Privacy Policy

1. Who we are

MyDIYGarage is a vehicle maintenance tracking application operated by Nielsen Digital, LLC ("we," "us," "our"), a Texas limited liability company. Our service is accessible at app.mydiygarage.com.

This Privacy Policy explains how we collect, use, and protect information you provide when you use MyDIYGarage. By creating an account or using the service, you agree to the practices described here.

2. What data we collect

Account information

• Email address — required to create an account, send transactional emails (verification, password reset), and contact you about your subscription.
• Username — chosen by you, displayed in your account settings.
• First and last name — optional, used for personalization only.
• Password — authentication is handled by AWS Cognito. Your password is stored and verified by Cognito using industry-standard one-way hashing — we never see or store the plaintext, and we cannot read your password. Optional two-factor authentication (TOTP) is available.
• Phone number — optional, never required, not used for marketing.

Vehicle and maintenance data

All vehicle records you create — service logs, fuel logs, fault codes, maintenance schedules, track-day logs, and vehicle details including the Vehicle Identification Number (VIN) — are stored on our servers to provide the service. This data is yours. We do not analyze it for advertising, sell it to third parties, or share it with insurers, dealers, or data brokers.

Photos, receipts, and documents you upload

• Vehicle photos — images you upload for your vehicles are stored in AWS S3 and shown back to you in your account.
• Receipt images — when you upload a photo of a parts or service receipt, we process it with optical character recognition (OCR) to extract fields such as the part, price, and date. The resulting parts-inventory data is stored in your account. Uploaded receipt images are stored in AWS S3.
• Owner's manuals — manuals you upload for a vehicle are stored so we can make them searchable inside your account.

OBD2 dongle data (auto-ingest)

If you pair a supported Bluetooth OBD2 dongle to your car, the MyDIYGarage mobile app reads a narrow set of values directly from your vehicle's onboard diagnostics port and sends them to your account. We capture only what the OBD2 standard exposes, and only the specific values we need to keep your log up to date:

• Odometer reading (OBD2 PID 01 31, or a derived distance estimate when the vehicle does not expose odometer directly) — so your mileage stays current without manual entry.
• Diagnostic Trouble Codes (DTCs) retrieved via OBD2 Mode 03 — the fault codes your car's computer has stored.
• Malfunction Indicator Lamp (MIL) status (PID 01 01) — whether your check-engine light is on.
• Freeze-frame snapshot associated with a stored DTC — the small set of sensor values (coolant temperature, RPM, vehicle speed, etc.) the car recorded at the moment the fault was set.
• A salted/keyed hash of the dongle's identifier — so we can recognize the same device on repeat connections and let you revoke it. We treat this hash as personal data: it lets us recognize your dongle, but we cannot recover the raw serial from it. (Under CPRA §1798.140(m), the Bluetooth address space is small enough that an unsalted hash would be reversible, so we apply a server-side keyed salt and treat the result as a pseudonymous identifier — not as de-identified or anonymous data.)
• Capture timestamps — when each reading was taken.

Each OBD2-sourced record is tagged with its provenance (auto-captured vs. manually entered) and lands as a draft you confirm before it joins your permanent log. You can delete all OBD2-sourced data for a vehicle in one action without affecting anything you entered yourself, and revoking a dongle stops all auto-ingest from that device immediately.

Billing information

If you subscribe to a paid plan, payment is handled by Stripe. We receive a payment confirmation and your Stripe customer ID. We never see, store, or process raw card numbers, bank account details, or full payment credentials.

Technical data

• IP address (logged by our infrastructure for security and abuse prevention)
• Browser type and operating system (included in standard HTTP headers)
• Timestamps of account actions (login, registration, record creation)

MyDIYGarage uses AWS CloudWatch RUM (Real User Monitoring) for first-party analytics — page views, performance, JavaScript errors, and aggregate product-usage events — to keep the app fast and reliable. This is our own telemetry via our cloud provider (AWS); it is not shared with advertising networks and does not track you across other websites.

We do not use third-party advertising or cross-site tracking analytics (no Google Analytics, no ad networks).

3. What we do not collect or sell

Specifically, for OBD2 dongle data

Driving telemetry is a category that other companies have built entire business models around selling. We have not, and we will not. To be explicit:

• We do not capture GPS or location data through the OBD2 connection. The dongle does not transmit GPS, and the mobile app does not pair location data with OBD2 readings. (If we ever add an optional location-aware feature in the future, it will be opt-in per vehicle, clearly labeled, and covered by an updated version of this policy before it ships.)
• We do not capture audio, video, or anything outside the OBD2 standard. The dongle is physically incapable of doing so, and the app does not ask for microphone or camera access for this feature.
• We do not sell or share OBD2-sourced data with insurance companies, advertisers, dealerships, repair networks, fleet-analytics firms, telematics aggregators, data brokers, or any other third party for monetary or other valuable consideration. We use "sell" and "share" here as defined by the CCPA/CPRA (including §1798.140(ad) and the cross-context behavioral advertising definition). There is no commercial pipeline. There is no anonymized-and-aggregated escape hatch that quietly resells driving behavior. This commitment does not have a feature flag.
• Processors are not sales or shares. Processors acting on our written instructions under service-provider/processor terms (e.g., cloud hosting, error monitoring) are not "sales" or "shares" under the CCPA/CPRA. The categories of processors we currently use are listed in section 5.
• Changing this commitment requires founder-level review and a material change to this policy, with at least 30 days' email notice to you before any new use takes effect (see section 10). We would rather lose a deal than quietly flip this rule.

4. How we use your data

We use the information we collect exclusively to:

• Create and maintain your account
• Deliver the features of the MyDIYGarage service (storing and retrieving your vehicle records)
• Send transactional emails: email verification, password resets, subscription receipts, and service notices
• Process subscription payments through Stripe
• Respond to support requests you initiate
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not use your data for any purpose not listed above without first updating this policy and notifying you.

OBD2-sourced data is used only to populate your own vehicle logs (mileage, fault codes, freeze-frame snapshots) and, in the future, to power your own AI co-pilot insights inside your account. It is never aggregated for resale, never fed to third-party analytics, and never used to build profiles of you or your driving for anyone else.

5. Third-party processors

We use a small number of third-party services to operate MyDIYGarage. Each has its own privacy policy. We share only the minimum data necessary for the service to function. The categories of third parties to whom we disclose personal information are: payment processors, cloud infrastructure providers, and mobile push-notification services (Apple Push Notification service and Google Firebase Cloud Messaging, which receive a device push token to route notifications to our mobile apps). We do not disclose personal information to advertisers, data brokers, CRM platforms, or cross-site tracking analytics services.

Categories of personal information we collect (CCPA §1798.140(v))

For California-resident transparency, here is how the data we collect maps to the statutory categories. We collect data in these categories only as described elsewhere in this policy:

• Identifiers — email address, username, name (optional), phone number (optional), IP address, and the salted/keyed hash of your OBD2 dongle's identifier (a pseudonymous identifier under CPRA §1798.140(m), treated as personal information throughout this policy).
• Commercial information — subscription tier and billing-related identifiers from Stripe (we do not receive raw payment credentials).
• Internet or other electronic network activity information — login timestamps, record-creation timestamps, browser/OS strings from standard HTTP headers, OBD2 capture timestamps, and BLE pairing metadata for paired dongles.
• Geolocation data — none collected via OBD2. The dongle does not transmit GPS, and we do not pair location data with OBD2 readings. Coarse geolocation may be inferred from IP address solely for security/abuse-prevention purposes; we do not store derived location.
• Vehicle and maintenance records — the service logs, fuel logs, fault codes, and vehicle details you create or that flow from a paired OBD2 dongle.
• Inferences — vehicle-health signals derived from DTCs and OBD2 readings (used only inside your own account to power your logs and, in the future, your own AI co-pilot insights). Never used to build profiles for third parties.

We do not collect biometric information, precise geolocation, sensitive personal information as defined by the CPRA, or any category not listed above.

Categories of sources (CCPA §1798.130). We collect this information from you directly (the account, vehicle, and maintenance data you enter), from your device and browser (technical data and our first-party telemetry), from a paired OBD2 dongle (diagnostic data), and from our payment processor (subscription and billing identifiers). We use each category only for the business purposes described in "How we use your data" above.

Stripe (payment processing)

Stripe processes all subscription payments. When you subscribe, your payment details are entered directly into Stripe's secure checkout — they never pass through our servers. Stripe may set cookies during checkout sessions. See Stripe's Privacy Policy.

Amazon Web Services (infrastructure)

Our application and your data are hosted on AWS. We use AWS for compute, database, authentication (Amazon Cognito), transactional email (Amazon SES), first-party telemetry (Amazon CloudWatch RUM), and image, receipt, and manual storage (Amazon S3). AWS does not access your personal data except as required to deliver these infrastructure services. See AWS Privacy Policy.

Push notifications

Push notifications: on the web, we use self-hosted Web Push (VAPID) with no third party. In the mobile apps, delivery uses the platform push services — Apple Push Notification service (APNs) on iOS and Google Firebase Cloud Messaging (FCM) on Android — which receive a device push token to route the notification.

We avoid third-party advertising, cross-site tracking analytics, CRM platforms, and Google fonts and analytics. The only third parties that receive your personal data are those described above: our payment processor, our cloud infrastructure provider (AWS), and — for mobile push delivery — Apple APNs (iOS) and Google Firebase Cloud Messaging (Android).

6. Cookies and local storage

We use a minimal set of cookies and browser storage. See our Cookie Policy for full details.

• Session authentication cookie — a secure, HTTP-only cookie that keeps you logged in. Strictly necessary; cannot be disabled without logging out.
• Local storage — we store your UI preferences (display units, default vehicle) in your browser's local storage. This data never leaves your device.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies on this site. Our current cookies and browser storage are strictly necessary / first-party (session authentication and your own UI preferences); our first-party telemetry (AWS CloudWatch RUM, described in section 2) does not track you across other websites. Because there are no non-essential or tracking cookies today, no consent banner is shown. If we ever introduce third-party, non-essential, or tracking cookies, we will update our Cookie Policy and this section and add an in-browser consent banner before deploying them. MyDIYGarage currently offers its service to customers in the United States; if we begin serving EU/UK residents, we will implement consent-based controls for non-essential analytics (including AWS CloudWatch RUM) before doing so.

7. Data retention

We retain your data for as long as your account is active. If you delete your account:

• Your vehicle records and personal information are permanently deleted 14 days after you delete your account. During that 14-day window you can restore your account; once it passes, deletion is irreversible.
• Billing records (subscription history, payment confirmations) may be retained for up to 7 years as required by financial and tax regulations.
• Anonymized, aggregated usage statistics — data from which all identifying information has been removed and that cannot be reasonably re-linked to any individual — may be retained indefinitely.

To request deletion of your account and data, email us at privacy@mydiygarage.com or use the account deletion option in your settings.

Security safeguards

We use industry-standard technical and organizational measures to protect your personal information, including encryption in transit (TLS) and encryption at rest for data stored on our servers. Access to personal data is restricted to personnel and systems that require it to provide the service. We also maintain regular encrypted backups, access logging, and ongoing vulnerability monitoring as part of our security program. No transmission over the internet or method of electronic storage is 100% secure; we cannot guarantee absolute security.

Security incidents

In the event of a security incident that affects your personal information, we will notify affected users as required by applicable law — including the Texas Business & Commerce Code Chapter 521 — and, in all cases, without undue delay. Notification will be sent to the email address on your account.

8. Your rights

Depending on your location, you may have the following rights regarding your personal data. We honor these requests for all users regardless of jurisdiction.

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your account and associated data (subject to legal retention requirements above).
• Portability — download a copy of your vehicle data in a machine-readable format yourself using the in-app "Download My Data" export in your account settings. If you would rather we send it to you, email us at privacy@mydiygarage.com.
• Objection / Restriction — object to or request restriction of certain processing activities.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at privacy@mydiygarage.com. We will respond within 30 days. We do not charge for reasonable requests.

Your rights over OBD2-sourced data

If you paired an OBD2 dongle, you have two additional controls available directly inside the app, without needing to email us:

• Delete all OBD2-sourced data for a vehicle in one action. This removes every auto-captured mileage reading, DTC, MIL status change, and freeze-frame snapshot tied to that vehicle. It does not touch entries you typed yourself.
• Revoke a dongle. Revoking dongle access from your vehicle settings stops all auto-ingest from that device immediately. New trips will not be captured until you re-pair.

Revoke + delete together cover both directions of objection (GDPR Art. 21). Revoking the dongle is the prospective remedy — no further OBD2 records are captured. Per-vehicle delete is the retrospective remedy — existing OBD2-sourced records are removed. Use one or both depending on whether you want to stop future capture, erase what's already there, or both.

Data portability (GDPR Art. 20). OBD2-sourced records are included in any data export you request under the Portability right above. You will receive your auto-captured mileage readings, DTCs, MIL status entries, and freeze-frame snapshots in the same machine-readable export as the rest of your vehicle data.

California residents (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). We do not sell personal information as defined by the CCPA, and we do not share personal information for cross-context behavioral advertising as defined by the CPRA. California residents have the right to:

• Know — request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.
• Delete — request deletion of your personal information, subject to certain exceptions.
• Correct — request correction of inaccurate personal information we maintain about you.
• Opt out of sale/sharing — we do not sell or share personal information, so this right is not applicable but is acknowledged.
• Non-discrimination — we will not discriminate against you for exercising any CCPA/CPRA rights.

We do not collect sensitive personal information as defined by the CPRA. To exercise any of these rights, contact us at privacy@mydiygarage.com. We will respond within 45 days, as required by California law.

EU/UK residents (GDPR)

If you are in the European Union or United Kingdom, our legal basis for processing your data is:

• Contract — processing necessary to provide the service you signed up for
• Legitimate interest — fraud prevention and security
• Legal obligation — financial record retention

We do not engage in solely automated decision-making that produces legal or similarly significant effects on you, as defined by Article 22 of the GDPR.

You have the right to lodge a complaint with your local supervisory authority. Our Data Protection contact is privacy@mydiygarage.com.

9. Children

MyDIYGarage is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If we discover that an account was created by someone under 13, we will delete it promptly. If you believe a child under 13 has created an account, contact us at privacy@mydiygarage.com and we will delete the account.

Users between 13 and 17 may use the service with verifiable parental or guardian consent. Consent is obtained by having the parent or guardian create the account and accept these Terms on behalf of the minor. We do not have a separate age-verification mechanism. Users who misrepresent their age to create an account assume full responsibility for any consequences of that misrepresentation.

10. Changes to this policy

We may update this Privacy Policy as the service evolves. For material adverse changes — changes that expand what data we collect, broaden how we use it, or add categories of recipients we share it with — we will:

• Post the updated policy at this URL with a new effective date
• Send an email to registered users at least 30 days before the change takes effect

Additive or more-protective changes (clarifications, new user controls, expanded transparency, formatting, typo fixes) are not "material adverse changes" and may take effect on the date posted. Version 1.4 is an example: it adds more transparent disclosures — first-party analytics (AWS CloudWatch RUM), mobile push-notification subprocessors (Apple APNs and Google Firebase Cloud Messaging), receipt-image OCR, vehicle photos, uploaded owner's manuals, the VIN, and AWS Cognito authentication. These describe existing practices more fully and add no adverse uses, so the effective date is the same as the publication date. (Version 1.3 shortened the post-deletion retention window from 30 days to 14 days — your data is deleted sooner, which is more protective. Version 1.2 similarly added OBD2-specific disclosures and a stronger no-sale commitment.)

No retroactive application. We will not retroactively apply new uses to data collected under the prior version of this policy. If a future revision broadens permitted uses, the broader uses apply only to data collected after that revision's effective date — earlier data remains governed by the version of the policy in effect when it was collected.

Mergers, acquisitions, and asset sales. In a merger, acquisition, restructuring, or asset sale, OBD2 data and other personal information transfer only to a successor that is contractually bound by commitments at least as protective as the ones in this policy — including the no-sale and no-share commitments in section 3. Users will receive at least 30 days' notice of any such transfer with an opportunity to export and delete their data before the transfer takes effect.

Continued use of the service after an effective date constitutes acceptance of the updated policy.

11. Contact us

For privacy questions, data requests, or concerns:

• Email: privacy@mydiygarage.com
• General contact: hello@mydiygarage.com

Nielsen Digital, LLC
c/o Northwest Registered Agent, LLC
5900 Balcones Drive, Suite 100
Austin, TX 78731
United States