Last updated: 3 October 2026
Garazh.Guru is a service for car owners. This policy covers the Garazh Guru mobile apps for Android (Google Play) and iOS, and the garazh.guru website. Contact hello@garazh.guru with privacy questions or requests to exercise your rights.
In the mobile apps, we process a name when Apple or Google provides it, email address, account identifiers, a password hash for email sign-in, a profile-picture link when Google or Apple provides one, vehicle data including plate, VIN, make, model, year and mileage, plate-search history, fuel and service records, expenses, reminders, and motor-liability policy start and end dates. Push delivery stores a device token (APNs on iOS, Firebase Cloud Messaging on Android), a device identifier, app version, locale, and time zone. When an app crashes or hangs, we receive a technical crash report: the app and OS versions, the device model, the error type, and the call stack of the app’s code. The report contains no account, vehicle, or log data and is not linked to your account. Receipt, service-document, vehicle and profile photos are stored locally on your device. Only when you request parsing is a copy of a receipt or service document sent through our backend to Google Gemini; Garazh.Guru does not retain that file on its server after the response. Google processes the copy under the Gemini API terms, and its retention and possible use to improve products depend on the applicable service and billing plan. Do not submit images containing unnecessary personal or sensitive data. Neither app requests location. On the website, we also process waitlist email; hosting infrastructure may record IP addresses and technical request data for security and operation, and the cookie banner stores your consent choice locally in your browser.
We use data only to authenticate and secure accounts, sync the garage and logs, parse documents you select, calculate expenses, deliver reminders, detect and fix app crashes, prevent abuse, provide support, and send launch updates. We do not sell data, show ads, combine it with third-party data for advertising tracking, request App Tracking Transparency permission on iOS, or use the Android advertising identifier.
We use HOSTiQ for hosting and database infrastructure and Google Gemini for receipt and service-document parsing you request. Sign in with Google is available on both platforms - through Credential Manager on Android and a browser-based OAuth flow on iOS - so Google receives the sign-in request in either case. On iOS we also use Apple services: Sign in with Apple, APNs, and TestFlight. On Android we use further Google services: Firebase Cloud Messaging for push, the ML Kit document scanner (the app sends no image while capturing), and distribution through Google Play. Registering for push means Google receives a technical app-installation identifier for that device. We use an email service provider for waitlist notifications and for correspondence with you. The current website code does not load Google Analytics; if analytics is enabled later, this policy will be updated and analytics will require prior consent. On Android, crash reports are collected by Google’s Firebase Crashlytics, which receives a technical app-installation identifier, the device model, the OS and app versions, and the call stack at the time of the crash. On iOS, crash reports come from Apple’s built-in MetricKit, and the app sends them only to our server. The native iOS and Android apps contain no third-party analytics, advertising, or tracking SDKs.
Data travels only over a secure TLS connection; release builds of the apps do not use unencrypted connections. The sign-in session is stored encrypted on the device - via the Android Keystore on Android and the Keychain on iOS. Access to the production server is restricted by SSH keys and a firewall, and data access is limited to people who need it to operate the service. We do not store receipt or service-document photos on our servers: the copy is processed in memory and never written to disk.
Account data is kept for as long as the account exists. Deleting the account in the app immediately and irreversibly removes your profile, vehicles, fuel and service logs, reminders, push tokens, plate-search history, and service requests from our database. Internal technical change records, which contain only a random account identifier, are deleted automatically within 72 hours, and processed queue records within 7 days. Database backups are taken nightly and rotated: deleted data may remain in them for up to 60 days, after which it disappears along with the older copies. Backups are used only to recover the service after a failure, never to restore individual accounts. Server technical logs may contain request metadata and are kept in our monitoring system for a limited period defined by its settings; iOS crash reports are kept there too. Firebase Crashlytics keeps Android crash reports for up to 90 days. A waitlist email left on the website is not linked to an app account - we delete it separately on request, together with the copy in our mailbox.
How to delete your account and what is erasedYou can review core data in the app, correct entries, or delete the account in Settings. You can also request access, correction, or deletion at hello@garazh.guru - including after you have already removed the app from your device. Information required by law or necessary for a security investigation may be retained only as long as needed.