A public website.
Your own private garage.

Your sign-in

Underhood supports ChatGPT sign-in and, when enabled, email/password and Google accounts through Google Firebase Authentication. ChatGPT provides an account identifier, email address, and optional display name. Email signup sends your name, email, and password securely to Firebase through Underhood; Underhood does not save your password in its database or logs. Firebase manages password storage, email verification, and password-reset messages. Email access requires verification. A secure, HttpOnly cookie keeps your sign-in token; Firebase sessions expire after one hour. Google sign-in uses Google’s account chooser and shares your account identifier, email, and display name with Firebase and Underhood. The Firebase browser session is kept in memory and cleared after sign-in; Underhood does not store browser refresh tokens. Firebase may recognize Google and email/password as the same Firebase account under its account-linking rules. A ChatGPT login is connected only when you explicitly prove access to both accounts. Matching email addresses alone never combines garages. Underhood never asks for your ChatGPT password.

What is stored

The app saves the vehicle details, VIN if entered, mileage, service and repair history, fuel purchases, gallons, station names, running expenses, payment dates, cost breakdowns, notes, reminder intervals, shop follow-ups, warranty providers, contract numbers, coverage notes and dates, and document information you provide. Uploaded receipts, photos, and manuals are stored separately from their descriptions. Household sharing also stores membership identifiers, member and invitation email addresses, invitation expiry dates, hashed invitation tokens, your selected garage, and whether you choose an RV-focused, vehicle-focused, or combined garage view. The original receipt and manual-page scanners run on your device. Separately, the optional AI assistant sends the text or photo you explicitly choose to OpenAI, as described below. Structured records use Cloudflare D1 and uploaded files use Cloudflare R2 through the Sites hosting platform.

Account administration and terms

Underhood stores account identifiers, name and email when provided, observed login methods, account and garage access status, recorded signup dates, and recent app activity. Existing historical dates that were never collected remain unknown. App activity timestamps are updated at most every 15 minutes to measure active use. Complimentary access stores the selected plan, grant date, operator note, and conversion-trial dates when applicable. Complimentary invitations store the invited email, a hash of the private token, expiration, and acceptance status. The operator can review these grants and invitations. We also store the Terms of Service version, acceptance time, login method, and acceptance method. We do not collect a separate IP address or device fingerprint for terms acceptance.

The owner-only admin dashboard shows account and aggregate usage information, including counts of vehicles, RVs, services, fuel purchases, files, and stored file sizes. It does not provide a customer-receipt viewer or browse individual service notes. Authorized administration can suspend users or garages and permanently remove app data. Reasons and actions are kept in an administrative audit log. To improve onboarding, we record the garage, UTC date, action category, and first and last successful save times for vehicle, service, receipt, reminder, mileage, fuel, and expense actions. This measures household adoption and return use without copying record contents into analytics. These activity records are removed when the garage is cleared or the account is permanently deleted. Help, feedback, and account requests save your selected category, topic, and submitted text for the owner to review; avoid including sensitive documents or passwords.

Permanent account deletion removes active garage records and uploaded files, household memberships, notification preferences, and account-request messages. Limited identity mappings and access-blocking identifiers prevent a deleted account from reopening through a connected login. Terms acceptance, necessary billing references, and audit records may be retained for security, consent, and legal purposes. Deleting an Underhood account does not delete an external Google, Firebase Authentication, or ChatGPT identity. We do not silently reactivate a suspended or deleted account when it signs in again.

Vehicle autofill

Choosing Fill details from VIN sends that VIN to the US National Highway Traffic Safety Administration (NHTSA) through Underhood to retrieve available vehicle identification details. Entering a year and make requests matching models from NHTSA. These lookups do not send your name, email, receipts, or service history. Suggestions for services, shops, stations, and suppliers come from records in your currently selected garage and common service names. Lookup results stay in the form until you save the vehicle.

Optional email and schedule services

Email preferences are stored per person and garage, including the signed-in email address, opt-in choices, and snooze date. Opted-in garage reminders and summaries are sent through Resend; that provider receives your email address and message contents, including vehicle names and due work. Delivery attempts keep a copy of the message to avoid duplicate sends. You can turn emails off in Account or through an unsubscribe link. Removing household access stops future reminder access to that garage.

VIN schedule lookup is awaiting a vehicle-data connection. When you choose to use it after connection, the vehicle VIN is sent to Vehicle Databases. Returned mileage schedules and vehicle identity are cached for up to 30 days between lookups. Daily lookup usage counters are kept separately from vehicles to enforce the request limit, including after a vehicle is removed. Neither this lookup nor email delivery sends your receipt files to those providers.

Optional AI assistant and recall checks

When you submit an AI question after agreeing in the assistant, Underhood sends OpenAI your question, the recent conversation in that panel, and the selected vehicle configuration. Questions about your records also include that vehicle’s saved service history, reminders, notes, follow-ups, warranty notes, and calculated costs. Saved VINs, account identifiers, emails, and warranty contract numbers are excluded from this context. Code and shop searches use your question and vehicle configuration without automatically including private service records. Local shop research includes the city or ZIP you provide and uses web search. Text you type and photos you choose may contain personal details: cover unnecessary details, including VINs, before submitting. Photo metadata is removed during browser resizing. The existing local receipt scanner remains available.

When you choose to build an AI maintenance plan, Underhood sends the vehicle configuration and driving use to OpenAI and uses web research to prepare recurring service intervals. It searches manufacturer sources first and may use named automotive references to create clearly labeled estimates when an exact manufacturer interval cannot be verified. Missing reminders are automatically added to your Service Plan; existing reminders are not replaced, and no completed-service date or mileage is invented. You can edit or remove every added reminder. Research results are cached for up to 90 days; model-level NHTSA recall results are cached for up to 24 hours. NHTSA recall checks send only year, make, and model. A VIN-specific check takes you to NHTSA, where you choose what to enter. AI requests use OpenAI’s store:false setting; provider operational and abuse-monitoring retention may still apply. Underhood does not save chat transcripts as garage records. Conversation drafts remain in the current panel until it is reset; closing the page loses them. Other AI-created records remain drafts until you review and save them. Daily usage counts enforce request limits. AI can make errors and does not certify roadworthiness, establish warranty coverage, or replace inspection by a qualified technician.

Who can view your garage

The home and help pages are public. Garage records, reports, and document downloads require sign-in and are checked against the current owner’s account. Other users can access your garage only if you explicitly invite them to your household. Accepted members can view and edit garage records and download files. You can remove their access in Account. An invitation is tied to the recipient’s sign-in email and expires after seven days. This is access-controlled storage, not end-to-end encryption; site operators and hosting providers may have administrative access needed to operate the service.

Your exports and deletions

Use Reports to download a vehicle report, running-cost summary, costs CSV, or service-history CSV. Account offers a JSON export of all your structured garage data and a list of your documents. You can download original files separately or together with a vehicle report in a ZIP. Calendar exports contain vehicle names, service titles, dates, and notes; your calendar provider handles the file after you import it. You can remove individual entries or vehicles, or permanently clear your garage in Account. Clearing your garage removes the app’s active records and uploaded files. Hosting-provider backups and operational logs may follow their own retention periods.

Removing a service, fuel purchase, or running expense keeps its receipts in the vehicle’s Files area. Removing a vehicle or clearing the whole garage also removes its receipts. Files and reports you already downloaded remain on your device.

Payments and tracking

Stripe processes subscription payments and billing-portal requests. Underhood sends Stripe your account email, an internal garage identifier, and your selected plan. Stripe collects payment details on its checkout pages; Underhood does not store full card numbers. We store Stripe customer, subscription, checkout, and event identifiers, subscription status, plan, billing-period dates, and cancellation status to manage access and prevent duplicate processing. Stripe handles payment information under its own privacy policy, available at stripe.com/privacy. The 30-day free trial requires no card and does not automatically charge you when it ends. Invitation links are private; share them only with the intended household member. The app stores a hash of each invitation token.

Underhood uses first-party analytics across public and signed-in pages. Random visitor and session identifiers measure page views, sessions, broad referral and campaign information, selected calls to action, signup and email-verification progress, product activation, return use, AI plan outcomes, trial milestones, and subscription events. UTM source, medium, campaign, content, and term values in a link may be retained with the original account acquisition. The owner dashboard can display an email address entered during an incomplete signup so the operator can understand pending verification; Firebase reports that a verification request was accepted but does not confirm inbox delivery. Underhood does not store passwords, card numbers, authentication tokens, API keys, AI prompts, VINs, service notes, or uploaded document contents in analytics. Raw IP addresses are not saved in these analytics records. Analytics events and sessions may be retained for up to 400 days for retention and year-over-year reporting and are cleaned up as new events arrive. Account and billing records follow the separate retention practices described above.

Underhood also uses Google Analytics to understand visits and navigation across the website. Google Analytics may receive page addresses, referral sources, interaction events, approximate location derived from network information, browser and device details, and identifiers stored by Google in the browser. Underhood does not send names, email addresses, VINs, receipt contents, service notes, or AI prompts to Google Analytics. Advertising personalization and Google signals are disabled. Both first-party analytics and Google Analytics are skipped when your browser sends a Do Not Track or Global Privacy Control signal. Google handles Analytics information under its own privacy policy at policies.google.com/privacy, and its retention follows the settings in Underhood’s Google Analytics account. To limit abusive sign-in attempts, Underhood temporarily stores counters keyed by hashed email addresses and network addresses. The hosting and sign-in providers may use their own cookies and operational logs to run their services.

Teenagers and family accounts

Garage owners and subscribers must be 18 or older. Members aged 13–17 may use only a parent or legal guardian’s Family garage with permission. We store the declared age group, guardian permission on the invitation and membership, and consent records; we do not ask for a full birth date. The guardian can remove access in Account. We do not permit children under 13 to use Underhood. If you believe a child under 13 has supplied information, email isaacm1986@gmail.com so we can investigate and remove it as appropriate.

Contact and privacy requests

Email isaacm1986@gmail.com to request access, correction, or deletion of your information, or to ask a privacy question. We may verify your identity before acting. We use information to provide the service, support accounts, process billing, protect security, and meet legal obligations. We do not sell your personal information or share it for targeted advertising. We retain active records while needed for your account and limited billing, consent, and security records where necessary after deletion.

Keeping useful records

Only upload documents you want stored with your vehicle. You can leave your VIN blank and cover unnecessary personal details on a receipt before uploading it. Review exported reports before sharing them, and keep original copies of paperwork you need.