Garajım — Privacy Policy

Last updated: 2026-08-28

Garajım (“the app”) helps you track your vehicle documents and their expiry dates, record the trips you ride, and ride together with friends on a live map. This policy explains what data the app collects, why, and how it is handled. The service is operated by the app’s owner on self-hosted infrastructure.

Most people use Garajım on their own. You can also share a vehicle, or a whole garage, with other people — a partner, your family, or your mechanic. If you do, Sharing a vehicle with other people explains exactly what they can and cannot see.

Separately, some people use Garajım as a member of a company’s organization — a business that runs a fleet or rents vehicles out. If that is you, everything below still applies, and Organizations and company vehicles explains what is different, including what your employer can see.

What we collect

We do not collect advertising identifiers, contacts, or browsing activity, and we do not use third-party analytics or advertising SDKs.

Location data

Location is optional. The app asks for it only when you use a feature that needs it, and it works without it — you can still track documents, expiry dates, and maintenance. You can revoke the permission at any time in iOS Settings.

Your location is used only for these features. It is never used for advertising and never sold. It is not shared with anyone other than the ride members you deliberately ride with and — for a trip recorded on a company vehicle — the organization that vehicle belongs to.

Sharing a vehicle with other people

You can share a vehicle — or a shared garage holding several vehicles — with other people. Nothing is shared unless you deliberately do it: you send an invitation to a specific email address, we email the invitation to that address, and the other person has to accept it. You can remove them, or stop sharing the vehicle, at any time. See Notifications about sharing for what that email contains.

There are two levels, and the difference between them is the whole point.

Guest — for a mechanic, a service, or a friend borrowing the vehicle. They can see and update the vehicle’s own facts:

A guest cannot see your trips or the routes you drove, your fuel purchases, or any document you scanned against that vehicle. They cannot rename the vehicle, change its plate, delete it, or share it onward. They see only the vehicles in the garage you shared with them — never the rest of your account.

Member — for a partner or family, when you are genuinely sharing a garage. Everything a guest sees, plus the trips recorded on those vehicles (including routes), the fuel purchases logged against them, and the documents scanned against them. Please read that sentence before you invite somebody as a member: it means they can see where those vehicles were driven and what was spent on them. A member still cannot delete a vehicle or manage who else is in the garage.

Neither level ever exposes your other vehicles, and neither ever exposes anything in your account outside the shared garage.

What the other person contributes. A vehicle that you put into a shared garage still belongs to you — you remain the person it is billed to, and you can take it back out at any time, which immediately ends everyone else’s access to it. If somebody leaves a shared garage, any vehicle of their own goes with them.

Duplicate vehicles. The same real vehicle cannot be recorded twice: we match on the chassis (VIN) and engine numbers. If you add a vehicle that somebody else is already keeping records for, we tell you that the vehicle is already tracked and let you either ask for access or say that you bought it — and we tell you nothing else. Not who holds it, not their name or email address, not the vehicle’s nickname, plate, or anything else about it. We deliberately do not match on plate numbers, both because Turkish plates are reassigned to different vehicles over time and because a plate is something a stranger can read off a bumper. If you send such a request, the current holder sees your name, your email address and the short note you wrote, so that they can decide. They are never told anything about you otherwise, and you are never told anything about them — including in the notifications either of you receives about it, which are described under Notifications about sharing.

Notifications about sharing

Sharing activity sends notifications, because all of it is somebody waiting on somebody else. Specifically:

These notifications say as little as the rest of the feature does. A request shown to you names your own vehicle but not the person asking — their name, address and note are on the decision screen inside the app, behind your passcode, rather than on your lock screen. An answer sent back to you repeats only the chassis or engine number you typed: nothing about the vehicle, and nothing about the person who answered, whether they said yes or no.

An invitation email is deliberately almost empty. It says that somebody has invited you to a shared garage, and it carries the link. It does not name the garage, the vehicles in it, or the person inviting you — because until the link is opened and signed into, all we know about that address is that somebody typed it. The name of the garage, how many vehicles are in it and exactly what you would be able to see are shown after you sign in with that address, which is where the decision to join actually gets made. If an invitation reaches you by mistake, ignoring it is enough: nothing has been shared with you and no account has been created.

How long we keep it. We keep a record that a notification was sent — who it went to, which event it was about and when — so that a retry cannot deliver the same message twice and so that invitation emails can be rate-limited. Those records are deleted after 90 days. For an invited address that never became an account, that deletion is the only thing that removes it, so it is not optional: we do not keep invited addresses indefinitely.

Ownership handover: what happens when a vehicle changes hands

If a vehicle is sold, its record can move to the new owner — either because the current holder hands it over, or because they approve a request from the buyer. It only ever happens when the current holder agrees. There is no automatic transfer: if nobody answers a request, nothing happens to the vehicle, and the person who asked can start a separate record of their own instead.

A handover moves the facts about the vehicle, and nothing about the person.

Transfers to the new owner:

Stays with the previous owner, and is never shown to the new owner:

Those records move to an archived copy of the vehicle in the previous owner’s own garage, so they keep them and can still read them; the new owner cannot see them and is never given any reference to them.

Why the split is drawn there. A scanned Turkish ruhsat carries the previous owner’s T.C. kimlik number, name and home address. A trip log is everywhere they drove. A fuel log is what they spent, and where. None of that is information about the car, and handing it to whoever bought the car would be a disclosure of personal data with no lawful basis under KVKK/GDPR. The service history is different: it is a fact about the vehicle, and it is the reason this feature exists. There is no setting that changes this.

Organizations and company vehicles

An organization is a company account: a fleet operator whose vehicles are driven by its people, or a rental business whose vehicles go out to customers. Organizations are set up for a company by the operator of this service. You are in one only because somebody at that company added you — it cannot happen by accident, and nothing in the app puts you in one.

Membership changes exactly one thing: the company’s vehicles are shared. Your own garage is untouched. Your personal vehicles, their documents, and the trips you record on them stay yours and are never visible to any organization, even one you are a member of.

What the organization can see. For each vehicle that belongs to it, the organization’s owner, managers and office staff can see everything recorded against that vehicle, whoever recorded it:

This means your employer can see where a company vehicle went, when, and who was driving it. We are not going to dress that up. It is there because a fleet has to account for its vehicles’ mileage, costs and compliance — but it is monitoring of employees, so it has limits, and these are they:

Who is responsible for it. The organization decides that it wants these records and what it does with them, so for everything on its vehicles the organization is the data controller (KVKK: veri sorumlusu) and we are its processor (veri işleyen) — we host the data and act on the organization’s instructions, and we do not use it for any purpose of our own. Your employer is responsible for telling you that company vehicles are tracked, for having a lawful basis for doing so, and for how long it keeps the records. If you cannot get an answer from them, write to us at the address below and we will help.

Information an organization holds about other people

A rental business using Garajım records the people it rents vehicles to: name, phone number, email address, whatever it chooses to write in the notes field, and the rental contracts themselves — dates, handover and return odometer, and the agreed rate. Those people are usually not users of this app, and we have no relationship with them.

That information is the organization’s, in the sense that matters legally: it decides which customers to record, what to record about them, and how long to keep them. The organization is the data controller; we host the data as its processor and use it for nothing else — never for marketing, never for analytics, and never shared with anyone.

How it is deleted. The organization can delete a customer from inside the app; doing so erases that customer’s record and every rental contract attached to it. Deleting the organization erases all of its customers at once. If you have rented a vehicle from a business that uses Garajım and you want your details removed, ask that business — they can do it themselves, immediately. You can also write to us at the address below and we will pass the request on and act on it as far as we are permitted to.

How your document images are processed

Date and field extraction (OCR) runs on the operator’s own server infrastructure. Document images are not sent to third-party AI/advertising services for this purpose.

Usage analytics

The app sends a small batch of usage events to our own server — no third-party analytics product is involved and nothing leaves our infrastructure. An event is a short name plus a few aggregate numbers (for example the rounded distance of a logged trip) and an app-session identifier. We do not put coordinates, routes, plate numbers, or document contents in these events, and we do not use them to build an advertising or cross-site profile.

How we use your data

We do not sell your data or share it with third parties for marketing.

Third-party services

Data retention & deletion

Your data is retained while your account is active. In the app you can delete individual vehicles, documents, dated records, and trips — deleting a trip removes its route from the server. Live group-ride positions are never stored, so there is nothing to delete.

You can delete your entire account from inside the app: Settings → Delete account. This permanently removes your account and everything attached to it — vehicles, documents and their uploaded images, dated and maintenance records, trips and their routes, fuel logs, ride memberships, notification tokens, purchase records, and usage events. It cannot be undone. If you would rather not do it yourself, email us at the address below and we will remove it for you.

If you are a member of an organization, deleting your account removes you: your account, your personal vehicles and everything on them, your memberships, and your vehicle assignments. The company’s own records — its vehicles, their documents, their service history, and the trips recorded on them — stay with the organization, because they are the company’s and not yours; wherever such a record still carried your name, it is handed to another member of the organization, so your identifier does not survive in it. If you were the last remaining member, the organization and everything in it is deleted along with you.

If you have shared vehicles, deleting your account removes them along with everything else of yours, and the people you shared with lose access to them at the same moment. If a vehicle of yours was handed over to somebody else before that, it is theirs and stays with them — but only ever with the facts listed under Ownership handover; your trips, fuel logs and documents were never given to them and are deleted with your account.

Records an organization holds about its own customers are deleted by that organization — see Information an organization holds about other people.

Security

Data is transmitted over HTTPS and stored on access-controlled infrastructure. Sessions use secure, signed cookies.

Children

The app is not directed at children under 13 and does not knowingly collect their data.

Changes

We may update this policy; the “last updated” date above reflects the latest revision.

Contact

Questions or deletion requests: [email protected]