Privacy Policy

DriveBunch is run by Diogo Soares, in Portugal. For anything in this policy, write to support@drivebunch.com.

Your email address — to create your account, to send you a sign-in code and to let you reset your password. If you sign in with Apple or Google, they give us your email address instead; with Apple's Hide My Email, that is a private address that forwards to yours. An email address is the only thing we require.

Sign in with Apple or Google — if you use it, Apple or Google gives us an account ID so you can sign in again, and your email address. Google also sends your name and a link to your Google profile picture; we keep them with your sign-in record and never show them to anyone. With Apple, we also keep a token so that deleting your account removes DriveBunch from your Apple ID. We never see your Apple or Google password. The sign-in itself is handled by Apple or Google under their own privacy policies. If you choose Google, Google's sign-in code in the app may also collect data for Google's own purposes, such as device information, usage data and approximate location, under Google's privacy policy. DriveBunch never receives it, and none of it is used to track you.

Your name, city and country — all optional, all editable, all skippable. We ask so the app can greet you and, if you join a community, so its members know who you are.

Your profile photo — optional. Stored privately; the app generates a temporary link each time it shows it to you.

Your garage — the cars you log, the rating you give each one, the date, any note you write, and any photos you attach. This is the point of the app.

Requests for missing cars — if you log a car we do not have, the text you typed is kept so the car can be added.

Your time zone — read from your device, not your location, so any time-based feature (like a notification) can reach you at a reasonable hour instead of ours.

Your push notification token — only if you turn notifications on. An opaque code Apple issues for your device so we can address a notification to it; it tells us nothing else about you. We use it to tell you when a car you logged has been identified or needs your help, when someone applies to a community you run or you are accepted into one, when members react to your cars (how many, never which reaction), and when a request to start a community is approved. At most one a day, never at night. We delete it the moment you sign out or Apple tells us it no longer works.

Communities — which communities you are in and your role, your applications (with the date and the exact wording you agreed to), your reactions, the people you block (only you see this list), and any request you make to start a community.

Reports — if you report something: what it was, the reason, and anything you wrote in “Tell us more”. Only the two founders read reports. The person you reported is never told who reported them or what you wrote.

Technical records — our hosting and database providers keep short-lived server logs that include IP addresses, which is ordinary for any website and is how abuse and outages get diagnosed.

Nothing, unless you join a community. When you apply, the screen lists exactly what becomes visible, and applying is your agreement. From then on, members of that community — and, while you are applying, its admins — see your driven cars (or, in a community about certain cars, only those that fit), ratings, photos and notes, including notes written before you joined, your username, first name, profile photo, city and country. When you are accepted, the community's feed shows a card saying you joined, with your three highest-rated cars from before you joined.

They never see your Dream Garage, your email, your time zone, the name you typed for a car still being identified, or anything about your notifications. Reactions show as counts, never who reacted.

Anyone signed in can search communities and see their name, description, size and admins’ usernames.

If you leave a community, are removed, or block someone, access ends immediately. Your data is not copied anywhere; it is only shown.

No analytics. No advertising. No tracking pixels, no third-party scripts, no advertising identifiers, no profiling.

No cookies. Not one. Staying signed in is handled by storage inside your own browser, not by a cookie sent to us.

No location. We never ask for it. Photos you upload are re-encoded in your browser before they are sent, which strips the embedded camera data — including GPS coordinates. The copy we receive has none.

No use of your push token beyond that. It is never used for tracking, advertising or analytics, and nothing correlates it across apps.

We do not sell, rent or share your data with anyone for their own purposes, and we never will. Community members see only what you agreed to show them.

Your account, your garage and your photos are processed to provide the service you asked for — the legal basis is performance of a contract.

Showing your garage to a community rests on your consent, given when you apply. You withdraw it by leaving the community or deleting your account.

Reports, blocks and moderation rest on our legitimate interest, and our duty, in keeping people safe.

Server logs and abuse prevention rest on our legitimate interest in keeping the service working and not being attacked.

A few suppliers process data on our behalf, and none of them may use it for anything else:

Supabase — the database, sign-in and file storage. Your data is held in the European Union.

Vercel — hosting for the website itself.

Resend — sends the sign-in and password emails, and sends each report and each request to start a community to the two founders. A report email includes the reporter’s words and a snapshot of what was reported, with links to its photos that expire after 7 days.

And if you email us — to ask a question or to have your account deleted — that message is handled by our email provider, Microsoft, and kept only as long as it takes to deal with what you wrote.

For as long as your account exists. When you delete your account, everything goes at once — profile, garage, notes, photos, avatar, memberships, applications, reactions, blocks and reports you made — with no backup copy kept and nothing recoverable afterwards. A community you run alone is handed over or deleted first; you choose which. If you signed in with Apple, deleting your account also tells Apple to remove DriveBunch's access to your Apple ID.

Report emails stay in the founders’ mailbox for as long as needed to deal with them and to recognise repeated abuse.

Guest accounts that were never given an email and have no cars are cleared out periodically.

Under the GDPR you can ask for a copy of your data, correct it, delete it, take it elsewhere, restrict what we do with it, or object to processing based on legitimate interest. Most of it you can do yourself in the app; for the rest, email us and we will answer within one month.

If you think we have handled your data badly you can complain to the Portuguese supervisory authority, the CNPD, or to the authority where you live.

Open your profile in the app and tap Delete account. It happens immediately and cannot be undone. Full instructions are on the delete account page.

DriveBunch is not intended for children under 16, and we do not knowingly collect anything from them. If you believe a child has created an account, tell us and we will remove it.

If this policy changes in a way that matters, we will say so in the app before the change takes effect. The date at the top always reflects the current version.