are sent through our server to TomTom's API to find nearby stations and prices. We don't store or log your location. If you decline, the rest of the app works normally.
• Cloudflare: our network and security provider. It handles every request to the site and sees standard connection data (like your IP address), as any hosting provider would.

How long we keep it

• Your account data is kept for as long as your account exists.
• Login-attempt logs are automatically deleted after 90 days.
• Sessions expire after 8 hours. They end on every device immediately when you use "Log out of all devices" or change your password. Hashed session records are kept for up to 7 days.
• When you delete your account, your profile, vehicles, maintenance records, mileage logs, uploaded receipts, and login history are deleted from our live systems immediately, from Settings. You don't need to send a request or wait.
• Backups: if a copy of the database is kept in a backup, it is kept for no more than 30 days, then permanently overwritten. Deleted data may remain in a backup until then, but it is never restored into the live service.

Your rights

You can access, correct, export, or delete your data at any time without contacting us:

• Access and correction: edit your profile, vehicles, and records directly in the app.
• Export: download a CSV of everything you've logged from Settings → Export Your Data.
• Deletion: permanently delete your account and all associated data from Settings → Danger Zone.

If you're in the EU/EEA or UK, these tools cover your GDPR/UK GDPR rights of access, rectification, erasure, and portability. You also have the right to object to or restrict processing, and to complain to your local data protection authority. If you're in California, they cover your CCPA/CPRA rights to know, delete, and correct your data. We don't sell or share personal information as those laws define it. For help exercising any right, email [email protected].

Security

Passwords are hashed with bcrypt. All traffic to the site is encrypted with HTTPS. Sessions can be revoked on every device at once from Settings. Sign-in to an account is temporarily paused after repeated failed attempts. Uploaded receipts are stored under random file names and can only be opened by the account that uploaded them.

If something goes wrong

If we discover a security breach that affects your personal data, we will notify affected users without undue delay. We aim to do so within 72 hours of becoming aware of it, and we will explain what happened, what data was involved, and what you can do. Where the law requires it, we will also notify the relevant authorities.

Children

AutoTrack is not directed at children. You must be at least 16 years old to create an account, and we don't knowingly collect data from anyone younger. If you believe a child under 16 has created an account, contact us and we'll delete it.

Changes to this policy

If we make a material change to this policy, we'll update the date at the top of this page and post a notice on this site. Once email features are available, we'll also email account holders before the change takes effect.

Contact

Questions about this policy or your data: [email protected].