GarageLog360
EN

GARAGELOG360

Privacy Policy

Last updated: 30 September 2026

This Privacy Policy explains which personal data is processed when you use the GarageLog360 app for iPhone and iPad and the garagelog360.app website, for which purposes, who receives it and which rights data subjects have. It is based on the Swiss Federal Act on Data Protection (FADP) and, where applicable, takes the EU General Data Protection Regulation (GDPR) into account. The German version is authoritative.

Controller

Xvision Solutions
Mario Mueller
Waldhaus 5
3432 Lützelflüh
Switzerland
office@xvision.solutions

Principles

  • Data is only processed to the extent required for the features of GarageLog360.
  • GarageLog360 contains no advertising, does no tracking across other companies’ apps or websites and does not sell data.
  • Usage analytics is voluntary and only active with your consent.
  • App data is stored with Supabase in a project located in Zurich, Switzerland.

Data we process

Guest mode

You can use GarageLog360 without an account. For this, the app generates a random session identifier. Your vehicles and entries are stored on our server under this identifier, without a name or email address. If you sign in later, you can transfer this data to your account. If you reset the guest session in the app, the related data is also deleted on the server.

Account and sign-in

  • email address and password when signing in with email. The password is stored by the authentication service only as a cryptographic hash; we have no access to the password in plain text.
  • with “Sign in with Apple”, an identifier provided by Apple and the email address passed on by Apple, which may be a private relay address from Apple
  • user ID, session and sign-in information, and the times of registration and sign-in
  • first and last name, if you provide them, and an optional profile picture
  • app settings such as language and currency

The authentication service sends emails to the address on file to confirm the email address and to reset the password.

Vehicles and entries

  • vehicle data such as name, make, model, vehicle type, licence plate, vehicle identification number (VIN), country, odometer reading and consumption figures
  • fuel-up and expense entries with date, odometer reading, quantity, price, amount, category and notes
  • reminders with title, notes, date, repetition and status
  • photos, documents and attachments that you add to vehicles or reminders

Photos from the camera or the photo library are re-encoded before uploading; in the process, embedded metadata such as the location where the photo was taken is removed. Files that you add through the file picker are stored unchanged and may contain their own metadata.

Profile pictures and vehicle cover images are provided through public links: anyone who knows the link can retrieve the image. Other photos, documents and attachments are kept in private storage and are only accessible through short-lived signed links.

Vehicle sharing

With PRO, you can share a vehicle with other people. To do so, you enter their email address and the role (viewer or editor, optionally with access to costs). The invited person receives an email with your name and an invitation link; replies go to your email address. The members of a shared vehicle see the vehicle’s entries according to their role, as well as the name and email address of the other members. If you delete a vehicle you own, or your account, the vehicle is also deleted for all members.

Location and trip recording

  • Country when adding a vehicle: If you allow location access, the app determines the country from the device’s location and Apple’s geolocation service in order to suggest the country and currency. Without access, the device region is used, and you can select the country manually.
  • Trip recording: If you record a trip or turn on automatic recording, the app stores GPS coordinates, altitude, speed and times of the trip. For this, location access in the background is also used during an active recording. Automatic recording is turned off by default. You can export trips as a GPX file.
  • OBD adapter: With the OBD add-on, the app reads vehicle data via Bluetooth, such as engine speed, speed, coolant temperature, throttle position, engine load, fuel level and the vehicle identification number. The readings are stored with the trip.

Location data is only used for your own trips and statistics and is not passed on to third parties.

Exchange rates

To convert amounts, our server queries exchange rates from the Frankfurter API. Only the two currency codes are transmitted, no personal data.

Notifications

If you allow notifications, the app schedules reminders as local notifications in guest mode. With an account, reminders are delivered to your devices through the Apple Push Notification service (APNs). For this, we process a device token generated by Apple, a random device identifier, the app version and build, and the time of last use. The title and notes of the reminder are passed to Apple as the content of the notification. The device token is removed when you sign out. You can turn off notifications at any time in the iOS or iPadOS settings.

Purchases

PRO and the OBD add-on are offered through Apple In-App Purchase. Payment data is processed exclusively by Apple. We verify the purchase confirmation with Apple on the server and store the unlock status, the product, the expiry date and Apple’s transaction identifier, in guest mode linked to the session identifier.

Feedback and contact

If you write to us via the feedback in the app or the contact form on the website, we send your name, email address, subject, message and, optionally, device model, app version and language to us by email in order to answer your request. This information is not stored in a database.

If you add 20 or more vehicles, we store your email address, the number of vehicles, app version, device and language setting and are notified by email so that we can, where appropriate, make you a suitable offer for larger fleets. The notification is sent via Mailjet. You can object to this processing at any time.

Crash and error diagnostics

To detect and fix crashes and technical errors, GarageLog360 uses the Sentry service. When a crash or technical error occurs, the app sends a technical report, in particular the type of error, error code and technical error message, the affected area of the app, technical steps and preceding actions in the app before the error (for example “vehicle added”), technical categories such as vehicle type or sign-in method, device model, operating system, app version and build, and information on the stability of the app session (start, end, crash).

Reports contain no user ID. We do not knowingly transmit email addresses, vehicle identification numbers, licence plates or location data. Screenshots, screen recordings and recording of interactions are disabled. The IP address is technically used for the transmission but is not stored as part of the reports. Reports are stored in Sentry’s EU region (Germany) and deleted when the retention period expires, at the latest after 90 days.

Usage analytics with your consent

Usage analytics is turned off by default and only becomes active after your explicit consent. The app can be used without restriction without consent.

With your consent, we use PostHog to improve onboarding, adding vehicles and logging fuel-ups and expenses. Only predefined events are recorded, for example opening the app, onboarding steps and the start, cancellation and completion of adding a vehicle or an entry. When something is edited, only the type of field that was changed is transmitted, never the value entered. The events contain app version, build, language, user status (guest, Free or PRO), vehicle type as a category and yes/no values, but no user ID, email address, VIN, licence plate, location data, receipts or free-text entries. No personal profiles are created, and IP-based geolocation is disabled. A randomly generated installation identifier makes it possible to analyse events from the same installation together. The data is stored in PostHog’s EU region.

You can withdraw your consent at any time in Settings. After that, no further events are recorded, and events not yet transmitted are discarded.

Data on the device

The sign-in session, the guest mode session identifier, app settings, a cache for images and a snapshot of an ongoing trip for the widget are stored on the device. This data is removed when you delete the app.

Technical data

Technically necessary data is generated when the server is accessed, in particular IP address, time, requested function and error messages. The hosting provider logs this data to ensure operation and security.

Purposes

We process data to:

  • provide the app with or without an account and synchronise data between your devices
  • provide vehicles, entries, reminders, trips, statistics and exports
  • enable shared vehicles and invitations
  • deliver reminders, if notifications are allowed
  • verify purchases and unlock PRO and the OBD add-on
  • ensure secure and stable operation, prevent misuse, and detect and fix crashes and errors
  • analyse usage and improve the app, with your consent
  • answer requests and feedback
  • comply with legal obligations

Legal bases

Where the GDPR applies, we base processing on the following legal bases:

  • performance of the contract of use to provide the app’s features, including purchases and vehicle sharing (Art. 6(1)(b) GDPR)
  • legitimate interests in secure, stable and abuse-free operation, in crash and error diagnostics, in answering requests and in offers for fleets (Art. 6(1)(f) GDPR)
  • consent for usage analytics, location access and notifications (Art. 6(1)(a) GDPR)
  • compliance with legal obligations (Art. 6(1)(c) GDPR)

Under the FADP, processing takes place within the purposes stated above and in line with the principles of proportionality, purpose limitation and data security.

Recipients and processors

Personal data is only disclosed where this is necessary for operation, required by law or the data subject has consented. Service providers process data on our behalf and only for the agreed purposes.

  • Supabase, Inc. (USA) provides the database, authentication, file storage and server functions. The project is located in Zurich, Switzerland.
  • Apple Inc. (USA) or Apple Distribution International Ltd. (Ireland) for distribution through the App Store, in-app purchases, “Sign in with Apple”, geolocation and the delivery of notifications. Apple’s privacy policy also applies to these services.
  • Mailjet SAS (France) for sending invitation, feedback and contact emails.
  • Functional Software, Inc. (Sentry, USA) for crash and error diagnostics. Reports are stored in Sentry’s EU region (Germany).
  • PostHog, Inc. (USA) for usage analytics, only with your consent. The data is stored in PostHog’s EU region.
  • Other users see the data of a shared vehicle according to their role.
  • Authorities only receive data where there is a legal obligation.

Transfers abroad

App data is stored in Zurich, crash and error reports as well as analytics data in the EU. Some of the service providers named above are based in the USA or use sub-processors abroad, for example for operation, support or the delivery of notifications. Data is only disclosed to, or accessed from, a country without an adequate level of data protection if appropriate safeguards are in place, in particular certification under the Data Privacy Framework or standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) or the European Commission.

Retention and deletion

  • Data is stored for as long as your account or your guest session exists or until you delete it in the app.
  • You can delete your account at any time in the app under Settings. This deletes the account, your vehicles with all entries, trips, reminders, photos, documents and attachments, your profile picture and your device tokens. Vehicles that belong to you are also deleted for the people you have shared them with. An active subscription is not cancelled by this; cancel it in your Apple Account settings.
  • Invitations expire when their validity period ends.
  • We keep feedback and contact emails for as long as necessary to handle them and to meet legal obligations.
  • Crash and error reports are deleted after 90 days at the latest. Analytics data is deleted when PostHog’s retention period expires.
  • Deleted data may remain in backups until the hosting provider’s regular backup cycles expire and is then overwritten.
  • Statutory retention obligations remain reserved.

Data security

We take appropriate technical and organisational measures, in particular encrypted transmission (TLS), access rules at database level, role-based permissions for shared vehicles and private file storage with short-lived signed links, except for profile pictures and cover images. Absolute security cannot be guaranteed for electronic transmission and storage. Please therefore protect your sign-in details and unlocked devices.

Your rights

Within the scope of applicable law, you have the right to access, rectification, erasure, restriction of processing, objection and data portability. You can withdraw any consent given at any time with effect for the future; this does not affect the lawfulness of processing carried out before the withdrawal. Where processing is based on legitimate interests, you can object to it at any time on grounds relating to your particular situation.

Please send requests to office@xvision.solutions. To avoid disclosing data to unauthorised persons, we may ask for proof of identity.

You also have the right to lodge a complaint with a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC); in the EU, the supervisory authority in your place of residence.

Changes

This Privacy Policy may be updated if GarageLog360, the services used or legal requirements change. The version published in the app and on garagelog360.app applies. We will inform you of material changes in an appropriate manner.

Contact

If you have questions about data protection, contact us at office@xvision.solutions.

This website

The garagelog360.app website is provided as a static site through GitHub Pages by GitHub, Inc. (USA). When you visit it, GitHub processes technical data, including your IP address, in particular to keep the service secure. More information is available in the GitHub Privacy Statement. Where data is transferred to the USA, GitHub relies on certification under the Data Privacy Framework or on standard contractual clauses. The legal basis is our legitimate interest in providing the website securely (Art. 6(1)(f) GDPR).

The website sets no cookies, embeds no analytics, advertising or social media services and loads no fonts or scripts from third parties. Your choice of light or dark appearance is stored only in your browser’s local storage under garagelog360-site-theme and is not transmitted. You can remove this setting by clearing the website data.

The contact form sends your entries through a server function at Supabase to Mailjet, which delivers them to us by email; the information is not stored in a database. Alternatively, you can write to us directly at office@xvision.solutions.