Privacy policy

Who is responsible

The controller is James Howling, an individual in the United Kingdom, not a company. Email hello@startinghandle.app.

What the app is for

Starting Handle keeps a record of your cars: service history, faults, fuel, expenses, photos and receipts. You sign in with Google. A car is visible only to you until you invite someone else to it by email.

Account data from Google

Sign-in uses Google's OAuth screen, via Supabase Auth. Google sends the account's name, email address and profile picture. Those are stored with your login at Supabase and copied into a profile row (display name, email, picture URL) so people you share a car with can see who you are.

Sign-in asks Google for the account's name, email address and profile picture. It does not ask for offline access, and it does not keep a Google refresh token. Supabase keeps the session. The app does not read Gmail, Drive, Calendar, or any other Google product. When the interface shows your picture, your browser loads it from Google's servers.

Starting Handle's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to sign you in, show your name and picture, and match a car invite to your email address. It is not sold, not used for advertising, not used to decide creditworthiness, and not passed to anyone except the processors named below, the people you share a car with (name, email and picture), or where the law requires it.

What you enter about a car

Depending on what you fill in, that includes:

• The car itself: nickname, registration, make, model, year, VIN, fuel type, colour, mileage, MOT, tax, service and insurance dates, purchase date and price, and notes.
• Services, the jobs and measurements recorded on them, parts lines, and the intervals you set for the next one.
• Faults you have noticed, including descriptions and status.
• Fuel logs: date, mileage, litres, cost, whether the tank was full, and notes.
• Expenses: description, date, cost, vendor, notes, and a receipt file (image or PDF).
• A to-buy list: title, part number, supplier, link, quantity, price, status and notes.
• Photos of the car, stored as files rather than in the form.

Sharing a car

If you invite someone, the app stores their email address, the role you picked (editor or viewer), and an invite token. They can accept only while signed in with that same Google address. Once they accept, they can see that car's records, photos and receipts, and you can each see the other's name, email and picture. Ownership of a car can be handed to someone who is already a member.

MOT lookups

If you use the MOT lookup, the car's registration number is sent to the DVSA MOT History API. The reply can include make, model, fuel type, colour and MOT test dates. This version stores the MOT expiry date, a short status sentence, and the time of the check. It does not keep a copy of every test. Tax dates are typed in by hand; they are not fetched from DVLA.

API tokens

Settings can mint a personal token so a script can list your cars and add expenses, including a receipt file. You see the token once. The database stores a hash, a short hint, the name you gave it, and the permissions you ticked. It does not store the token itself.

Where it is stored

On this hosted instance, accounts, database rows and uploaded files (photos, banners, receipts) are stored in Supabase, in the EU region. The bucket for files is private. The website itself is hosted on Vercel, which will process connection data such as IP address and user agent in its request logs.

Other processors, only for the purpose of running the service:

• Google, for sign-in.
• Supabase, for the account, the database and file storage.
• Vercel, for hosting.
• DVSA, only for a registration you ask to look up.

James Howling can access the database and file storage because he operates the instance. The app has no advertising and no analytics package of its own.

Cookies and the installed app

Supabase Auth sets cookies so you stay signed in. They are required for the app to work; there are no advertising or analytics cookies in the code. If you add the site to your home screen, a service worker caches the app shell and an offline notice. It does not cache your garage.

How long it is kept

Records stay until you delete them. Invite links expire after 14 days if they are not accepted. API tokens last until you delete them. A data export includes links to your files that expire after 7 days.

Deleting a car removes that car, its history, and the photos and receipts stored for it.

Settings can delete the whole account, after you type DELETE. That removes the login, the profile and the API tokens. A car that only you belong to is deleted, including its files. If other people belong to a car you own, the person who has been a member longest becomes the owner and you are removed. That car and its files stay, because they are the group's record. Your membership of a car someone else owns is removed. Notes you wrote on a car that is kept can remain, with your name detached. If you cannot sign in, email hello@startinghandle.app.

Export

Settings has "Download your data". It is a zip of the cars, services, jobs, faults, fuel logs, expenses, to-buy list and sharing rows you are allowed to see, plus links to the photos and receipts. That includes cars other people have shared with you, because those are records you can already open.

Why this processing is allowed

The record-keeping is done to provide the service you signed up for. Running and securing the instance is a legitimate interest. Sending a registration to DVSA happens because you asked for the lookup. You choose Google as the way to sign in.

Your rights

Under UK GDPR you can ask for access, correction, erasure, restriction, and a copy of your data, and you can object to processing based on legitimate interests. The export is the copy. Email hello@startinghandle.app to use any of these. You can also complain to the Information Commissioner's Office at ico.org.uk.

Children

Starting Handle is not aimed at children under 13, and accounts are not opened for them.

Changes

If this notice changes in a way that matters, the date at the top will change with it. The current text is always this page.