Privacy Policy

Account information: username (your public handle), email address (required — used as your sign-in identity and for password reset, never shown to other users), password, and optionally your first/last name, country, preferred currency, and distance-unit (miles/km) preference.

Vehicle information: year, make, model, trim, VIN (optional, used only to autofill the above via the free NHTSA vPIC decoder), nickname, registration/plate number, current mileage, road tax and insurance due dates, country, and any photo you upload of the vehicle.

Maintenance and service records: service date, category, mileage at service, cost, shop, parts replaced, notes, and any receipt photo or PDF you upload. Planned/future services you schedule ahead of time (date, category, title, notes, estimated cost) are stored the same way.

Receipt photos, if you use "Scan a receipt": this optional feature sends the photo to Google's Gemini API to extract the shop, date, mileage, and service line items automatically, so you can review and edit them before saving. If you don't use this feature, your receipt photos are only ever stored, not analyzed.

We do not run analytics, tracking, or advertising tools of our own. Our hosting providers (Vercel, Supabase) log standard technical data (such as IP address and request logs) as part of securely operating the Service — see Section 4.

We use the information above to:

• Provide the core Service — storing your vehicles and maintenance history, computing service reminders and a vehicle health score, and letting you plan and log services.
• Decode VIN information using the National Highway Traffic Safety Administration's public vPIC database.
• Extract structured data from a receipt photo via Google's Gemini API, only when you choose to use the "Scan a receipt" flow.
• Send you a password-reset email when you request one.
• Maintain and improve the Service, including troubleshooting, security, and backups.

Where applicable, we process your data based on: performance of a contract (providing the Service you signed up for), and our legitimate interests (e.g. security, fraud prevention, service improvement, backups).

We do not sell your personal information, and we don't share it with advertisers — we don't have any. We share information only with the service providers who host and operate the Service on our behalf:

• Supabase — database, authentication, and file storage (vehicle/receipt photos).
• Vercel — application hosting.
• Google (Gemini API) — only the specific receipt photo you submit, and only when you use "Scan a receipt," to extract its contents. Google's own privacy terms govern how they handle that request.
• The National Highway Traffic Safety Administration (NHTSA) — only the VIN you enter, if you use VIN decode; this is a public government API and doesn't require an account or identify you.

We may also disclose information if required by law, or to protect the rights, safety, or property of DipStk or others.

We retain your account and vehicle data for as long as your account is active. To delete your account, email us at support@dipstk.com — we'll remove your account and associated vehicle/maintenance data within 30 days, except where retention is required by law.

The production database is backed up daily (data only, not photos) to a private, access-restricted repository for disaster recovery. These backups are not pruned automatically, so a deleted account's data may continue to exist in historical backup snapshots even after removal from the live app — these snapshots are not accessible to other users and are used solely for restoring the Service if something goes wrong.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Email support@dipstk.com for any of these requests.

If you're in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

Because DipStk is available globally, your information is processed by the service providers listed in Section 4, which may operate in countries other than your own (including the United States). Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.

DipStk is not directed to children and is not intended for use by anyone under the age of 18. We do not knowingly collect information from children.

We may update this Policy from time to time — for example, as new features that touch data (like payments or notifications) are actually built. We'll update the "Last updated" date above, and for material changes, notify you via the app or by email.

Questions about this Policy? Contact us at support@dipstk.com.