Privacy policy

If you create an account: your name, email address, and — if you sign up with a password rather than Google — a securely hashed (never plain-text) version of your password. If you sign in with Google, we store Google's account identifier for your account, not your Google password. This is used to let you log in, verify your email address, and reset a forgotten password.

Session and security data: when you're logged in, we store a session token, the IP address and browser/device string associated with that login, and timestamps. This is used to keep you logged in, let you sign out of a specific device, and detect abuse (e.g. credential-stuffing attempts).

Report history ("My Pages" / Mina Sidor): if you're logged in when you generate a report, we record which vehicle/report it was and when, so you can find it again later. Reports themselves are not personal data about you — they're research output about a vehicle.

Vehicle and listing data: when you paste a Blocket link or enter a Swedish registration number, we fetch the public listing and — where available — registry information about that vehicle (via car.info and biluppgifter.se) to build the report. A registration number can reveal information about a vehicle's current registered keeper, who is very likely someone other than you, the visitor generating the report; we only use this to build the report you asked for and to detect inconsistencies between a listing and the registry (a common scam pattern), never to build a profile of that third party.

Feedback and flagged reports: if you use the feedback widget or flag a report as wrong, we store your message and, if you chose to provide one, a contact email — only used to follow up on that specific submission.

Cookies: a session cookie (keeps you logged in), a language-preference cookie, and a short-lived cookie used only during the Google sign-in handshake to prevent cross-site request forgery. All three are strictly necessary for the site to function and aren't used for advertising or cross-site tracking, so we don't run a separate cookie-consent banner for them.

We use a small number of service providers ("subprocessors") to run Car Advisor. Each only receives the data it needs to do its job:

• Supabase (database hosting) — stores account, session, and report data.
• Vercel (application hosting) — runs the site and processes requests, including your IP address.
• Upstash (Redis caching) — supports rate limiting and short-lived caches.
• Google — if you choose "Continue with Google", Google authenticates you and shares your name/email with us; see Google's own privacy policy for how they handle that.
• Cloudflare (Turnstile) — a bot-detection check on registration/login forms, which sees your IP address during that check.
• Anthropic — the AI provider that generates the narrative parts of a report. It receives listing and registry details about the vehicle, not your account information.
• An email provider (SMTP) — sends verification, password-reset, and welcome emails to the address you registered with.

We don't sell your data, and we don't use it for advertising.

Account, session, and token data is kept for as long as your account exists, and removed (see "Your choices" below) if you delete your account. We do not currently enforce an automatic deletion schedule on report or vehicle data beyond that — this is an area we're actively working on, and this page will be updated once a defined retention period is in place.

You can update your account details, set or change your password, and see which login methods are linked to your account from your account settings page. You can permanently delete your account (and everything tied to it — sessions, login methods, your report history) from that same page at any time; the vehicle reports themselves stay reachable by their original link, since they're shared, cached research output about a vehicle, not personal data belonging to your account.

For anything else — access to a copy of your data, a correction, or a question about this policy — reach us via the feedback link in the site footer, or at info@caradvisor.nu.

If this policy changes materially, we'll update the date at the top of this page. Continuing to use Car Advisor after a change means you accept the updated policy.