Privacy policy

Last updated: October 2026

Track2Drive is a free web app that helps you keep track of your car's maintenance, documents and running costs. This policy explains what personal data we process, why, who helps us do it, and the rights you have.

1. Who is responsible for your data

The controller of your personal data is:

• Balazs Megyeri
• NIE: Z1196770Q
• Carrer Montsant 5, 08107 Martorelles (Barcelona), Spain
• Email: hello@track2drive.com

For any question about your data or this policy, write to hello@track2drive.com.

2. What data we process, and why

Your account

• What: email address, password (stored only as a secure hash by our authentication provider; we never see it), optional display name, country, and preferences (currency, distance unit, date format, language, email reminder setting, cost-data sharing setting).
• Why: to create and run your account and show the app in your units and currency.
• Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR).

What you enter about your cars

• What: car details: make, model, year, powertrain, transmission, nickname, photo; mileage readings and maintenance settings; service history, parts and costs, and receipts you upload; Glovebox documents such as insurance or inspection, with expiry dates, costs and the files you upload; expenses.
• Why: this is the core of the service. We use it to calculate what maintenance is due, when, and roughly what it will cost.
• Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR).

We don't ask for your number plate or your vehicle identification number (VIN). Please don't upload documents that contain more personal data than you need to. For example, crop or cover the details you don't want stored.

Sharing anonymised cost data (optional, off by default)

• If you switch this on at signup or in Settings, we may in future use the costs you record, stripped of anything that identifies you or your car, to improve cost estimates for everyone.
• This feature isn't active yet. Nothing is shared today.
• Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in Settings.

Email we send you

• What: account emails (confirming your address, resetting your password, confirming an email change, and security notices when your password or email changes).
• Legal basis: performance of our agreement and our legitimate interest in keeping your account secure (Art. 6(1)(b) and (f) GDPR).
• Maintenance reminders: Settings lets you choose whether you want maintenance reminder emails. Reminders aren't sent yet. When they are, we'll only send them if that setting is on.

When you contact us

• What: if you use the contact form or write to hello@track2drive.com, we receive your name (if given), email address, subject and message. The form also notes whether you were signed in and your language.
• Why: to reply to you. Contact messages are emailed to us and aren't stored in the app's database.
• Legal basis: our legitimate interest in answering your request (Art. 6(1)(f) GDPR).

Security and abuse prevention

• What: Cloudflare Turnstile checks that forms (sign-up, sign-in, password reset, some account settings and the contact form) are used by a person and not a bot. To do this, Cloudflare processes technical information such as your IP address and browser characteristics.
• Server logs: our hosting and database providers keep short-lived technical logs (for example IP addresses and request times) to operate and secure the service.
• Legal basis: our legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR).

We don't use your data for advertising, we don't sell it, and we don't build profiles about you.

3. Cookies

Track2Drive uses only strictly necessary cookies, for example to keep you signed in and to protect forms against abuse. We don't use analytics, advertising or tracking cookies. Because of this, we don't show a cookie consent banner. If we ever add non-essential cookies, we'll ask for your consent first.

4. Who processes data for us

We use a small number of service providers (processors) that process data only on our instructions:

Some of these providers are companies based in the United States, or may access data from outside the European Economic Area. Where personal data is transferred outside the EEA, it's protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, as provided in each provider's data processing terms.

We may also disclose data where the law requires it, for example to a court or a public authority.

5. How long we keep data

• Your account and everything in it: until you delete your account. Deleting your account (Settings → Delete account) immediately and permanently removes your profile, cars, history, documents, expenses and all uploaded files. Our providers may keep technical backups for a limited period, after which they're overwritten.
• Contact messages: as long as needed to handle your request, and no longer than 24 months.
• Technical logs: for the short periods set by our providers.

6. Your rights

You can, at any time:

• access your data, and get a copy. Settings → Export gives you a readable PDF and a machine-readable JSON file;
• correct it. Most data can be edited directly in the app;
• delete it. Settings → Delete account removes everything;
• restrict or object to certain processing;
• port your data to another service (the JSON export);
• withdraw consent where processing is based on consent (the cost-data setting), without affecting what was done before.

To exercise a right that the app doesn't cover directly, write to hello@track2drive.com. We'll reply within one month.

If you think we've handled your data unlawfully, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the data protection authority where you live.

7. Age

Track2Drive is intended for people aged 18 and over. We don't knowingly process data of anyone younger.

8. Security

• Your data is protected by encrypted connections (HTTPS).
• Each account can only ever read its own data, which the database enforces.
• Uploaded files are private and are only reachable through short-lived links.
• No system is perfectly secure. If a breach affects your data, we'll inform you and the authorities as the law requires.

9. Changes to this policy

If we change this policy, we'll update the date above. If the change is significant, we'll tell you by email or in the app before it takes effect.