Privacy policy
The short version
- Your car log stays on your phone. MotorLog has no accounts and no sign-in. Your cars, records, costs, photos and notes are stored on your device. We can't see them.
- Your registration is only sent off your phone when you look it up. If you tap Find my car, your reg goes to our lookup service on Cloudflare, which asks the DVSA for the car's details and MOT history.
- No ads, no analytics, no tracking. We don't sell or share your data, and we don't build a profile of you.
- You're in control. Settings › Delete all data on this phone wipes everything, and so does uninstalling the app.
1. Who we are
MotorLog is a car maintenance log for drivers in the UK and Ireland, made by an independent developer ("we", "us"). For UK GDPR purposes we are the data controller for the small amount of personal data described below.
Contact: help.motorlog.app@gmail.com
2. What stays on your phone
Everything you enter into MotorLog is stored only on your device, in the app's private storage:
- car details: registration, make, model, year, fuel, engine, colour, mileage and, if you add it, the VIN
- service, repair, MOT/NCT, tyre and fuel records, with costs, garages and notes
- MOT, road tax and insurance dates, and any insurer, cover type or policy number you choose to save
- photos you add, such as invoices, receipts and a picture of your car
- your settings, reminder choices and, if you have one, a founding-tester code
We don't have a server that stores this, and we never receive it. Text in photos (invoices, GOV.UK screenshots, insurance documents, VIN plates) is read on your phone. The photos are never uploaded.
Android backup. If you've turned on Google backup on your phone, Android may include MotorLog's data in your personal backup to your Google account. That backup is between you and Google, under Google's privacy policy. We can't see it.
3. What leaves your phone, and why
MotorLog only connects to the internet for the features listed here, and only when you use them. Every connection uses HTTPS (it's encrypted in transit). As with any internet request, the service you connect to can see your IP address and the time of the request.
| Feature | What is sent | Who receives it | How long it's kept |
|---|---|---|---|
| UK reg lookup (you tap Find my car) | The registration number you typed, plus your IP address | Our lookup service at motorlog-reg-lookup.motorlog.workers.dev, run on Cloudflare Workers. It forwards only the registration to the DVSA MOT History API and sends the result back to your phone. | The result is cached against the registration for up to 24 hours (1 hour if the reg wasn't found) so repeat lookups are fast. Your IP address is held in memory for rate limiting (stopping abuse) and is gone within a day. We don't keep lookup logs, and we don't link a reg to you. |
| Document scanning engine (first scan only) | No personal data. The app downloads the open-source tesseract.js text-recognition engine and its English language file. | jsDelivr content delivery network (cdn.jsdelivr.net) | Under jsDelivr's own policy. Your photos are not sent. |
| VIN decoder (you tap Decode) | The 17-character VIN you entered | The US government NHTSA vPIC service (vpic.nhtsa.dot.gov), which returns the make, model and engine | Under NHTSA's policy |
| Report a problem / feedback | Opens your own email app with a draft containing the app version, Android version, phone model and the screen you were on. Nothing is sent unless you press send. | Us, at help.motorlog.app@gmail.com (hosted by Google Gmail) | As long as we need to deal with your message, then deleted, and at most 24 months |
| Links to GOV.UK, NCTS and similar | Nothing from MotorLog | The website opens in your browser | Under that website's policy |
About the DVSA. MotorLog is independent and isn't affiliated with the DVSA, DVLA or GOV.UK. MOT history is public data that the Driver and Vehicle Standards Agency (DVSA) publishes for any registration. The DVSA is a UK government agency and handles our requests under its own terms and privacy notice. It sees requests coming from our lookup service, not from you, so it doesn't receive your IP address. Our lookup service doesn't use the DVLA at the moment. If we add it, we'll update this policy first.
Irish registrations are never sent anywhere. Irish cars are set up by hand.
4. What we don't do
- No accounts, no sign-in, no passwords.
- No advertising and no advertising IDs.
- No analytics, crash-reporting or tracking code. We checked the app for Google Analytics, Firebase, Crashlytics, Sentry and similar SDKs, and it contains none.
- No location, contacts, microphone or call-log access.
- We never sell your data or share it for marketing.
5. Reminders, permissions and tester codes
- Notifications: MOT/NCT, tax, insurance, service and mileage reminders are scheduled and shown on your phone using Android's alarm system. There's no push server, and nothing is sent to us. You can turn reminders off in Settings › Reminders or in Android settings.
- Camera and photos: only used when you choose to take or pick a photo. MotorLog uses the system camera and file picker, so it doesn't need the camera permission.
- Exact alarms and "run at startup": these only make sure reminders fire on time and survive a restart.
- Founding-tester codes are checked offline on your phone.
6. Our lawful basis (UK GDPR)
- Reg lookup and VIN decode: we process the registration or VIN and your IP address to give you the feature you asked for. This is our legitimate interest in running the app for you (Article 6(1)(f)), and it is necessary to provide the service you request (Article 6(1)(b)). Rate limiting by IP address is a legitimate interest in keeping the service secure and available.
- Emails you send us: legitimate interests (Article 6(1)(f)), so we can reply and fix problems.
7. Your rights and deleting your data
Under UK GDPR (and EU GDPR if you're in Ireland) you have the right to access, correct, delete, restrict or object to the use of your personal data, and to data portability.
- Delete everything on your phone: Settings › Delete all data on this phone, or uninstall MotorLog, or clear its storage in Android settings. We can't recover it afterwards, so make a backup first if you want one (Settings › Back up everything).
- Get a copy of your data: Settings › Back up everything (JSON) or Export history (CSV).
- Lookup cache: deletes itself within 24 hours. We have no way to tie a cached registration to you.
- Emails: ask us at help.motorlog.app@gmail.com and we'll delete your messages. We'll reply within one month.
8. Service providers and international transfers
- Cloudflare, Inc. runs our lookup service and hosts this page. It acts as our processor.
- Google (Gmail) holds our support mailbox. Google Play distributes the app and collects its own data under Google's privacy policy.
- jsDelivr serves the scanning engine files. NHTSA (VIN decoder) and the DVSA (MOT data) are independent public bodies.
Some of these providers process data outside the UK, for example in the United States. Where they do, we rely on the safeguards UK law allows, such as the UK–US data bridge or standard contractual clauses (the UK International Data Transfer Addendum).
9. Security
All connections use HTTPS. The keys for the government APIs live only on our lookup service, never in the app. Your data on the phone is protected by Android's app sandbox. Backup and CSV files you export are not encrypted, so keep them somewhere safe and only share them with people you trust.
10. Children
MotorLog is for car owners and drivers. It isn't aimed at children, and we don't knowingly collect data from anyone under 13.
11. Changes to this policy
If we change how MotorLog uses data, we'll update this page and the date at the top, and describe the change in the app's release notes before it takes effect.
12. Questions and complaints
Email help.motorlog.app@gmail.com. If you're unhappy with our answer, you can complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, in Ireland, the Data Protection Commission (dataprotection.ie).