CarBindr Privacy Policy

Last updated: October 17, 2026 Effective: October 17, 2026

CarBindr is run by James Millington, an individual doing business as CarBindr ("we", "us"). If you have a question about anything here, email carbindrhq@gmail.com — a person reads it.

The short version

• We collect what you type in and what you upload.
• You can sign in or sign up with Google or Facebook instead of a password. If you do, they tell us your name, email address and an identifier for your account there, and nothing else. They also learn that you use CarBindr. See Your account.
• When you choose to share a vehicle with an approved repair shop, that shop receives your full name, email and account phone number, if one is on file, along with the shared vehicle information. You can revoke access.
• Today we run no analytics and no third-party trackers, and we have never sold anyone's information. We reserve the right to do all three — see What we reserve the right to do. We will tell you before we do, and give you a way to opt out of any sale. SMS opt-in data and consent are excluded from those permissions and are never sold, rented or transferred.
• If you use the AI features, the photos you scan are sent to Anthropic to read them. See AI features.
• You can export everything as a PDF, and you can delete your account and everything in it, at any time, from inside the app.
• CarBindr is in beta. How it handles data is expected to change before general release. See Beta.

1. What we collect

Everything below is either something you typed, something you uploaded, or something the service has to record to work at all.

Your account

Your name, email address, username, and a bcrypt hash of your password. We never store your password itself and cannot recover it. You may optionally add an account phone number. When you share a vehicle with an approved repair shop, we include that number, if present, so the shop can contact you about your vehicle. Numbers entered for SMS reminders are used to deliver reminders you enable.

If you sign up or sign in with Google or Facebook, that provider sends us, after you approve it, your name, your email address and a unique identifier for your account with them. We keep the identifier, the email address they gave us and the time you last signed in that way, so we can recognise you next time. We never receive your Google or Facebook password, and we do not ask for your contacts, friends, posts, photos or anything else from your account, and we post nothing on your behalf. The provider learns that you used CarBindr and when, and handles that under its own privacy policy. An account created this way has no password until you set one with "Forgot password"; you may also connect or disconnect Google or Facebook later from Sign-in methods in the account menu. We use your email address to find duplicate accounts and never to join a new sign-in to an account that already exists with that address.

Your vehicles

Whatever you choose to record: year, make, model, trim, engine, transmission, colour, nickname, VIN, licence plate, odometer readings, purchase date, and free-text notes.

A VIN and a licence plate can identify a specific vehicle and, indirectly, its owner. We treat them as personal information even where the law is unsettled on the point.

Your service history

Service dates, mileage, costs, and the name, address, phone number, email and website of the shop that did the work — as you entered them. Parts records include brand, part number, price, where you bought it, and a purchase link if you added one.

Documents and photos you upload

Files you file under Purchase, Registration, Insurance, Tax, Miscellaneous or a folder you created, plus receipts and paperwork attached to a service visit, and a photo of the vehicle itself. These frequently contain sensitive material — bills of sale, titles, insurance policies, and tax documents carry names, addresses, signatures, policy numbers and financial detail. We store them as you gave them to us, and we do not read, index or analyse them unless you explicitly ask us to (see AI features).

How you got here

If you joined with an invite key, we record the key, which event it was handed out at, when the sign-up page was opened with it, and that it was used to create your account. We keep this to answer one question: which events are worth doing again.

It is linked to your account, and we would rather say so than claim otherwise. A key is spent at the moment an account is created, so even if we stored no link the two timestamps would sit seconds apart and anyone with both tables could match them. Calling that anonymous would not be true. If you delete your account the link is severed and only the count remains.

Nothing here describes you. We do not record your age, your gender, where you live, or anything else about who you are — not at an event, not afterwards, and not from anything you scan.

Technical records

We use Cloudflare Turnstile on account signup and when additional sign-in verification is required to prevent automated abuse. Temporary failed sign-in counters help determine when that additional verification is required. Cloudflare processes technical signals including your IP address, browser information and the site's origin to detect bots and improve its bot detection. See Cloudflare's Turnstile Privacy Addendum.

Server logs recording the time, path and status of requests, kept briefly for debugging and abuse prevention. If error reporting is enabled, unhandled errors are reported with your account's internal ID attached — never your name, email, IP address, or the contents of your request.

2. What we do not do today

This describes CarBindr as it currently runs. It is not a promise about the future — see the next section for what we reserve the right to do.

• No analytics or product telemetry. We do not currently know which buttons you press.
• No advertising or marketing trackers, and no ad networks.
• No location tracking. In-app photos are re-encoded in your browser before upload, stripping EXIF metadata including GPS coordinates. Photos sent by MMS may retain metadata in the privately stored originals; we do not use it to track your location. The resized copy used for AI extraction strips metadata.
• Nothing has been sold. We have never sold, rented or traded anyone's information, and we are not doing so now.
• No profile data from anywhere else, with one exception you choose: if you sign in with Google or Facebook we receive only your name, email address and that provider's identifier for you (see Your account). We do not read your contacts, friends, posts or photos, and we do not post for you.
• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Numbers and consent collected solely for SMS reminders are used to deliver those reminders through Twilio, our messaging provider. Separately, your account contact phone number is included when you deliberately share with a repair shop, as described in section 7. Your SMS subscription and opt-in information are not shared with shops, and sharing a vehicle does not authorize promotional texts. This one is not merely current practice: unlike the rest of this section it is not subject to section 3. SMS opt-in data and consent cannot be sold, rented, transferred or shared with other businesses, including repair shops, advertisers, affiliates or data buyers.

3. What we reserve the right to do

We want to be straight with you rather than promise something and quietly change it later.

We reserve the right to collect usage analytics, to use tracking technologies, and to sell or share personal information with third parties. We are not using these rights for analytics, advertising or commercial data sales today. Sharing you request with a repair shop (section 7) and the service providers in section 5 are separate from the future commercial practices below. If we start those practices, this policy will say so before it happens.

SMS opt-in data and consent are excluded from all permissions to sell, rent, transfer or share information in this policy. These exclusions also apply to future analytics, advertising, commercial sharing and changes during beta. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes.

What that could include:

• Usage analytics — which features are used, how often, and where people get stuck, to decide what to build.
• Tracking technologies — cookies, pixels or similar, including third-party ones, for analytics or advertising.
• Selling or sharing information — including to data brokers, advertisers, automotive-industry buyers, or analytics partners. This may cover vehicle and service data, and may be identifiable, pseudonymous or aggregated.

What we commit to before any of that

1. Notice first. We will update this policy and email you at least 30 days before any sale or commercial sharing described in this section begins.
2. An opt-out. If we ever sell or share personal information, we will publish a "Do Not Sell or Share My Personal Information" control, honour requests through it, and respect Global Privacy Control signals from your browser — regardless of whether California law requires it of us at the time.
3. Your documents are treated differently. Files you upload — titles, bills of sale, insurance policies, tax documents — contain signatures, policy numbers and financial detail. We will not sell the contents of uploaded documents or make them available to commercial data buyers, in any form. This does not prevent sharing you request through the service, including with a repair shop you authorize or an AI scan you initiate.
4. You can leave. If you don't like a change, export your data and delete your account. Deleting removes your information from the live service, and we will not sell information belonging to a deleted account.

A note on retroactivity. If we adopt a looser practice later, it applies going forward. Information collected while a stricter version of this policy was in force stays governed by the promise in force when we collected it, unless you agree otherwise.

4. Why we have it

We do not currently use your records to train any model, build a profile of you, or target advertising at you. See what we reserve the right to do.

5. Who else can see it

We currently use a small number of service providers. Each sees only what it needs to do its job, and none of them may use your data for their own purposes.

This table lists our service providers receiving information today. Repair shops you authorize are described separately in section 7. The table does not limit who might in future — see what we reserve the right to do — but we will update it before anyone is added.

We may also disclose information if we are legally required to — a subpoena, a court order, or a law we cannot lawfully refuse. If that happens we will tell you unless we are forbidden from doing so.

We do not currently sell personal information, and we do not currently share it for cross-context behavioural advertising, as those terms are defined under California law. We reserve the right to do both — see section 3 for the notice and opt-out you would get first.

SMS opt-in data and consent

All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.

We do not sell, rent or transfer messaging consent, or use consent obtained by another business. Consent is between you and CarBindr. Using Twilio to deliver the texts you request does not give Twilio or anyone else permission to reuse or transfer that consent. An account contact number you deliberately share with a repair shop is separate from your SMS enrollment and consent records.

6. AI features

AI scans send the images you select to an external provider for processing. SMS/MMS photos also pass through Twilio, as described in section 5.

CarBindr can read a window sticker, service receipt, or pump and odometer photograph. When you request a scan in the app, or text pump and odometer photos with verified garage reminders enabled, the selected images are sent to Anthropic's API to be read. Nothing else goes with them: not your name, not your email, not your other records.

Those images often contain personal information, because that is what is printed on them: a VIN on a window sticker, and a name, address and prices on a receipt.

Three things constrain this:

1. It only happens when you ask. Pressing a scan button or texting fuel photos requests extraction. Scheduled reminders do not scan stored photos.
2. Under Anthropic's commercial terms, API inputs are not used to train their models. We rely on that; you should verify it for yourself at https://www.anthropic.com/legal/commercial-terms.
3. In-app scans are drafts you review. SMS/MMS fuel logging is different: reliable pump and odometer readings can automatically save a fuel log and both photos, update the selected vehicle's odometer, and restart the garage reminder timer. We send a confirmation and maintenance-health snapshot by text. A multi-car garage requires a vehicle choice. Missing numeric readings are not inferred; unclear units default to USD, US gallons and miles.

In-app images are re-encoded and downscaled in your browser before upload. MMS images pass bounded download, format and image-size checks on the server; a resized copy is sent for extraction. Originals are stored privately with the fuel log. Twilio also processes incoming messages and media. Pending vehicle choices expire after 30 minutes and their temporary input is cleared by the worker; processed/cancelled job URLs and completed reply text are cleared. Small message receipt and job metadata remain for duplicate prevention until account deletion. Twilio may retain its own message and media copies under its provider retention settings; clearing temporary CarBindr URLs does not erase those provider copies.

If you would rather no image ever left our systems, simply don't use the scan buttons or text fuel photos — every field can be typed in by hand, and the app is fully usable that way. STOP or pausing reminders prevents new SMS processing; an external request already dispatched may finish, but current authorization is checked again before a save or queued result text.

7. Sharing with a repair shop

You can share selected vehicles with an approved repair shop by entering the shop's access code, or by creating a vehicle invite code and giving it to the shop. Before sharing, the app explains the contact information included.

The shop receives your full name, email and current account phone number, if one is on file, plus the shared vehicles' details, service history and documents. This lets it identify you and communicate about the vehicle and service. Sharing includes the account number regardless of whether you have enabled SMS reminders; it does not share your SMS subscription or messaging opt-in information, or give the shop permission for promotional messages. The shop can log its work and update the current odometer; it cannot change the owner's existing records or documents or other vehicle details.

• Codes expire — 72 hours by default, and never longer than 7 days.
• Access covers only vehicles you share and the contact details above, not your sign-in credentials or vehicles you have not shared.
• The shop sees the current contact details while its approved access remains active, including an account phone number added or changed later.
• You can revoke it at any time, and revocation takes effect immediately. This stops future access through CarBindr; it cannot retract information a shop has already copied into its own records.

This sharing happens when you deliberately grant access through either code flow. Entering a phone number alone does not give any shop access.

8. Cookies

One cookie today: spanner_token. It holds your sign-in session, is httpOnly (unreadable by scripts), sameSite: strict (not sent from other sites), and transmitted only over HTTPS in production.

It is strictly necessary to sign in, so there is currently no consent banner — there is nothing optional to consent to. If we later add analytics or advertising cookies, we will update this section and provide whatever consent mechanism the law then requires. Today there are no analytics, advertising or preference cookies, because we don't use any.

9. How long we keep it

We keep your data until you delete it. There is no automatic expiry, because a maintenance history is only useful if it's complete — a record of an oil change from four years ago is the point.

A sign-in with Google or Facebook that you start but do not finish is held in our database for at most ten minutes (a one-time code, the page you came from and, for a new sign-up, the beta key you entered) and then deleted; the technical details are not kept after you are signed in.

When you delete your account, the records are removed from the live database immediately, and uploaded files are removed from object storage at the same time. Encrypted database backups persist for up to 7 days before being overwritten on their normal cycle; we do not restore deleted accounts from them. So a deletion is complete in the service at once, and complete everywhere within a week.

10. Your choices

These apply to everyone who uses CarBindr, not only California residents. California's CCPA/CPRA may not currently apply to a business of this size, but we would rather honour these than argue about thresholds.

• See what we hold. Everything is visible in the app, and the Share panel exports a complete PDF — vehicle details, documents, schedule, full service history and your charts.
• Correct it. Every field is editable.
• Delete it. Delete individual records, documents or vehicles at any time, or delete your entire account — which removes your vehicles, service records, documents, photos and settings. This cannot be undone.
• Disconnect Google or Facebook. Remove either from Sign-in methods in the account menu. An account with no password must set one first (use "Forgot password"), so you cannot lock yourself out. To also remove CarBindr from the list of apps connected to your Google or Facebook account, use that provider's own settings. Deleting your CarBindr account removes the identifiers we stored; it does not delete anything in your Google or Facebook account.
• Control shop access. Revoke a shop from the vehicle's Share menu to stop it receiving further vehicle information and account contact details.
• Opt out of commercial sale or sharing. We are not selling personal information or sharing it for cross-context advertising today. If that changes, you will be able to opt out through a "Do Not Sell or Share My Personal Information" control, or by emailing carbindrhq@gmail.com, and we will honour Global Privacy Control signals sent by your browser. You can register an objection in advance by emailing us, and we will apply it if and when it becomes relevant.
• Object or complain. Email carbindrhq@gmail.com.

We will not discriminate against you for exercising any of these — you will not get a worse service or a higher price for opting out.

To make a request, email carbindrhq@gmail.com from your account's address. We aim to respond within 30 days.

11. Security

• Passwords are hashed with bcrypt (cost 12) and never stored or logged in the clear.
• All traffic runs over HTTPS, and the database connection requires TLS.
• Sessions use signed tokens in an httpOnly, sameSite: strict cookie.
• Every request for a vehicle is checked against its owner or an approved shop's current access grant. This is covered by an automated test suite that runs against a real database.
• Password reset tokens are stored only as a SHA-256 hash, single-use, and expire in one hour — so even a database leak cannot be used to reset anyone's password.

No system is perfectly secure, and we won't pretend otherwise. If we discover a breach affecting your personal information, we will notify you and any authority we are required to, without undue delay.

12. Children

CarBindr is for adults. You must be 18 or older to use it. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, email carbindrhq@gmail.com and we will delete it.

13. Where your data lives

CarBindr is operated from the United States and its data is stored in the United States (us-west-1, Northern California). It is offered to United States residents. If you access it from elsewhere, you are doing so on your own initiative and your data will be processed in the US.

14. Beta

CarBindr is pre-release software in beta testing. That matters for privacy in two specific ways.

This policy will change before general release. It describes a product still being built. We expect to revise it — including the practices in section 3 — and we will tell you when we do.

We intend to keep what you enter. Our aim is that your account and records carry through to general release with nothing to re-enter, and we will take reasonable care to make that happen. We will not discard beta data for convenience.

We still cannot guarantee it. Data could be lost to a bug, a failed migration, or a problem we have to fix by resetting something. If a reset ever becomes necessary we will tell you first and give you time to export — but please don't treat CarBindr as the only copy of anything during beta. The PDF export in the Share panel exists for exactly this.

We will tell you when beta ends. Before CarBindr leaves beta we will email you to say what is changing, what happens to your account and your data, and whether there is anything you need to do.

Beyond that, everything in this policy applies to beta users in full: your data is handled the way described above, and you have every right listed in section 10.

15. Changes

If we change this policy we will update the date above. For anything that materially affects your rights, we will tell you by email before it takes effect. Continuing to use CarBindr afterwards means you accept the new version.

16. Contact

Email: carbindrhq@gmail.com Postal: 71 Columbine Road, Milton, MA 02186

James Millington, doing business as CarBindr.