Privacy Policy
Last updated:
Dear Car is operated by Qusai Eilouti (“we”, “us”), who decides how your information is used and is responsible for it (the data controller). This policy covers the Dear Car app and this website, dearcar.app. It says what we collect, why, who else handles it, where it is kept, for how long, and what you can do about it. Dear Car can be used in any country. Questions, requests and complaints go to support@dearcar.app.
In short
- We collect what Dear Car needs to keep your cars’ records, remind you and share a garage.
- Only the people in your garage see what is in it. Nothing in a garage is public.
- We do not track your location, show ads, sell your data or use it for advertising.
- The app’s data and your files are stored in the European Union.
- You can export your records, and delete your account in the app at any time; deletion is complete within 30 days.
What we collect
- Your account. Your name, email address and how you sign in. With Sign in with Apple or Google, the provider shares the details you allow, which can be a private relay address from Apple or a profile photo address from Google. After a Sign in with Apple we keep a token from Apple so we can revoke the app’s access when you delete your account. With an email and password, we store the password only in a scrambled (hashed) form that nobody can read, and we email you a six-digit code to confirm your address and a link when you ask to reset your password.
- Sign-in sessions. For each phone you sign in on: the session, its device type and app version, the times it was made and last used, and the IP address it was made from. You see your sessions under Your devices and can sign them out. IP addresses are used only for security, for example to slow down repeated sign-in attempts; we never use them to work out where you are.
- Your cars. What you enter about each car: make, model, year, powertrain, odometer and its unit, and optional details such as a nickname, photo, plate number, VIN, colour, fuel grade, tank or battery size, engine and tyre size, and the purchase date, price and odometer.
- Your cars’ records. Fuel and charging entries with their amounts, odometer readings, service records with their dates, costs, shops and notes, paperwork and expiry dates, reminders and who takes each service, and who in the garage logged or paid for each entry. Members’ driving licence expiry dates, if your garage adds them.
- Photos and documents. Car photos, receipts, invoices, insurance policies, registration cards and other files you attach. The app shrinks photos before uploading them, which also removes the location and camera details stored in them. Files can contain personal details such as names, addresses and ID numbers, so attach only what you need.
- Your garages. The garages you belong to, their members and roles, invite links, an activity feed of changes, and, if the owner turns on cost sharing, each member’s share of a car’s costs, the balances between members and the repayments they record. Each garage has a country, which sets its currency, units, fuel grades, paperwork names and service schedule. It starts from your phone’s region setting, not your location, and you can change it.
- Purchases. If you buy the Garage plan, monthly or yearly: the product, price, currency, store country, transaction and subscription status, from Apple, Google Play and RevenueCat, linked to your account number. We never receive your card details.
- Notifications. When you allow notifications, a push token for that phone and the app language, so reminders reach it in your language.
- Diagnostics and usage. In release versions of the app: crash reports with the error, device model, system and app version and your account number, and a small set of fixed product events (for example that the app was opened or an account was made) with the app language. They never contain what you record about your cars.
- Help and feedback. When you report a problem or ask for a feature in the app: your message with the app version, your phone’s model and system version, the app’s language and theme, the garage you were using and the screen you sent it from, as the app shows you before you send it.
- Emails to us. What you write to support@dearcar.app, with your email address, so we can reply.
What we do not collect
Dear Car does not track or read your location, connect to or read data from your car, read your contacts or calendar, record audio, or collect your phone’s advertising identifier. It uses the camera and your photos only for the files you choose to attach.
How we use it, and why we may
| What we do | With | Legal basis, where the law asks for one |
|---|---|---|
| Run the app: keep each car’s record, estimate the odometer, work out what is due, share a garage, store your documents, keep cost-sharing balances | Account, cars, records, files, garages | Providing the service you asked for (contract) |
| Send the reminders and garage notifications you set up | Push token, language, the records they are about | Contract; your permission for notifications, which you can withdraw in your phone’s settings |
| Sign you in, confirm your address, reset a password, keep accounts secure | Account, sessions, IP addresses, sign-in emails | Contract; our legitimate interest in keeping accounts safe |
| Sell and verify the Garage plan | Purchases | Contract |
| Find and fix crashes; see which features are used | Diagnostics and usage events | Our legitimate interest in an app that works; they carry no records and no IP address |
| Answer you | Help and feedback, emails to us | Contract; our legitimate interest in helping you |
| Keep records the law requires, answer lawful requests | What the request or the law covers | Legal obligation |
To work out litres from the amount you paid, we use the price that car last paid for the grade, from its own record. We do not make automated decisions about you that have legal or similarly significant effects.
Who can see it
Everyone in a garage sees that garage’s cars, records, paperwork, documents, activity and cost-sharing balances, including who logged each entry and who paid. Invite only people you want to see this. Documents are stored privately and open through links that expire within an hour.
Service providers process information for us, only to provide their service and under contracts that protect it:
| Provider | What for | Where |
|---|---|---|
| Convex | The app’s database and server, and sign-in (Better Auth runs on it) | European Union (Ireland) |
| Cloudflare | Storing photos and documents (R2); hosting this website | Files: European Union. Website: Cloudflare’s worldwide network |
| Resend | Sending sign-in codes and password reset emails | European Union |
| Apple and Google | Sign in with Apple and Google; App Store and Google Play purchases; delivering notifications (APNs, FCM) | Worldwide, including the United States |
| Expo | Passing notifications on to Apple and Google | United States |
| RevenueCat | Checking Garage plan purchases with the stores | United States |
| Sentry | Crash reports, without storing IP addresses | European Union |
| PostHog | Product usage events, with IP addresses discarded and no location lookup | European Union |
We share information beyond this only when the law requires it, to protect people from harm, or with your permission. If Dear Car is ever transferred to someone else, your information would go with it under this policy, and we would tell you first. We do not sell or rent personal information, and we do not share it for advertising.
Where it is stored, and transfers
The app’s database is in Ireland and your files are in Cloudflare’s European Union storage. Dear Car has one service for every country, so if you live outside the European Union your information leaves your country to be stored there. Some providers above, such as Expo, RevenueCat, Apple and Google, handle the parts they need in other countries, including the United States. Where data protection law requires it, these transfers rely on safeguards such as the European Commission’s standard contractual clauses or an adequacy decision, built into our providers’ terms. Everything travels encrypted.
How long we keep it
| Information | Kept |
|---|---|
| Account, garages, cars, records, files | While you have an account; see below for what stays in a garage others still use |
| Something you delete in the app (an entry, a record, a file) | Ten minutes, so Undo can bring it back, then deleted for good |
| Sign-in sessions, with their IP address | Until you sign that phone out, the session expires (a week after the app last used it), or you delete your account |
| Sign-in codes and reset links | A code works for 5 minutes and a link for 30 minutes. Our copy of the email is deleted two to three hours after sending; Resend keeps its own delivery record for up to 30 days |
| Push tokens | Until you turn notifications off, sign out on that phone, or delete your account |
| Garage plan status | While you have an account. Apple and Google keep their own records of your purchases |
| Help and feedback messages | Until you delete your account |
| Emails to support@dearcar.app | As long as we need them to help you, and no longer than two years after the conversation ends |
| Crash reports (Sentry) | Up to 90 days |
| Usage events (PostHog) | Up to one year, or until you delete your account |
| Backups of the database | Up to 30 days, then replaced |
When you delete your account
You can delete your account in the app at any time, or by email (Delete your account). When you confirm, your account is deleted at once and every phone is signed out. Within minutes, the rest is removed automatically: your sign-in methods, sessions and devices, your Help and feedback messages, and your place in every garage. A garage you own passes to its longest-standing member; if nobody else is in it, it is deleted with its cars, records, reminders, photos and documents. We revoke Sign in with Apple’s access, and ask RevenueCat and PostHog to delete what they hold about you.
Entries you logged in a garage that others still use stay in that car’s history, because the others rely on it, and open cost-sharing balances stay so their totals add up, without your name. Copies in database backups are gone within 30 days. Crash reports carry only an account number, not your name or email, and are deleted within 90 days.
Your rights
In the app you can see and correct your information, export your cars’ records to CSV, leave a garage and delete your account. You can also email us to ask for a copy of your information, to correct or delete it, to take it with you, to limit how we use it, or to object to a use based on our legitimate interests. Where we rely on your permission, you can withdraw it at any time. Depending on where you live, laws such as the GDPR in the European Economic Area and the United Kingdom, Brazil’s LGPD, Jordan’s Personal Data Protection Law and similar laws give you these rights and may give you more. We answer within one month, and may ask you to write from the address on your account so we know the request is yours. You can also complain to the data protection authority where you live.
Security
Data is encrypted in transit and at rest. Every request for a garage’s data checks that you are a member of that garage. Files are kept in a private bucket and opened only through links that expire. Passwords are stored only as hashes. No system is perfectly secure; if a breach affects your information, we will tell you and the authorities as the law requires.
Children
Dear Car is for people aged 13 and over, or older where the law requires a parent’s consent for online services until a later age, and we do not knowingly collect information from younger children. If you believe a child under that age has an account, email us and we will delete it.
Anonymous statistics
In a later version, Dear Car may combine records from many cars of the same make, model, year and powertrain into anonymous statistics, such as common service intervals and typical prices, to suggest better templates. A group is used only once it includes at least 20 cars, and the statistics never identify you, your garage or your car. You will be able to turn this off in the app’s settings, and this policy will say so before it starts.
This website
dearcar.app sets no cookies and runs no analytics or ads. Cloudflare, which hosts it, processes basic request data such as IP addresses to deliver and protect the site. An invite link opened here is not looked up or stored.
Changes
We will update this policy when Dear Car changes, and tell you in the app or by email before a significant change takes effect. The date at the top shows when it last changed.