Privacy policy

Last updated: 12 October 2026

Draft: to be reviewed by a lawyer before the app is launched. Remove this box when the text is approved.

1. Who are we?

Car Logbook is provided by Bukkøy AS, organisation no. 933209326 (Norway). We are the controller of the personal data described here. Contact us at support@carlogbook.no.

2. In short

You need an account to use the app: an e-mail address, or a code from the account owner if you are the second phone.
Your vehicles and their history are kept on your phone and as a copy on a secure server in Europe, so you can use them on two phones and do not lose them if the phone is lost.
We show no ads, use no tracking, and never sell information about you.
You can delete your account in the app at any time (here is how). The copy on the server is then deleted.

3. What do we store, and why?

What	Why	Legal basis
On your phone: vehicles, service and other history, odometer readings, costs, reminders and photos of receipts.	To make the app work, also without a connection. Photos of receipts are stored on your phone only.	Contract (GDPR art. 6(1)(b)).
Your e-mail address (the account owner's). You need an account to use the app.	To sign you in with a code sent by e-mail, without a password.	Contract (GDPR art. 6(1)(b)).
Copy on the server (all users): vehicles (name, make, model, year, plate, VIN, tyre size, insurer), events and notes, odometer readings, reminders and costs. Photos are not shared. The second phone has no e-mail address, only a random ID.	So you can use the app on two phones, and do not lose your data if the phone is lost.	Contract (art. 6(1)(b)).
Feedback you write in the app: the text (up to 100 characters), what it is about, app version, platform, language and a random device ID. Do not write personal data in the field.	To improve the app.	Consent: you send it yourself (art. 6(1)(a)).
Error reports, only if you said yes: the kind of error, a short technical description without names and numbers that could identify you, app version and platform.	To find and fix bugs.	Consent (art. 6(1)(a)). You can turn it off under Feedback in the app.
Technical data: IP address and time in the server's operating logs.	Security and troubleshooting.	Legitimate interest (art. 6(1)(f)).

[When payment is added: the subscription is bought from Apple or Google. We only learn that it is active and until when, not your card details.]

4. Who helps us? (processors)

Supabase stores the account and the copy of your data, and handles sign-in. The server is in Europe.
Resend sends the sign-in codes by e-mail.
[Apple and Google take payment for the subscription. This is added when payment is introduced.]

We have data processing agreements with the providers. Some of them are US companies. Transfers outside the EEA then rely on the EU Standard Contractual Clauses (SCC) or another valid basis.

5. How long do we keep it?

Account and data on the server: until you delete the account. Everything on the server is then deleted. Backups at the provider may exist for a short time more (up to 30 days).
When the subscription has expired: we keep your data for [12 months] so you can come back. It is then deleted. You can ask us to delete it sooner at any time.
Feedback and error reports: up to 24 months. They are not linked to your e-mail address.
Data on your phone: until you delete it or the app.

6. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection. You can do most of this yourself in the app. For the rest, write to support@carlogbook.no. You may also complain to the Norwegian Data Protection Authority, Datatilsynet.

7. Handing a vehicle to someone else

When you hand a vehicle to a buyer, the app makes a code containing the vehicle and the history you choose to share. You decide whether costs are included. Your insurer is never included in the code for the buyer. The code is not stored by us.

8. Security

All traffic between the app and the server is encrypted. The database has rules that make sure only your own account and the phone you have connected can see your data. Sign-in uses a one-time code by e-mail, and the code for the second phone is valid for 15 minutes and can be used only once.

9. Children

The app is not made for children under 13, and we do not knowingly collect information about them.

10. Changes

If we change this policy in a way that matters to you, we will tell you in the app. The date of the last update is at the top.