Privacy policy

Who is responsible

CarGeek is a reference and community site for automotive diagnostics, at cargeek.org. It is operated from the Netherlands, which means the EU General Data Protection Regulation applies to everything described here — for every visitor, wherever they are reading from.

To be completed: the legal name and address of the operator, and an email address for privacy requests. Until those are filled in this section is incomplete, and a policy without a named controller does not satisfy Article 13.

The supervisory authority is the Autoriteit Persoonsgegevens, and you can complain to it about anything on this page.

Reading the site

You do not need an account to read anything. Every trouble code, vehicle page, article and diagnosis on CarGeek is public and readable without signing in, and reading does not require you to give us anything.

Two things still happen when you load a page. Our server keeps a short-lived session record — an identifier, your IP address, your browser's user agent and the time — which is what makes forms and sign-in work. And our CDN, Cloudflare, processes your request in order to deliver the page and to block attacks.

We use Cloudflare Web Analytics to count page views. It was chosen deliberately: it sets no cookies, stores nothing on your device, and does not build a profile of you or follow you between sites.

We also use Google Analytics 4, to understand which parts of the reference are useful and which countries readers come from. Unlike the Cloudflare measurement above, this one does set a cookie on your device, and it sends Google the pages you view, an approximate location derived from your IP address, your device and browser type, and the site you arrived from.

Google truncates IP addresses before storing them. We have switched off Google Signals and ad personalisation, which are the settings that would otherwise let Google link your visit to a signed-in Google account or use it for advertising. We do not run advertising trackers, and we do not sell or share your data with advertisers.

Google acts as our processor for this and stores the data outside the European Economic Area; those transfers rely on the European Commission's standard contractual clauses. You can opt out of Google Analytics entirely in any browser with Google's own opt-out add-on, and most browsers' tracking protection blocks it as well.

Cookies

Three of these exist only to make the site work, and under the Dutch Telecommunicatiewet they do not require your consent:

• A session cookie, so the site knows one request from the next.
• A CSRF token cookie, which stops other sites submitting forms as you.
• A theme preference stored in your browser, so the site opens in light or dark as you left it. This never leaves your device.

One is not in that category and we would rather say so plainly than bury it: Google Analytics sets a measurement cookie, described in the section above. It is not an advertising cookie and it does not follow you to other sites, but it is analytics rather than strictly necessary, and we have not yet built a banner to ask you first. Until we do, the opt-out add-on linked above is how you decline it.

There is no advertising cookie and no cross-site tracking cookie.

If you describe a problem

The Diagnose page lets you type a fault in your own words. We record the sentence, the language, and how many codes it matched — with no account, IP address or identifier attached to it. We use it for one purpose: to find the phrasings the site fails to understand, so we can teach it those words.

Please do not type a registration number, VIN or anything identifying into that box. It is not needed to get an answer, and we would rather not hold it.

If you make an account

An account is only needed to contribute. Depending on how you sign up we hold:

• Your username and display name, which are public.
• An email address, a mobile number, or both. One of them must be confirmed before you can post. Neither is shown publicly.
• A password, stored only as a hash we cannot reverse.
• Anything you choose to add to your profile — a bio, headline, location, website, avatar and cover image, and if you present yourself as a professional, a shop name, years of experience, specialities and certifications. All of this is optional and all of it is public.
• Two-factor secrets and recovery codes, if you enable two-factor authentication.

If you sign in with Google, GitHub, X or Facebook, we receive your name, email address and profile picture from that provider to create or match your account. We do not post anything anywhere on your behalf.

If you sign in with a mobile number, we store the number, the time, and the IP address the request came from, and send a one-time code through an SMS operator. The IP is kept to limit abuse of the code-sending endpoint.

What you post

Posts, comments, photographs and documents you upload are public by design — the point of the site is that other people can find them. Your username appears with them.

Every uploaded image is decoded and re-encoded before it is stored, which removes the metadata a phone writes into a photograph — including the GPS coordinates of where it was taken. We do this because a picture of a fault is often taken on somebody's driveway.

We keep a record of edits to published posts and comments, so that a discussion cannot be silently rewritten under the replies to it. That history is not public; it is visible only to moderators reviewing a report.

Please do not upload documents containing registration numbers, VINs, addresses or other people's details. If you do, you can remove them, and you can ask us to.

Why we are allowed to hold it

• To provide the service you asked for — your account, your posts, signing you in. This is the contract between us.
• Because we have a legitimate interest — keeping the site up, preventing abuse and spam, moderating content, and counting page views in a way that does not identify you.
• Because the law requires it, where it does.

We do not sell your data, and we do not share it with advertisers.

Who else touches it

• Our hosting provider, which runs the server the site is on.
• Cloudflare, which delivers the site and provides the cookieless analytics.
• An SMS operator, if you sign in by mobile, to deliver your code.
• Google, GitHub, X or Facebook, only if you choose to sign in with them.

Some of these are outside the European Economic Area. Where that is so, transfers rely on the European Commission's standard contractual clauses.

How long we keep it

• Your account and your posts: until you delete them.
• Session records: a couple of hours after you stop browsing.
• One-time sign-in codes: kept briefly after use, because the limit on how many can be sent is counted from them.
• Diagnose queries: kept while they are useful for improving the matcher. They are not linked to you.
• Moderation records: kept while your account exists, so a decision about your content can be explained and appealed.

Deleting your account removes your profile and personal details. Content you posted is removed too, unless a discussion someone else took part in would be left unreadable, in which case it stays with your name detached from it.

Your rights

Under the GDPR you can ask us to:

• Show you what we hold about you, and give you a copy.
• Correct anything wrong.
• Delete your account and your data.
• Restrict or object to how we use it.
• Take it elsewhere, in a machine-readable form.

You can do the first three yourself from your account settings. For the rest, write to the address in the first section. We will answer within a month.

If you are not satisfied, you can complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority.

Children

CarGeek is not aimed at children and accounts are not intended for anyone under 16. If you believe a child has created an account, tell us and we will remove it.

Changes

If this policy changes in a way that affects you, the date at the top changes and the change is announced on the site. We will not start collecting something new under an old policy.