Last updated 26 October 2026

Privacy Policy

This policy explains what personal data the Garage Portfolio app collects, why, who it is shared with, and the choices and rights you have.

1. Who we are

Garage Portfolio is operated by The Tech Narrative Ltd. (company no. 14862125), registered at 124 City Road, London, EC1V 2NX, United Kingdom. We are the controller of the personal data described in this policy.

2. What we collect

Your account

• Your email address.
• One-time email verification records, stored as keyed hashes, and hashed session identifiers used to keep you signed in. We do not use passwords.

Your garage

The vehicles you add and the details you enter for them:

• registration number and vehicle type;
• make, model, year and colour;
• VIN or chassis number, engine, power, transmission and drivetrain;
• current mileage, recorded compliance dates, whether a UK vehicle is MOT exempt, and any notes you write.

If you choose to fill in a vehicle's records, we also store:

• ownership: whether you still own it, purchase and sale dates and prices, and where it is stored;
• servicing: when the next service is due, past services with their date, mileage, workshop and cost;
• insurance: the policy number and agreed value;
• modifications and wraps: what was done, when, by whom, the cost and any warranty expiry;
• keys: how many there are and where the spare is kept; and
• tyres: sizes, models, pressures, and when and at what mileage they were fitted.

Some of these details, such as where a vehicle or its spare key is kept, could be useful to a thief. Only record what you're comfortable storing, and remember that anyone who can sign in to your account can see it.

Planned subscriptions

Paid subscriptions are not available yet. We do not currently collect subscription status or store transaction identifiers. We will update this policy to explain any payment-related data processing before paid plans launch.

Vehicle photographs

When you choose a photograph for a vehicle, we store a compressed copy with that vehicle. It is available through your signed-in account. You can replace or remove it in the app; deleting the vehicle also removes its photograph.

Vehicle records from DVLA and DVSA

When you look up or refresh a UK registration, we send its registration number to the DVLA Vehicle Enquiry Service and the DVSA MOT History service. We use what they return to fill in the vehicle and store it with that vehicle: make, model, colour, year, first registration date, engine size and fuel type; MOT status, expiry and last test date, test advisories and defects, recorded mileage history and any outstanding safety recall; tax status and due date; and CO₂ emissions, Euro emissions standard and whether the vehicle is marked for export.

On your phone

The app stores your sign-in token in your phone's secure storage, and non-secret account metadata and your reminder setting on your device. Sessions expire after 30 days without API use or 90 days in total. Compliance and service reminders are scheduled by your phone's operating system. We don't use a push notification service, and reminders never pass through our servers.

To let you view your garage offline, the app keeps an encrypted copy of vehicle details and previously loaded care records on your phone. Each account has a separate encryption key in your phone's secure storage. Signing out removes the key and the saved copy.

Feedback you send in the app

When you send feedback, a feature request or a bug report from the app, we receive the type, title and message you write, your account identifier and email address, and the app version and platform. It is emailed to our inbox so we can read it and reply to you.

Crash reports

If the app crashes or hits an unexpected error, it may send a report to Sentry. The report contains the error, your device model, operating system and app version. We configure it not to include your email address, IP address or vehicle details.

Technical logs

Our servers record technical details of requests to our API, such as the time, the endpoint, the response status and your IP address. We use them to keep the service secure, prevent abuse and fix faults. We don't write registration numbers to these logs.

This website

garageportfolio.com is hosted by Vercel, which records technical details of each request, such as your IP address, the page requested and your browser, to deliver and protect the site. We use Google Analytics to understand visits and how people use the website. Its Google tag uses first-party cookies to distinguish visitors and sessions. See how Google uses information from sites that use its services.

What we don't collect

The mobile app doesn't use advertising, analytics or tracking tools. We don't access your location or contacts, or browse your photo library. We receive only the photographs you choose to upload. We don't sell your data or share it for marketing.

3. How we use it

UK data protection law requires a lawful basis for each use of personal data. Ours are:

4. Who we share it with

We use these service providers, each only for the purpose shown and under contract with us:

• DVLA and DVSA receive a UK vehicle's registration number when you look it up or refresh it. They receive nothing else about you.
• Resend delivers sign-in and email confirmation codes to your email address, and feedback you send in the app to our inbox.
• Our hosting provider runs our API and PostgreSQL database containing your account, garage and authentication records.
• Cloudflare Turnstile processes device and network information, including your IP address, to protect sign-in from bots. Verification runs in a web view inside the app.
• Sentry receives crash reports.
• Expo delivers app updates and receives technical details such as app version and platform when the app checks for one.
• Apple and Google distribute the app under their own privacy policies.
• Vercel hosts this website.
• Google Analytics measures visits and usage on this website.

We may also disclose information where the law requires it, to protect our rights or the safety of others, or to a buyer of our business under equivalent protections.

5. International transfers

Some providers process data outside the UK, including in the European Economic Area and the United States. When they do, we rely on UK adequacy regulations or on safeguards approved under UK law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

6. How long we keep it

• Account and garage: for as long as you have an account. Deleting a vehicle removes it straight away.
• After you delete your account: your account, every vehicle and their records are deleted from our live systems immediately. Encrypted backups may retain earlier copies until their configured retention period ends.
• Crash reports: up to 90 days.
• Technical logs: up to 30 days, unless we need them longer to investigate a security incident.
• Emails and in-app feedback you send us: for as long as needed to deal with your request or feedback, and then up to two years.

7. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• correct it: you can edit vehicle details and records in the app yourself;
• delete it: you can delete vehicles or your whole account in the app, or ask us by email;
• receive your data in a portable format;
• object to or ask us to restrict processing based on legitimate interests; and
• withdraw consent, for example by turning off reminders.

To use these rights, email us from the address on your account. We'll reply within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office.

8. Security

Connections from your device to our service are encrypted. Database access stays on a private server network. Codes and session identifiers are hashed, access to our systems is restricted, and sign-in attempts, codes and lookups are rate-limited. No online service can be perfectly secure, but we work to protect your data and will tell you and the ICO about a breach where the law requires.

9. Children

Garage Portfolio is not intended for children under 13, and we don't knowingly collect their personal data. If you think a child has created an account, contact us and we'll delete it.

10. Changes to this policy

We'll update this policy when the app or the way we handle data changes, and update the date at the top. If a change materially affects how we use your data, we'll tell you in the app or by email before it takes effect.

11. Contact us

Email info@garageportfolio.com, or write to: