Garage privacy policy

Last updated: 25 October 2026 · Version: 1.0

Garage is an app to keep cars, motorcycles, scooters and vans in order: refuels, consumption, services, expenses and deadlines such as road tax, inspection and insurance. This policy explains what data the app processes, why, where it goes and your rights under Regulation (EU) 2016/679 ("GDPR").

In short

• Without an account your data stays only on your phone. We never receive it.
• Photos (receipts, registration certificate, odometer) are read on the phone and are neither saved nor sent. From the registration certificate we only read the vehicle data: the holder's name and address are never read or stored.
• The account is optional. It is only needed for cloud sync and backup (Garage Plus). Synced data is stored in the European Union.
• No ads, no profiling, no sale of data, no behavioural analytics.
• You can delete your account and all data at any time from the app.

1. Data controller

Daniel Serra, independent developer publishing as filaliscio · certified email (PEC): [email protected] · email: [email protected]

No data protection officer has been appointed (not required for this activity).

2. What data we process and why

2.1 Garage data on your phone

Vehicles (name, type, make, model, plate, fuel, mileage, first registration date, colour), refuels, services, expenses, deadlines, the optional vehicle photo and your preferences (theme, language) are stored in the phone's memory, inside the app. Until you create an account and turn on sync they are not sent to us. Uninstalling the app deletes them; the vehicle photo is never synced.

2.2 Photos of receipts, registration certificate and odometer

When you choose to read a receipt, the registration certificate or the odometer, the photo is analysed on the phone with Google ML Kit text recognition, built into the app. The photo and the recognised text are not saved and never leave the phone: the app suggests the values found (amount, litres, date, mileage, vehicle data) and you confirm or correct them. From the registration certificate, the holder fields (C.1, C.2, C.3 and following: name, surname, address, tax code) are discarded immediately without being read by the app.

ML Kit sends Google some anonymous technical information about how it works: phone model and operating system, app name and version, processing times, image format, error codes. It does not send the images or the recognised text. Legal basis: legitimate interest in the feature working properly (Art. 6(1)(f) GDPR).

The camera is only used when you open it from these features. Gallery photos are chosen with the system picker: the app has no access to the rest of your gallery.

2.3 Account (optional)

To create an account we only need your email address: we send you a 6-digit sign-in code (or a link). We do not use passwords. For security, the authentication service also records technical sign-in data (IP address, date and time). Legal basis: performance of the contract, i.e. providing the service you request (Art. 6(1)(b) GDPR), and legitimate interest in security (Art. 6(1)(f)).

2.4 Cloud sync and backup (Garage Plus)

If you have an account and an active Garage Plus subscription, the garage data described in 2.1 (except the vehicle photo) is copied to our database, hosted by Supabase in the European Union (Frankfurt, Germany), so you can find it on other phones or after changing phone. Each account only sees its own data. The connection is encrypted (HTTPS). Legal basis: performance of the contract (Art. 6(1)(b) GDPR). When the subscription ends, sync stops and the data stays on your phone.

2.5 Purchases (Garage Pro, Garage Plus, PDF report)

Payments are made through Google Play, which processes your payment data as an independent controller under its own policy: we never see or store card or account details. To verify purchases and unlock features we use RevenueCat, which receives: an anonymous identifier generated by the app (not linked to your account or email), purchase and receipt data (product, date, subscription status, store country), technical information about the app and device. Legal basis: performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)).

2.6 Notifications

Deadline reminders are local notifications scheduled on the phone: they do not go through our servers.

2.7 PDF report

The vehicle report is created on the phone. You share it yourself, with whoever you want and with the app you choose. It only contains the garage data you entered.

2.8 Contact and support

If you write to us we process your email address and message to reply (Art. 6(1)(b) or (f) GDPR) and keep them as long as needed to handle the request, at most 24 months.

2.9 Website filaliscio.com

The site uses no profiling cookies or analytics. The hosting provider (Cloudflare) records technical visit data (IP address, date and time, requested page) for security and operation, for a few days.

3. Who we entrust data to (processors)

When data is transferred outside the European Economic Area, it is protected by the safeguards required by the GDPR: adequacy decision (EU-US Data Privacy Framework) for participating providers, or standard contractual clauses approved by the European Commission.

We do not sell or hand over your data to third parties and do not use it for advertising.

4. How long

• Data on the phone: as long as you keep it or until you uninstall the app.
• Account and synced data: as long as the account exists. If you delete the account (More → Account → Delete account), the account and synced data are removed from the database immediately. Any technical backup copies are overwritten within 30 days.
• Purchase data: as long as required by tax and accounting obligations and Google Play rules.
• Support emails: at most 24 months.

5. Your rights

You can request access to your data, rectification, erasure, restriction, portability and object to processing based on legitimate interest (Arts. 15–21 GDPR) at any time by writing to [email protected]. We reply within one month. Many actions you can do yourself in the app: edit or delete data, delete the account.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country.

6. Children

Garage is not intended for children under 14. If you are a parent and believe a child has given us data, write to us and we will delete it.

7. Security

Connections with our providers are encrypted. The database enforces access rules so that each account can only read and change its own data. The sign-in session is stored in the phone's secure storage.

8. Changes to this policy

If we change how we process data we will update this page and the date at the top; for important changes we will notify you in the app.