Privacy Notice

Last updated 2026-09-08.

This notice is pending a final review by counsel. It is written to give real, honest visibility into what happens when you use GarageIntel, and it describes our current practice. Wording may be refined once that review is complete; any material change will be posted here with a new date. Questions: relias@garageintel.app.

This notice explains what GarageIntel (“we”, “us”) collects, why, who we share it with, and the choices you have. It covers garageintel.app and every feature on it, including Dock Intel.

1. What we collect

Category	Examples	Why
Search input	The VIN, HULL ID, Coast Guard official number, vessel name, or year/make/model you enter, plus filters (mileage, ZIP, intent).	To generate the report you asked for.
Account	Your email address and a hashed password (handled by Supabase Auth — we never see or store your raw password). Whether and when you accepted these terms.	To create and secure your account.
Payment	Handled entirely by Stripe. We store a Stripe customer / subscription ID and your subscription status — never a card number.	To run your membership and usage credit.
Usage on your account	Your usage-credit balance and ledger; the list of VINs you have searched (with the year/make/model and time); your Garage watches and any Flip Pipeline ledger entries you create.	To run the paid features and show you your own history.
Waitlist	If you join the founding-beta waitlist, the email address you submit and where on the site you submitted it.	To email you if a seat opens. You can ask us to remove it at any time.
Submissions	If you send feedback or submit a repair-cost or sale-price report, the content you provide and (for the crowd data) your account ID.	To improve the product and, for crowd data, to build aggregated medians. Crowd data is only ever shown in aggregate.
Security log	For a request that trips a rate limit or a security rule: the event type, which function it hit, the time, and the request’s IP address. Not linked to your account or your searches.	To investigate and prevent abuse.
Analytics	Raw event counts only (“a page was loaded”, “a checkout started”). No unique-visitor ID, no tracking cookie, no stored IP.	Basic “is this working” visibility.
Camera (optional)	If you use the in-browser VIN barcode scanner, the camera feed is processed on your device only. No image or video is uploaded or stored.	To read a VIN barcode without typing it.

Information about other people

A report can include information that public records associate with someone other than you — for example, a vehicle’s prior registration state, or, for a U.S. documented vessel, the managing owner. For an individual vessel owner, the U.S. Coast Guard already redacts the name and street address in the public file; on the free lookup we additionally withhold the owner’s postal code and show only city and state. Company owners are shown as published. If you are the subject of a record shown on GarageIntel and want it addressed, email relias@garageintel.app.

2. Third-party data providers

Building a report calls out to real third-party services:

MarketCheck — market value, factory build and specification data, marketplace listing history, and model-level market statistics for the exact vehicle you search. This is a live, per-search lookup: we don’t run searches on your behalf without you asking, we don’t build a standing archive of vehicle histories, and we don’t resell or redistribute this data (consistent with MarketCheck’s licence). Results are cached on our servers only briefly — up to about 24 hours — so generating or refreshing one report doesn’t trigger duplicate paid lookups.
NMVTIS — if you buy the title and odometer add-on, the National Motor Vehicle Title Information System supplies that report through an authorized provider.
NHTSA / EPA — free, public U.S. government data (recalls, safety ratings, fuel economy).
U.S. Coast Guard — the public documented-vessel file that powers Dock Intel.
Serper — web-search-derived value and parts-price estimates when a specific paid lookup isn’t available.
eBay — where configured, real parts listings for your vehicle.

We also use Stripe for payments, Supabase for authentication and our database, and Netlify for hosting. Each processes data on our behalf under its own terms. We do not sell your personal information, and we do not use third-party advertising or cross-site tracking.

3. How we use it

To provide the Service and the specific report or feature you request.
To run your account, membership, and usage credit, and to contact you about your account (for example a receipt, a failed payment, or a security notice).
To keep the Service secure and prevent abuse (rate limiting, fraud and chargeback handling).
To improve the product using aggregated, de-identified data.
To comply with law and enforce our Terms.

We do not use your searches or account data to make automated decisions that produce legal or similarly significant effects about you.

4. How long we keep it — and deleting it

Account and billing records are kept while your account is active and for a limited period afterward as required for tax, accounting, and dispute purposes. Search results are cached short-term (as above) and are not a permanent record tied to you.

You can delete your account yourself at any time from the account menu (“Delete account”). That immediately cancels any subscription and removes your account, your usage-credit balance and ledger, your saved search list, your Garage watches, any Flip Pipeline entries, and — if present — your waitlist email. Feedback and crowd submissions you made are retained in de-identified form (your account link is removed). Anonymous counts (“a page was loaded”) are not tied to you and are not removed. Backups roll off on their normal cycle.

5. Your choices and rights

Regardless of where you live, you can:

see the VINs on your account (the Recent Searches list) and your credit ledger in the app;
delete your account and its data yourself;
email relias@garageintel.app to ask for a copy of your account data, to correct it, or to have your waitlist email or a record about you removed.

California residents (CCPA/CPRA)

In the past 12 months we have collected the categories of personal information described in section 1 (identifiers such as email and IP; internet activity such as your searches; commercial information such as your subscription; and, if you use the scanner, no stored biometric or audiovisual data). We collect it from you directly and from the third-party data providers named above, for the business purposes in section 3. We do not sell your personal information and do not “share” it for cross-context behavioral advertising as those terms are defined under California law, and we have not done so in the past 12 months. We do not knowingly collect personal information from anyone under 16. California residents have the right to know, to delete, to correct, and to not be discriminated against for exercising these rights; exercise them using the contacts above. We will verify your request against your account email.

Other U.S. state privacy laws

Residents of states with comparable laws (for example Colorado, Connecticut, Virginia, Utah, Texas, Oregon) have similar rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, sale, and certain profiling. We do not conduct targeted advertising, sales, or such profiling. Use the contacts above; you may appeal a denied request by replying to our response.

If you are outside the United States

GarageIntel is operated from the United States and our providers (Stripe, Supabase, Netlify) may process data in the United States and other countries. If you are in the EEA or UK, our legal bases are performance of our contract with you (running your account and reports), our legitimate interests (securing the Service, preventing abuse, improving the product), consent (the optional camera scanner), and legal obligation. You may have rights to access, rectify, erase, restrict, port, or object to processing, and to lodge a complaint with your local supervisory authority. Contact us at the address above.

6. Cookies & local storage

If you sign in, a sign-in token is kept in your browser’s local storage so you stay signed in. It is not a tracking cookie and is sent only to GarageIntel’s own servers to verify your session.
A short-lived preference for light or dark theme, and small UI conveniences (a remembered tab, a collapsed panel).

We don’t use third-party advertising or analytics cookies. Our pageview counter records a page load with no cookie, no stored IP, and no device identifier. Our security and rate-limiting systems separately record the IP address of a request that trips a rate limit or a security rule, used only to investigate and block abuse.

7. Security

We use industry-standard measures: TLS everywhere, hashed passwords (via Supabase), row-level database security, a strict content security policy, rate limiting, and least-privilege access to production systems. No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by law.

8. Children

GarageIntel is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, email us and we will delete it.

9. Changes

We will post any update here with a new “last updated” date and, for a material change, note it in the app or by email.

10. Contact

GarageIntel — relias@garageintel.app.