Privacy policy
What Behind The Badge collects when you use the website or the app, why, who else handles it, and how to have it changed or deleted.
Last updated
Who we are
Behind The Badge runs behindthebadge.io and the Behind The Badge app for iPhone and Android, and is responsible for the personal data described here (its controller, in the GDPR’s terms). For anything in this policy, email support@behindthebadge.io.
The short version
- You can look up a car without an account. We only know who you are if you sign in.
- Signing in, with Google or with Apple in the app, is only needed to comment.
- Comments are public. Everything else stays with us and the companies listed below.
- We don’t sell personal data, show ads or share it for advertising.
- You can delete your account, and your comments with it, yourself at any time.
What we collect, and why
The cars you look up
The registration or VIN you enter, and the vehicle details we find for it. We keep the vehicle details so the next lookup is quicker and to count lookups on the Stats page. They’re about the car, and aren’t stored against your account.
Why: to give you the result you asked for. Legal basis: our legitimate interest in running the service.
Your account
Signing in with Google gives us your name, email address, profile picture and Google account ID. Signing in with Apple gives us your Apple account ID and the email address Apple shares, which can be a private relay address, and your name if you choose to share it. We keep the sign-in tokens the provider issues, and for each signed-in session the IP address and the browser or device it began on.
Why: so you can comment under your name and stay signed in, and to spot misuse of an account. Legal basis: providing the account you asked for (contract), and our legitimate interest in keeping accounts secure.
Comments
What you write, any link you add, the car it’s about, when you posted it and your name. Anyone can read a comment. If you post anonymously, other people see “Anonymous” and can’t tell it’s yours, but we still know which account posted it, so we can deal with abuse.
Why: to publish what you post, and to moderate it. Legal basis: providing the service you asked for (contract), and our legitimate interest in keeping comments within the terms.
Reports
What you tell us is wrong with a vehicle record or a comment, which comment it was, and your account ID if you’re signed in. Reports go to the team, not to other users.
Why: to correct records and remove comments that break the rules. Legal basis: our legitimate interest in both.
Analytics
We use PostHog to see how the service is used, and only as far as you agree. The website asks first, and sends nothing until you answer.
- If you allow analytics cookies, PostHog records the pages you visit and what you do, such as looking up a registration (with the registration), signing in, or posting a comment or report. It also records visits: a replay of the page, your clicks and scrolls, with anything you type hidden. A cookie and your browser’s storage tell your visits apart, and if you sign in, your activity is linked to your account ID, never to your name or email address.
- If you say no, we still count visits, but without cookies. PostHog’s servers make a code from your IP address and browser that changes every day, which tells one visit from another that day without anything being stored on your device. There are no recordings, and nothing is linked to your account.
You can change your mind at any time with “Cookie choices” at the foot of every page.
The app asks too. If you allow it, it sends the same kinds of events, the screens you open and crash reports, with a random ID for the install kept on your phone, and nothing that links them to you or your account. If you don’t, it sends nothing. You can change your answer in the app’s settings.
Why: to find out what’s useful and fix what breaks. Legal basis: your consent, for analytics cookies, recordings and the app’s analytics; our legitimate interest, for counting visits without cookies.
Server logs and security
Our servers log each request: when it was, what was asked for (such as a registration) and, for something done while signed in, your account ID, but never your name or email address. Vercel, which hosts the service, also logs IP addresses, and its firewall and our rate limits count requests from each IP address to stop abuse.
Why: to keep the service secure and working, and to investigate faults. Legal basis: our legitimate interest in both.
On your device
On the website, your recent searches, light or dark theme and the people you’ve blocked are kept in your browser’s storage and never sent to us. Signing in sets a cookie that keeps you signed in, which the site needs to work. The app keeps your recent searches on your phone and your sign-in in the phone’s secure storage. If you allow analytics, PostHog’s cookie (on the website) or install ID (in the app) is kept too. Whatever you answer about analytics is remembered, so we don’t ask again.
The cars you save to My cars, with your private notes, reminders and the mileage from an ad, stay on the device too, in the browser on the website and on the phone in the app, and are never sent to us. In the app, reminders are notifications your phone schedules itself, and the plate scanner reads the photo on your phone, without uploading it or keeping it.
Emails to us
If you email us, we keep the email and our reply for as long as we need them to deal with what you asked.
Legal basis: our legitimate interest in answering you.
Who else handles it
Companies that work for us
- Vercel hosts the website and the app’s server, with its firewall.
- Neon runs our database: accounts, comments, reports and vehicle records.
- PostHog provides the analytics and session recordings.
- Rapid7 stores our server logs.
- Discord carries the team’s alerts about new lookups, comments (with the commenter’s name, even on an anonymous one) and reports.
They can only use the data to provide their service to us.
Sign-in providers
Google and Apple handle signing in, under their own privacy policies. We get only what’s listed above.
Where vehicle details come from
Our servers send the registration, or the VIN you enter, to motorcheck.ie and motortax.ie for Irish vehicles and to the DVSA’s MOT history service for UK ones. They get nothing about you.
Link icons
A link in a comment shows the website’s icon, which your browser loads from Google’s favicon service. Google sees your IP address and the linked site’s address.
The law
We’ll pass data to the Gardaí or other authorities only when the law requires us to.
Where it’s kept
Our database is in London, and the European Commission recognises UK data protection as adequate. PostHog and Rapid7 keep our data in the EU. Vercel, Discord, Google and Apple are US companies, so some data is processed in the US. Where it is, the transfer is covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
How long we keep it
- Your account: until you delete it.
- Comments: until you delete them, we remove them, or you delete your account. A comment you delete disappears straight away, but we keep a hidden copy for moderation until your account is deleted.
- Signed-in sessions: they end after a week without use, or when you sign out.
- Reports: as long as they help keep the records right. Deleting your account takes your ID off them.
- Server logs and analytics: deleted automatically after a fixed period.
- Vehicle records: kept, since they’re about cars rather than people.
Your rights
You can ask for a copy of your data, and ask us to correct it, delete it, limit what we do with it or send it to you in a form you can take elsewhere. You can also object to anything we do on the basis of our legitimate interests. Email support@behindthebadge.io and we’ll answer within a month.
Deleting your account you can do yourself: on the website from your account menu or on the delete your account page, or in the app from your account. It removes your account and every comment you’ve posted, there and then. Reports stay, with nothing linking them to you. To have your analytics removed too, email us.
If you’re unhappy with how we’ve handled your data, you can complain to the Data Protection Commission at dataprotection.ie.
Children
Behind The Badge isn’t for children: you need to be 16 or over to create an account. If you think a child has signed up, tell us and we’ll delete the account.
Changes to this policy
When this policy changes, we’ll update it here and change the date at the top. If a change affects how we use your data, we’ll make it clear on the website and in the app first.
Contact
Questions, requests or complaints about your data: support@behindthebadge.io.