Privacy Policy

This Privacy Policy explains how DriveDTC ("DriveDTC", "we", "us" or "our") collects, uses and shares information when you use the Drive DTC app, the website at drivedtc.com, and related online services (together, the "Services"). By using the Services, you agree to this Privacy Policy and our Terms of Service. If you don't agree, please don't use the Services.

1. Information that stays on your computer

Live vehicle data, drive recordings, reports you save, and your garage (vehicles, saved checkups, maintenance, and any customer details you enter) are stored on your computer. They are not sent to us unless you use the cloud features described below. The app also keeps a crash log and your settings on your computer.

Your garage is encrypted on your own computer too. The garage files, and any photos and receipts you attach, are locked using Windows' own data protection, tied to the Windows account you sign in with. Another person using the same PC can't read them, and neither can anyone who obtains a copy of the files – from a backup, a cloud-synced Documents folder, or a lost or stolen computer. Reports you deliberately save or export are ordinary files, so that you can open and send them.

2. Information we collect

Account information

If you create an account, we store your email address, a securely hashed version of your password (we never see your actual password), and a record of which version of our Terms of Service and Privacy Policy you agreed to and when.

Usage details

When you use the app while signed in, we store when you last opened it, the app version, which plan the app reports, and the name and a scrambled identifier of each computer you use it on. We also keep a daily record that an account or licensed computer used the app, with the app version, for overall usage charts. Each account works on a limited number of computers; when you move your account to another computer, we record which computer was removed and when. We use this to operate, secure and support the Services and to enforce license limits.

Signed licenses

To confirm what your computer is entitled to, the app regularly asks our license server for a signed license. The request includes your computer's scrambled identifier, your license code (if any) and, when you're signed in, your account. The signed license lists your plan, brand packs and their end dates, and is stored on your computer so the app can keep working offline for a limited time.

Anonymous usage statistics (optional)

Usage statistics are off unless you turn them on in Settings. When they're on, the app sends the trouble codes a checkup finds, the vehicle's make and model year, whether connecting worked, and the names of your adapter and the vehicle's protocol. They don't include your VIN, account, computer identifier or location. To limit abuse, we store a scrambled (hashed) form of your network address with each report. We use these statistics, in aggregate, to decide which vehicles and adapters to support and to fix problems.

Cloud sync and share links (optional)

If you turn on cloud sync, we store your synced garage: vehicles (including VIN, year and nickname), saved checkups (trouble codes, readiness results, misfire counts, battery voltage and health score), maintenance records, and any customer name, phone number, email or notes you enter in shop mode. All of it is encrypted on your computer before it is uploaded, and we can't read any of it. Your account has one encryption key, which Drive DTC locks with your password and with a recovery key shown to you once. We only ever receive those locked copies, so the garage we store is unreadable to us, to our hosting provider and to anyone who obtains a copy of the database or its backups. It also means that if you forget your password and lose your recovery key, we cannot recover the synced copy for you – nobody can. The garage on your own computer is not affected.

A share link works the same way: the report is encrypted before it is uploaded, and the key that opens it is part of the link, after the #. Web browsers never send that part to a server, so we store a report we can't read, and only someone you give the whole link to can open it. We keep it until the link expires (at most 90 days). If you email a report to a customer from the app, the whole link – including the key – is in that email, so it also passes through our email provider.

License codes

If you activate a license code, we store which code was used, a one-way scrambled identifier for your computer (so a code works only on the number of computers it allows), your computer's name, the app version, the Terms version you agreed to, and when the code was activated and last checked. The app re-checks the code from time to time.

Vehicle confirmations

The first time a vehicle connects, Drive DTC asks you to confirm that you own it or have the owner's permission to scan it. When you confirm, we record it – but we do not store the VIN itself. We store a one-way scrambled form of it (a keyed fingerprint), its last 6 characters, its 3-character manufacturer code, the model year and whether its check digit adds up, together with the date and time, your account (if you're signed in) or license code, a scrambled identifier for your computer, the app version and the Terms version. That is enough for us to recognise the same vehicle again and to spot made-up VINs, and it means nobody – including us – can read a VIN out of our database. The app also keeps a list of confirmed VINs on your own computer so it doesn't ask again.

Vehicles covered by a license code

Brand packs on some license codes work on a limited number of vehicles. When such a code unlocks a brand pack on a vehicle, we store the same one-way fingerprint and last 6 characters described above – not the VIN – with the code, a scrambled identifier for your computer, and when the vehicle was first and last used.

Customer authorization (Shop)

In shop mode, the app records on your computer (and in your synced garage, if you use cloud sync) when you confirmed that a customer authorized a scan.

The Shop console (Shop)

The Shop console is the part of our website where a shop keeps its work: customers, vehicles, jobs, estimates, repair orders, invoices, appointments, parts, inspections and payments. What you enter there is stored on our servers so that everyone in your shop can work on the same records. That includes customer names, phone numbers, email and postal addresses and notes; vehicles, including the VIN, year, make, model, engine and mileage you enter; and the jobs and documents that belong to them. We also keep a record of who in your shop did what and when, which the people your shop has given that permission to – by default the owner, administrators and service managers – are able to see.

Unlike cloud sync, these records are not end-to-end encrypted. They travel over an encrypted connection, and the database lets members of your shop read them, each according to the permissions your shop has given that person, and lets a customer your shop has invited to the customer portal see their own vehicles, estimates and invoices. But they are held in a form we are technically able to read. We use them only to provide the console to your shop.

Known fixes (Shop, optional)

In the Shop console, a shop can record what fixed a trouble code on a job: the code, what was done, which part, and an optional note. These records belong to the shop, like the rest of its jobs, and the vehicle's year, make, model and engine are copied onto them from the job.

Sharing them with other shops is off unless the shop's owner or an administrator turns it on. When it is on, and once we have confirmed the shop's Shop plan, we count its fixes together with those of other confirmed shops that share, and show the result to shops that share. What is counted is the trouble code, the vehicle's make and model, what was done, and which part. The shop's name, the customer, the VIN, the year, the notes and who did the work are never included. A line is shown only when at least three other shops, with different owners, have recorded the same fix, and it says how many shops recorded it – not how many times, and not which shops. A shop can turn sharing off at any time, and its fixes stop being counted straight away.

Plans granted to your account

If we give your account Pro or Shop directly, we store the plan, its end date and an internal note.

Purchases, refunds and disputes

We keep internal notes about an account when needed to run the business – for example, a refund, a chargeback or payment dispute, or a warning about misuse – with the account's email address, the date and, where relevant, the amount. We use these records to handle refunds and disputes and to prevent fraud, as described in our Refund Policy.

Support messages

If you contact us from Help & support, we store your message, the email address you give (if any), the app version and, if "Include diagnostics" is on, technical details: Windows and app versions, adapter and connection details, the trouble codes from your last checkup, and recent adapter messages. Your VIN is not included in diagnostics. If you're signed in, the message is linked to your account so you can see our reply in the app.

Crash reports (optional)

Crash reports are off unless you turn them on in Settings. When they're on and the app crashes, it sends the app version, Windows version and the technical error. Crash reports are not linked to your account, don't include vehicle data, and have your Windows user name removed from file paths.

Launch list (optional)

If you sign up on our website to hear when Drive DTC launches, we store your email address, where you signed up, when you signed up and confirmed, and a scrambled (hashed) form of your network address to prevent spam sign-ups. We send one email to confirm, then only news about Drive DTC's launch and major updates. Every email has an unsubscribe link. If you sign up through a link from a shop or other partner, we record which link you used.

Emails to account holders

We may email people with a confirmed Drive DTC account about news and updates. Every such email has an unsubscribe link. We may also send automatic emails, such as a check-in a couple of weeks after you sign up or a reminder before a plan or license code ends; these have an unsubscribe link too. Service emails – such as account confirmation, password resets and replies to your support messages – aren't marketing and are sent while you have an account. We keep a record of the emails we send (the address, the type of email, and whether it was delivered) to operate and troubleshoot email.

Vehicle details and recalls

When the app reads your vehicle's VIN, it looks up the make, model and engine, and the safety recalls for that model, from the U.S. National Highway Traffic Safety Administration (NHTSA), a public government service. Only the VIN, or the make, model and year, is sent to NHTSA – not your account details. NHTSA's own privacy practices apply to those requests.

AI explanations (Pro, optional)

When you press Explain this on a checkup, the app sends that checkup to our server: the trouble codes and what the app calls them, the readings, the health score and the drive-or-don't verdict, and the vehicle's year, make, model and engine. Our server checks your plan using your account, your computer's scrambled identifier and, if you use one, your license code. It then passes the checkup – and only the checkup – to Anthropic, which provides the AI model, and sends the explanation back to you. Your VIN, your account, your computer's identifier, your license code and your location are never sent to Anthropic.

We keep a record of each request: your account, when it was made, the license code if one was used, how many trouble codes it had, how long the request and the answer were, and whether it worked. We use it to apply the daily limit and to see what the feature costs. We do not keep the checkup or the explanation.

Announcements and app settings

The app downloads announcements and app settings from our servers (for example, a notice that an update is available). This doesn't send personal information beyond what your internet connection normally reveals, such as your IP address.

Our website

Our website doesn't use advertising or analytics cookies. Like any website, our hosting providers receive technical information such as your IP address, browser type and the pages requested, which may be logged for security and to keep the Services running.

Microsoft Store purchases

Purchases of Drive DTC Pro or Shop are handled by Microsoft through the Microsoft Store. We don't receive your payment card details. Microsoft's privacy statement applies to those purchases.

3. How we use information

• To provide, operate and maintain the Services, including accounts, sync, share links and license codes.
• To respond to support requests and send service emails (such as account confirmation, password reset and support replies).
• To send launch news to people who asked for it.
• To enforce license limits and our Terms – including blocking accounts and turning off license codes that are misused – and to detect and prevent fraud, abuse and security problems.
• To understand problems and improve the Services.
• To comply with the law, enforce our Terms of Service, and protect the rights, property and safety of our users, DriveDTC and others.

4. How we share information

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We share information only as follows:

• Service providers that help us run the Services and may process information on our behalf: Supabase (database, accounts and hosting), Resend (email delivery), Netlify (website hosting), Sentry – Functional Software, Inc. (crash reports, only if you turn them on), Anthropic (AI explanations, only when you ask for one) and Microsoft (the Microsoft Store and payments).
• Public data services: NHTSA receives VINs or make, model and year for vehicle details and recall lookups, as described above.
• At your direction: for example, when you create a share link and give it to someone.
• Legal reasons: when we believe in good faith that disclosure is required by law, legal process or a government request, or is needed to protect rights, property or safety, or to investigate fraud or abuse.
• Business transfers: if DriveDTC is involved in a merger, acquisition, financing, reorganization or sale of assets, information may be transferred as part of that transaction.

Our admin tools show account emails, sign-up and last-seen dates, app versions, plans, license code use, and the number of vehicles and checkups – not the contents of your garage. Access to underlying data is limited to operating, securing and supporting the Services, or as required by law.

5. How long we keep information

• Account and synced data: while your account is active, or until you delete it.
• Share links: until they expire (at most 90 days).
• Records of AI explanation requests (who, when and how much – never the checkup or the explanation): as long as reasonably needed to apply the daily limit and to account for what the feature costs.
• Shop console records: while the shop exists. They belong to the shop rather than to one person's account, so deleting your own account does not delete a shop's records. Records a shop archives, voids or takes back are kept, marked as such, as part of the shop's history. A shop's owner can ask us to remove the shop and its records by emailing [email protected].
• License activation records and the vehicles a license code covers: while the license code exists.
• Vehicle confirmations: as long as reasonably needed for legal, safety and license purposes – including after you delete your cloud data or account.
• Support messages and crash reports: as long as reasonably needed to support and improve the Services.
• Computers used with an account, daily usage records, anonymous usage statistics and the email log: as long as reasonably needed to operate, secure and improve the Services.
• Blocked-account records: as long as reasonably needed to prevent abuse.
• Notes about refunds, chargebacks, disputes and misuse, and a record of the Terms version you agreed to: as long as reasonably needed for accounting, legal and dispute purposes – including after you delete your account.
• Our record of changes made by our own staff in the admin tools: as long as reasonably needed for security.
• Launch list: until you unsubscribe. We may keep a record that you unsubscribed so we don't email you again.

Backups and logs kept by our service providers may retain information for a limited time after deletion. We may also keep information when required by law or to resolve disputes and enforce our agreements.

6. Security

We use reasonable safeguards, including encrypted connections (HTTPS), hashed passwords, access controls that limit each account to its own records, and end-to-end encryption of your synced garage and shared reports (AES-256-GCM, with the key locked by a password stretched with PBKDF2-SHA256 and by your recovery key). Shop console records are protected by encrypted connections and by access controls that limit them to members of the shop; they are not end-to-end encrypted. However, no method of transmission or storage is completely secure, and we can't guarantee absolute security. You're responsible for keeping your password and license codes private and for the security of your own computer.

7. Your choices and rights

• Delete cloud data: in the app, open Account → Delete my cloud data to remove synced records, share links, support messages and usage details.
• Delete your account: in the app, open Account → Delete my account and type your email address to confirm, or email [email protected] from your account email address. This deletes your account, synced garage, share links and support messages. Records we keep after deletion are listed in section 5.
• Computers: in the app, open Account to see the computers using your account and move it to a new computer.
• Local data: delete the Drive DTC folders in your Documents and AppData folders, or uninstall the app.
• Emails: use the unsubscribe link in any launch email.
• Crash reports: turn them off in Settings at any time.

Depending on where you live (for example, in certain U.S. states), you may have rights to access, correct, delete or get a copy of your personal information, and to opt out of certain uses. To make a request, email [email protected]. We may need to verify your identity before responding, and we'll respond as required by applicable law. We won't discriminate against you for exercising your rights.

8. Shops entering customer information

If you use shop mode or the Shop console to record details about your customers, you are responsible for having their permission and a lawful reason to collect and store that information, for telling them how you use it, and for handling their requests about it. We process that information only to provide the Services to you.

9. Children

The Services are not directed to children under 13, and we don't knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we'll delete it.

10. Where information is processed

DriveDTC is based in the United States, and the Services are intended for users in the United States. Information is processed and stored in the United States and other places where our service providers operate. If you use the Services from outside the United States, you understand that your information will be transferred to and processed in the United States.

11. Changes to this policy

We may update this Privacy Policy from time to time. We'll change the date at the top, and for material changes we'll give notice in the app, on our website or by email, and may ask you to agree again. Continuing to use the Services after an update means you accept the updated policy.

12. Contact us

Questions or requests about privacy: [email protected]

See also our Terms of Service and Refund Policy.