Car Notes
ENUA
Open web app
Home / Privacy policy

Privacy policy

Last updated 6 November 2026

1. Who is responsible for your data

Car Notes is operated by Jerry McQuin, Ukraine (“we”, “us”), who is the data controller for the personal data described in this policy. Contact for all privacy matters: support@carnotes.app.

This policy applies to the website carnotes.app, the web application at app.carnotes.app and the Car Notes mobile application (together, the “Service”). It is intended to meet the requirements of the EU and UK General Data Protection Regulation (GDPR) and the Law of Ukraine on Personal Data Protection.

2. Confidentiality of your records

Your records belong to you. They are held in a private account, are not published and cannot be seen by other users. We do not sell personal data, do not use it for advertising and do not review your records in the ordinary course of running the Service.

Data is encrypted in transit and encrypted at rest by our storage providers. The Service must process your records in order to display and synchronise them, so they are not end-to-end encrypted. Administrative access is restricted to the operator, and we access the content of an account only in the following cases:

  • you ask for support and the request cannot be resolved without it;
  • you submit a custom import request (section 5);
  • it is necessary to investigate a security incident or a fault affecting the Service, or a suspected breach of the Terms of use;
  • we are required to do so by law (section 8).

3. Data we process

  • Account data: email address and name, a protected (hashed) password, and, if you sign in with Google, the name, email address and profile picture supplied by Google.
  • Records you enter: vehicles, including the number plate and VIN if you add them, expenses, service items, reminders, documents, notes and odometer readings.
  • Files you attach: receipt and document photographs, and export files you send for a custom import.
  • Correspondence: support messages, suggestions sent from the app and any contact email you leave with them.
  • Technical data: IP address and device or browser type, recorded with your sign-in sessions, in rate-limiting records and in server logs.
  • Usage statistics, only with your consent: pages and screens opened, actions such as adding an expense or a car, and general device and location data derived from your IP address. Your records are not included (section 9).

We do not ask for payment details. Parking locations and the data used for local notifications remain on your device and are not sent to our servers.

4. Purposes and legal bases

  • Performance of a contract (GDPR Art. 6(1)(b)): providing your account, storing and synchronising your records across devices, calculating statistics, sending password reset emails, carrying out import and export requests, and answering support requests.
  • Legitimate interests (Art. 6(1)(f)): keeping the Service secure, preventing abuse, limiting automated requests and diagnosing faults.
  • Consent (Art. 6(1)(a)): analytics on the website and usage statistics in the applications (section 9). You may withdraw consent at any time, without affecting earlier processing.
  • Legal obligation (Art. 6(1)(c)): responding to lawful requests and meeting legal duties.

Providing an email address and password or a Google sign-in is necessary to use an account. All other information is optional, although some features depend on it. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects. Temporary limits applied to excessive requests are a technical safeguard only.

5. Custom import requests

Standard imports are processed automatically. Where the format of your export is not yet supported, you may submit the file as a custom import request. In that case only, the operator may review the file manually, once, for the sole purpose of preparing the import for your account. The file is not used for any other purpose.

6. Device permissions

The mobile application requests location only when you select My location on a parking spot, accesses only the photographs you choose, and schedules notifications on the device. It does not track your location in the background.

7. Service providers

We use the following providers, which process data on our behalf and only to deliver their service:

  • Vercel: application hosting.
  • Neon: database hosting.
  • Cloudflare: private file storage in the EU, website delivery and cookieless website statistics.
  • Resend: delivery of transactional email.
  • Google: optional sign-in, the map in the web application, Tag Manager on the website and, with your consent, Google Analytics on the website and in the applications. When you use the map, the website or Google Analytics, Google receives your IP address and the requested content, as described in its privacy policy.

Exchange rates are retrieved from public sources, and those requests contain no information about you.

8. Disclosure required by law

We disclose personal data to a public authority only where a valid legal request or applicable law requires it, and only to the extent required. We assess each request before responding and, unless prohibited by law, inform the person concerned. We may also disclose information where this is necessary to establish, exercise or defend legal claims.

9. Cookies and similar technologies

  • Strictly necessary: the web application uses a session cookie to keep you signed in, and browser storage for your language and settings. The website stores your language and theme choice in browser storage. These do not require consent because they are needed for the Service you request.
  • Analytics, with consent only: if you accept analytics cookies in the cookie notice on the website, Google Analytics 4 sets cookies named _ga and _ga_*, kept for up to two years, to measure visits and traffic sources. You can withdraw consent through the cookie notice or by clearing your browser’s cookies.
  • Without cookies: Cloudflare Web Analytics counts visits in aggregate, sets no cookies and does not follow you across sites. Google Search Console gives us aggregated reports on how the website appears in Google Search and places nothing on your device.
  • Web application, with consent only: if you allow usage statistics when the application asks, Google Analytics 4 sets the same _ga and _ga_* cookies and records the screens you open and when you add an expense or a car. Your records, such as amounts, notes and plates, are not included. You can turn this off in Settings, which also removes these cookies.
  • Mobile application: it uses no cookies. Your session is kept in the secure storage of your device. If you allow usage statistics when the application asks, Google Analytics for Firebase records the same information with a random identifier created for the app. It does not use the advertising identifier, and your records are not included. Nothing is collected before you allow it, and you can turn this off in Settings.

10. International transfers

Receipt, document and import files are stored in the EU. Some of our providers are established or process data outside the European Economic Area, including in the United States. Where such a transfer takes place, it relies on an adequacy decision, Standard Contractual Clauses or another safeguard recognised by the GDPR. You may ask us for details.

11. Retention

  • Account data, records and files: until you delete them or delete your account.
  • Import files and support correspondence: until your account is deleted, or earlier on request.
  • Session and rate-limiting records and server logs: for the short period needed for security.
  • Analytics data: up to 14 months.

When you delete your account, your data is erased from the live systems immediately. Copies in our providers’ backups are overwritten in the normal course of their retention cycle.

12. Security

We apply technical and organisational measures appropriate to the risk, including encrypted connections, hashed passwords, access limited to each account, private file storage with time-limited links and rate limiting. No system is entirely secure. If a personal data breach is likely to put you at risk, we will notify you and the competent authorities as the law requires.

13. Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability and to withdraw consent. Most of these can be exercised directly in the app:

  • correct your data: edit it in the relevant screen or in Profile;
  • obtain a copy: Profile → Data exports everything as JSON and each vehicle as CSV;
  • erase your data: Profile → Account → Delete account removes your account and all related data immediately. The procedure is also described on the Delete account page.

For any other request, or if you cannot sign in, write to support@carnotes.app. We respond within one month. You also have the right to lodge a complaint with the supervisory authority of your country of residence or, in Ukraine, with the Ukrainian Parliament Commissioner for Human Rights.

14. Children

The Service is not directed at persons under 16, and we do not knowingly collect their data. If you believe that such data has been provided to us, please contact us and we will delete it.

15. Changes to this policy

We will publish any change on this page and update the date above. Material changes will be announced in the app before they take effect.