Privacy

WheelHarness (wheelharness.com and the WheelHarness phone and TV apps) is a garage for your vehicles: what you own, what's due, what you've done to it, your trips, and the friends you drive with. It's run by its owner, Maxim, from Alberta, Canada.

Your data is stored in Canada, on a server in Beauharnois, Quebec. If you live in the US or elsewhere, your data is still stored and handled in Canada. We follow Canada's federal privacy law (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).

To check: the legal name of the business (sole proprietor or company) and that Alberta PIPA applies; whether to name Maxim. From 17 to 23 October 2026 the site ran on an OVH server in Singapore, which still holds a copy until it's cancelled (around 17 November): say so here, or wipe it first.

Only what you give us or what the app records while you use it:

• Your account:email, name, a scrambled (hashed) password (never the password itself), and, if you use them, your Google or Apple sign-in id. Optionally a phone number, your postal code's first three characters (we turn it into a rough area), and your units (km/litres or miles/gallons) and currency. To run your account and show things near you.
• Your vehicles: make, model, year, VIN, nickname, photos, cartoon pictures and 3D models made from your photos, documents (insurance and registration photos, which can show your home address), mods, gear, and when they come due.
• What you log: maintenance, fuel fill-ups, meter readings and meter photos, notes, once-over inspections, battery-monitor readings, and your chats with the AI mechanic (with their photos).
• Trips from the phone app: for each trip, when it started and ended, the distance, top and average speed, braking, cornering and lean forces, and which Bluetooth device started it. Not the route: trips are kept as a summary, without GPS points. A route is only kept if you save it yourself (Saved trips); then we keep its points so you can see and share it, and you can hide its start and end.
• Dyno pulls: the speed and engine readings of each pull, with positions removed on your phone before upload.
• Crash reportsyou fill in after a crash: what happened, where, photos, and the other driver's details (name, phone, licence, insurer, policy, plate) and witnesses. These are about other people, so they're private to your vehicle: you and the people you share the vehicle with.
• Selling and buying: your for-sale ads and parts, and the messages and photos you exchange with buyers and sellers; orders (with a ship-to address) if you buy parts.
• Bring-Along:what you send (description, size, photos), pickup and drop-off addresses, the recipient's name and phone or email, and the driver's planned route. Your friends, and their friends, see an item you send with its pickup and drop-off towns.
• Stolen-vehicle reports and the tips people send about them.
• Searches and clicks: what you search for in the parts shop and which shop links you tap, so we know what parts people need.
• Feedbackyou send from the bottom of any page, with your name and email if you're signed in.
• Corrections: when you tell the AI a figure we showed was wrong, we log the correction (with a short piece of the chat) so we can fix it for everyone with that model.

Most of WheelHarness is private to you. These parts are meant to be seen:

• For-sale ads(vehicles and parts): the photos, your ad text, a rough area, and the vehicle's maintenance history (dates and meter readings; never costs, private notes or the VIN). Anyone can open them and search engines can find them.
• Stolen-vehicle posters: the vehicle, its photos, the VIN, where and when it was last seen, your description, a reward, and your phone number only if you add one. Public and findable on purpose.
• Links you share:a read-only link for your mechanic, a saved trip's link, a TV screen link. Anyone holding the link can open it until you turn it off.
• Cartoon picturesof your vehicles can be opened by anyone who has the picture's address (they show on your ads, to friends and in messages). Your real photos, documents and meter photos can't: they need you, or someone you shared the vehicle with, signed in.

We use these services to run WheelHarness. Each gets only what it needs for its job.

Some services only see that our server exists, nothing about you: UptimeRobot (checks the site is up) and the Bank of Canada (exchange rates).

Card payments for parts, when they're offered, go through Stripe; we never see your card number. We'd share data with police or a court only when the law requires it.

To check: Gemini: if the API key is on Google's free tier, Google's terms let it use what's sent to improve its products and have people review it. Either move to a paid tier or say so here. Firebase push: is FIREBASE_SERVICE_ACCOUNT set on the server? If not, drop that card until it is. Stripe and Sign in with Apple aren't switched on yet.

Much of the AI runs on our own computer: reading meter photos, VIN photos, documents, scale tickets, crash-report photos (including the other driver's licence and insurance), part photos, voice-message transcripts, and the daily friend roast. Those never leave our own hardware.

Some answers need a bigger model, and those go to Google Gemini or Anthropic Claude (what each one gets is listed above). We send the vehicle and the question, not who you are. What an AI says is a draft: you check it and decide what gets saved.

• During a trip the app uses GPS to measure the distance and show the map. The trip is kept as a summary, without the route (see above).
• Maps, navigation and address searchrun on our own server, from open map data. Where you search for and where you navigate to aren't saved on the server; your home and recent places stay on your phone.
• Sharing your location with a friend only starts when you tap it (or allow their request), for 15 minutes to 8 hours. We keep only your latest point, and delete it when your last share ends, you unfriend, or you sign out.
• Bring-Along:a trip you post shows its from and to towns to your friends, and while you carry someone's item, its sender and recipient see your live position until the drop.
• Weather and voice use your location rounded to about 1 km.

The app asks Android for these, and uses them only for:

• Location, including in the background: trips, the Cockpit, location sharing you turned on.
• Bluetooth and physical activity:starting and ending trips by themselves (your vehicle's Bluetooth, a battery monitor, walking away).
• Microphone: voice messages and talking to Claude, only when you tap.
• Camera: photos you take.
• Notification access:Android ties reading what's playing (song, artist, app) to this switch. The app reads only that; it doesn't read or keep your notifications.
• Display over other apps: the Cockpit bubble.

Your Cockpit layout and app settings are backed up to your account so a new phone can restore them.

Only friends who accepted your invite see anything. They see your name, your phone number if you added one, your vehicles' cartoon pictures, and, while you drive: that you're driving and in what, the song you're playing and whether you're on a call, and your speed. They also see your daily roast.

These are on unless you turn them off: Show me as driving, Share my music, Share my speed and Let friends roast me. Friends never see where you are unless you share your location.

Voice messages are kept 7 days, then deleted with their transcript. Songs you burn to a friend (title and artist) stay in their Bootleg list until they remove them.

To check: the CREW switches are all ON by default (showDriving, shareMusic, shareSpeed, allowRoast, allowIntros, shareMonth). Fine for a friends app, but say it plainly or flip some to off.

Send diagnostics (on your Account page and in the app's Trip settings) lets the app send its troubleshooting log, with your phone model and app version, so we can fix bugs. Any location in it is rounded to about 1 km first. The log can include the VIN and engine readings from the OBD reader. It's on by default; you can turn it off there any time. Logs are deleted after 30 days.

With it on, the app also sends possible-crash readings: a short stretch (seconds, up to a few minutes) of motion-sensor and speed readings around a hard knock or a moment you mark, with no position. We keep them until we've reviewed them, to make crash detection better.

To check: "until reviewed" has no deadline in the code (no prune for CrashCandidate). Consider a fixed limit (e.g. 1 year) or delete once labelled.

The owner runs WheelHarness and can see account details, usage counts, feedback, search logs, diagnostics and crash readings, so the site can be fixed and run.

For troubleshooting, the owner can also switch on a full view of riders' garages (chats, notes, private photos and VINs). It's off normally, and every vehicle opened in it is written to a log.

To check: the FULL garage viewer covers every rider, not just testers, and the /hq setting says "tell your testers". Decide the promise: e.g. "only with your permission" (then restrict it) or this wording. Also check what mode prod is in today.

• Your account, garage, logs, chats, trips and saved trips: until you delete them or your account.
• Voice messages: 7 days.
• Diagnostics logs: 30 days. Possible-crash readings: until reviewed.
• Photos sent to read a VIN, a scale ticket or a manual page: a copy is kept 30 days so we can fix misreads.
• Dyno pull logs you didn't keep: 30 days.
• Engine logs (OBD datalogs): until you delete them. Each vehicle keeps your newest 50 (a log you mark Keep stays); a deleted one is gone for good after a day.
• Battery-monitor readings: full detail for 90 days, then thinned to one every 10 minutes; daily summaries stay.
• Claude connector usage (which tool, when, no content): 90 days.
• Unfinished 3D model photo sets: 7 days.
• Your shared location: only the latest point, deleted when the share ends.
• The song you're playing and your speed: replaced every few seconds, cleared when you stop.
• Backups: 14 days on our server, 60 days on Google Drive. So something you delete can stay in a backup for up to 60 days.
• Parts searches, shop-link clicks, feedback and AI-correction logs: kept, without a set limit.

To check: retention gaps with no limit: crash readings, ShopSearch, OutboundClick, Feedback, DataIssue, AuditLog, TvPairing (stores an IP), mechanic chats. And the home computer's frozen copy of the database from the 2026-10-23 move is used for development and testing, with real riders' data in it, kept indefinitely.

• Switches on your Account page and in the app: email reminders, Send diagnostics, and the CREW sharing switches. Reminder emails have an unsubscribe link.
• Download my dataon your Account page: your vehicles, maintenance, fuel fill-ups, notes, documents and meter readings as spreadsheet files. For anything else (photos, chats, trips), email us and we'll send it.
• Correct it:you can edit or delete almost everything you've logged, yourself.
• Delete my account(bottom of the Account page) deletes your vehicles and everything on them, photos, chats, trips, friends, shares, sign-ins and connected apps, and takes down your ads and stolen posters. What stays, without your name or email: messages you sent to other people (shown as "Deleted user", so their threads still make sense), records of sales and orders, work you logged on someone else's vehicle (that's their history), and your past parts searches. A note that an account was deleted stays in our admin log.
• Questions or complaints:email us. If we can't settle it, you can contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.

To check: the CSV download leaves out trips, saved trips, photos, chats, CREW and crash reports, so "email us" is the promise for the rest. Fine for PIPEDA if you answer within 30 days.

We use only the cookies the site needs: one to keep you signed in (30 days), short-lived ones during Google or Apple sign-in, and, if you aren't signed in, one that remembers the postal area you typed (1 year). No advertising or tracking cookies. The site and app also save a few things on your device so they work offline (your vehicles' specs, schedules and crash guide); signing out clears them.

Everything travels encrypted (HTTPS). Passwords are stored hashed. The server only accepts logins by key, and the link between the server and our own computer is a private, encrypted network. Private photos are only served to people allowed to see them. No system is perfect: if something of yours is exposed, we'll tell you and the Privacy Commissioner as the law requires.

To check: backups on Google Drive are plain (not encrypted with rclone crypt). Consider encrypting them.

WheelHarness isn't meant for children, and we don't knowingly collect their data.

To check: there is no age rule anywhere in the code (sign-up asks no age). Pick one (13+ or 16+, or 18+ given Bring-Along and selling) and add it to sign-up / terms.

When we change what we collect or who sees it, we update this page and the date at the top. Big changes are also announced on What's new.

Questions, a copy of your data, or a correction: [email protected].

To check: [email protected] is the From address on our emails (MAIL_FROM). Make sure someone reads it, or change CONTACT.