Privacy Policy

What we collect

To run GarageJot, we collect: your email address (used for passkey registration and magic-link sign-in); vehicle data you enter, including year, make, model, trim, nickname, VIN (if you choose to enter one), license plate (if you choose to enter one), odometer readings, service records and notes; and any photos or file attachments (JPGs, PNGs, or PDFs) you upload to a vehicle or service record.

VIN and license plate are treated as personal information under privacy laws like the CCPA and GDPR when they're linked to your account, and we handle them with that in mind.

How we use it

We use your data to operate the app: authenticating you, storing and displaying your vehicle and service history, serving your uploaded photos and documents, and — only if you ask for it — generating AI-assisted maintenance suggestions based on your own service history.

We do not sell your data to third parties.

Who we share it with

We rely on a small number of service providers to run GarageJot. They process data on our behalf and are not permitted to use it for their own purposes:

• Resend — sends transactional and magic-link sign-in emails.
• Neon — hosts our Postgres database, where your account and vehicle data is stored.
• Cloudflare — hosts the app, stores uploaded photos/attachments (R2), resizes and delivers images, and (when enabled) provides basic site analytics via Google Analytics. Analytics is gated behind an environment variable and may not always be active.
• Cloudflare Workers AI — when you request AI-assisted maintenance suggestions, your vehicle's service history (dates, notes, service provider, odometer readings) is sent to this model to generate a response. We're calling this out explicitly because, while it's not identity data, it is data about your vehicle and its upkeep that we want you to know leaves our own infrastructure for processing.

Your right to deletion

You have the right to request deletion of your data. You can already delete an individual vehicle yourself at any time, which permanently removes that vehicle's records, specs, photos, and attachments.

Whole-account deletion is not yet available as a self-service feature. Until it is, email us using the link below and we'll manually delete your account and all associated data.

How we protect your data

GarageJot is passkey-first, which means for most users there is no password stored anywhere, ever — nothing to leak. Sessions are stored server-side in our database rather than trusted entirely to a client-held token. Every connection to GarageJot is encrypted over HTTPS via Cloudflare.

Children's privacy

GarageJot is not directed at children under 13, and we do not knowingly collect data from anyone under 13.

Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page and, when the change is significant, notify you by email.

Contact us

Questions about this policy, or a deletion request? Questions? Get in touch.