Location access
We only ask the browser for your location after you select Use my location. Your coordinates are used to define the area for that nearby search and are not stored by this MVP after the current session. You can always search by town or postcode instead.
Search and map requests
The browser sends searches and visible map bounds to same-origin Car Insight endpoints. Those endpoints may use a configured fuel-data provider to return matching stations. Precise location values should not be written to production application logs.
Accounts and secure sessions
My Garage uses a secure, HttpOnly session cookie after sign-in. Browser scripts cannot read the portal access token. Private API responses are not stored in a public cache, and the portal derives your identity from the verified token rather than accepting a user ID from the page.
Vehicles, services and trips
Portal records come from the Car Insight backend after synchronization from your phone. When interval editing is enabled, the service-interval details you add or change are sent to that same account-scoped backend and can synchronize to compatible Car Insight clients. Concurrent edits are version checked rather than silently overwritten. Trip routes are private. The portal receives only simplified points or an encoded polyline needed to draw the route, not an unnecessary raw telemetry stream. Records belonging to another account must not be returned.
Google Calendar service reminders
Saving a service reminder sends your edited title, date, time, time zone and notification settings, together with the vehicle identifier and service name, to the primary calendar of the Google account you select. The event is private and you can edit or delete it in Google Calendar.
Google asks for permission to manage events on calendars you own. Car Insight uses that permission only to create the requested event and, when you retry a save, retrieve that specific event to confirm its details. It does not list your other calendar records. The short-lived Calendar access token is handled in memory for authorization and the save request; it is not stored in cookies, a database or application logs. We do not request or store a refresh token.
We do not use Google Calendar data for advertising, AI features or model training, or share it with third parties other than Google to perform your requested save. You can revoke Car Insight's Calendar access in your Google Account permissions. Revoking access does not delete an event already saved in Google Calendar. Reminder delivery depends on your Google Calendar notification settings and device permissions.
Vehicle checks and AI comparisons
Vehicle Check sends the registration to a same-origin Car Insight endpoint, which retrieves available DVLA and MOT History information on the server. When you actively choose Compare cars, the two normalized vehicle records, including returned MOT tests and defects, are sent server-side to OpenAI so GPT-5.6 Luna can prepare the comparison. Registration numbers are not placed in the page URL, and the OpenAI request is made with response storage disabled. Do not use Compare Cars if you do not want those records sent to OpenAI for that request.
Fuel and map providers
When Google Maps is configured, your browser connects directly to Google Maps Platform. Google may receive technical request information such as your IP address, referring site, browser or device details, and map interactions under the Google Privacy Policy. Other configured map or fuel providers receive the minimum requests needed to provide their service under their own terms. Navigation links open a third-party mapping service in a new tab.
Your choices
- Decline location access and search manually.
- Clear a search at any time with the reset control.
- Block or revoke geolocation access in your browser settings.
- Sign out to delete the portal session cookie from this browser.
- Use the account deletion process in Car Insight when it becomes available for your configured identity provider.