Legal

Privacy policy

Effective 27 October 2026 · See also the terms of use

VirtualPitstop (“the app”, “we”) is made and run by Iwan Koster, who can be reached at info@virtualpitstopapp.com. This policy explains what happens to your information when you use the app and this website.

Information stored on your device

• Profile: the name, username, bio, city, country and photos you enter.
• Spots: photos of cars you spot, the car you selected, the date, and the location you add or allow the app to fill in.
• Garage: the cars you add, with their details, photos, modifications and build updates.
• Places: photo locations and routes you add or save, with their location and photo.

This information stays in the app's private storage on your device. Without an account it is not uploaded to us or to anyone else. With an account, it is also kept in your private backup, and what you share to the community is stored on our server (see below). Every account on a device has its own set of this information; what you added without an account is added to the first account you log in with. It is removed from the device when you choose Delete all data in the app or delete the app.

Community account (optional)

When you create an account we store:

• Account details: your e-mail address and a securely hashed password. Your e-mail is used to log in, to confirm your account and to reset your password. It is never shown to other members. If you use Sign in with Apple, Apple tells us a fixed account code and the e-mail address you choose to share (with “Hide My Email” this is a private relay address from Apple that forwards to you), and, the first time only, your name if you share it; there is no password. To disconnect your account from your Apple ID when you delete it (as Apple requires), we also keep a token from Apple until then. We also keep a member number: the order in which accounts were made (the first 1000 see “Founding member” on their own profile).
• Public profile: your username, name, bio, city, country, profile and cover photo, whether your account and garage are public or for friends only, and the counts of your spots, cars, garage and places.
• Your showcase on your profile: your garage (up to 30 cars, current and previously owned, with make, model, year, engine, power, fuel, colour, transmission, edition, the years you owned them, the main photo and up to 10 more photos), your collection progress (how many cars you spotted per rarity and for your top manufacturers) and your Dex (which cars you spotted, their rarity and the date of your first spot, without places or photos). The app keeps this up to date while you are logged in. Your Dex and progress are visible to the people who may see your account (everyone for a public account, accepted followers for a private one); who sees your garage follows your choice of everyone or friends only.
• What you share: posts (photos, videos of up to 30 seconds with a still frame, captions, and for photo locations the place and its map position; spots are shared with the place name only), likes, comments, and who you added as a friend.
• Number plates (optional): when you add the plate of a car you spotted, it is stored with that spot on the server, apart from the post. It is never shown on the post or to other members; a member who types exactly that full plate finds the spot (only spots they may see anyway), so an owner can find spots of their car. A plate you add to a car in your own garage stays on your device and in your private backup. An owner who added their plate to a car in their garage sees the spots of that plate in the app, and can repost a spot of a public account to their own feed: the repost shows the spotter's photo and username, never the plate or the place, and the spotter gets a notification. Owners can switch on “Hide my car from plate search” for a car in their garage: then nobody else finds spots by that plate. For this we only keep a one-way code of the plate (a SHA-256 hash), never the plate itself. Owners who want a spot of their car removed can also report it or e-mail us.
• Spot alerts (optional): the models, makes and spotters you follow (at most 10) and, per alert, the area you chose. For an alert “near me” we keep your position rounded to a square of about 10 km, taken once when you choose it. When you share a spot, your phone also sends its country and a square of about 10 km, stored apart from the post and never shown to anyone; it is only used to send alerts to people who follow that car, make or spotter and may see your post. A spot with “Don't share the location” sends no area.
• Your car, spotted (optional): when you switch on “Tell me when my car is spotted” for a car in your garage, we keep only a one-way code of its plate (a SHA-256 hash), never the plate itself, so you can get a notification when a public spot carries it.
• Safety: reports you file and accounts you block.
• Notifications (only if you allow them): a push token for your phone, so likes, comments and new followers can reach you, and which of these you want. The token is removed when you log out or delete your account.
• Your backup: a copy of the information stored on your device (spots with their photo, car, date and location, your garage, your places and routes, and your settings), so it comes back when you log in on another device. It is private: only you can read it, through your own log-in; it is never shown to other members and its photos have no public web address. It is on by default with an account; Profile → settings (the gear) → “Back up to your account” turns it off and deletes the copy from the server.

A public account's posts can be seen by every member; a private account's posts only by friends you accept. Photo locations and routes you share with a location also appear on the map of the people who follow you. The data is stored with our hosting provider Supabase, on servers in the European Union (Ireland). Shared photos and videos are stored as files on the same servers. The app shows them through links that expire after a few hours and that are only given to people who may see the post (or the garage); after the app update 1.1 has reached everyone, the files can no longer be opened in any other way. Backup photos are different: they can only be downloaded with your own log-in. We keep these data as long as your account exists.

Deleting your account: Profile → settings (the gear) → Delete account removes your account, profile, posts, photos, likes, comments, friends and backup from the server. Your data on the device is not affected. No longer have the app? E-mail info@virtualpitstopapp.com from the address of your account and we delete everything within 30 days.

Moderation: reported posts are reviewed within 24 hours. Content that breaks the community rules is hidden or removed, and accounts that break them may be suspended or removed; a suspended account cannot log in and is hidden from others. When we act on your post, comment or account, you get a short message in Activity with the reason, and you can ask us to look again by e-mail. When you report something, you get a short message with what we decided, never the name of the person or the reason. We keep a record of each decision (what, when and by which moderator) to handle questions and repeated abuse.

Permissions

• Camera: used only when you take a photo in the app, or when you scan a friend's profile code. Scanning happens on your phone; no camera images are stored or sent.
• Photos: used only when you choose a photo to add to a spot, car, place or your profile.
• Location (while using the app): used to fill in where you spotted a car, to search for places and to show your position on the map. Your location is not stored unless you save it with a spot or place. It reaches us when you share a photo location or route to the feed (spots are shared with the place name only, and you can choose not to share a location at all), and, with an account, in your private backup unless you turn the backup off.
• Notifications: asked once, after your first post or follower. Without your permission no notifications are sent; which ones you get can be changed in the app.

You can change these permissions at any time in your iPhone's Settings.

Services the app connects to

• Vehicle catalog: the app downloads a public list of car makes and models from the jsDelivr content delivery network (source: the vehicle-makes-models dataset, ODbL 1.0). This request contains no personal information, but, like any internet request, jsDelivr can see your device's IP address.
• Maps and place search: on iPhone, the map is provided by Apple Maps, and the place names you type in a search are looked up by Apple's location service, both under Apple's privacy policy.
• Route files: a GPX file you upload for a route is read on your phone; only the simplified route line is kept with the route.
• Community server: accounts, posts, photos and backups are handled by Supabase (supabase.com) on our behalf.
• Sign in with Apple (optional): when you continue with Apple, Apple confirms who you are to us under Apple's privacy policy. Deleting your account also ends the connection with your Apple ID.
• Push notifications: sent through Expo's push service (expo.dev, 650 Industries, United States) and Apple's push notification service. A notification contains the username of the person who reacted and, for a comment, its first 120 characters; a spot alert contains the spotter's username, the car and, unless they chose not to share it, the place name.
• “Car missing?”: the make, model and year you fill in are sent anonymously, without your name, username or e-mail address, as an e-mail to us through our web host (mijn.host). Your device's IP address is only used, as a scrambled code kept for one hour, to limit abuse.
• “Business on VirtualPitstop”: if you register your business's interest in a place on the map, the business name, kind of business, town and the e-mail address or Instagram name you fill in are sent as an e-mail to us through our web host (mijn.host). This only happens after you tick that we may contact you, and we only use it to contact you about business listings (legal basis: your consent, which you can withdraw at any time by e-mailing us). We delete the e-mail on request, and at the latest one year after you sent it. Your device's IP address is only used, as a scrambled code kept for one hour, to limit abuse.

Launch list (this website)

If you join the launch list on this website, we store your e-mail address and the date you signed up, with Supabase in the European Union. We use it for two e-mails only: a thank-you right after you sign up, and one when VirtualPitstop is available in the App Store. Both are sent from info@virtualpitstopapp.com through our web host. We delete the list after the launch e-mail is sent. You can ask us to remove your address earlier at info@virtualpitstopapp.com.

This website

Cookies: neither the app nor this website uses cookies, analytics or third-party trackers, so there is nothing to consent to and no cookie banner. The fonts are served from this website itself. Our web host keeps standard server logs (such as IP addresses) for security, as web servers do.

Legal bases

• Your account, posts, likes, comments, friends and backup: needed to provide the community and the backup you sign up for (performance of a contract, GDPR art. 6(1)(b)). You can turn the backup off at any time.
• Security, rate limits, server logs and handling reports: our legitimate interest in keeping VirtualPitstop safe and free of abuse (art. 6(1)(f)).
• The launch list: your consent when you sign up (art. 6(1)(a)); you can withdraw it at any time.

Cars you spot: photos of cars in public places can show a number plate or a person, which can be personal data. Sharing spots rests on the legitimate interest of car enthusiasts in sharing cars they see, balanced by our rules: no recognisable people, and blur or crop number plates when you can. Spots in the feed show a place name, never exact coordinates, and photos are shared without location data. If a photo shows you or your plate, report it in the app or e-mail us and we remove it.

Who processes data for us: Supabase (database, log-in and photo storage, servers in the EU; Supabase is a US company, and transfers are covered by its data processing agreement with the EU Standard Contractual Clauses), mijn.host (this website and our e-mail, the Netherlands), Apple (App Store, Apple Maps and place search) and GitHub (a weekly copy of the community database for disaster recovery, encrypted with a key only we hold, so GitHub cannot read it; kept for 90 days). We have processing agreements with them where the law requires it.

Your rights

You can ask us for a copy of your data, to correct it or to delete it, and you can object to how we use it. E-mail info@virtualpitstopapp.com. If you are in the European Union, you also have the right to complain to your data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens).

Children

You must be 16 or older to create a community account. Without an account, nothing about you leaves your phone. VirtualPitstop is not directed at children and does not knowingly collect information from anyone under 16; if you believe a child has made an account, e-mail us and we delete it.

Changes

If this policy changes, the updated version will be published on this page with a new effective date.

Contact

VirtualPitstop is made and run by Iwan Koster, who is responsible for your data. Questions about privacy? E-mail info@virtualpitstopapp.com. This address is also our single point of contact for users and authorities under the EU Digital Services Act; we reply in English or Dutch. You can also complain to the Dutch data protection authority (Autoriteit Persoonsgegevens).