Privacy Policy

This policy explains what MileMinder collects, why, and what you can do about it. MileMinder is a mileage tracker for people on lease, UK PCP and mileage-limited insurance agreements, operated by Jack Bishop, based in the United Kingdom. For the purposes of UK GDPR, Jack Bishop is the data controller for the information described below, and can be reached at hello@jackbishop.co.

What we collect

Account information

• Your email address — it identifies your account, and is where password resets and mileage alerts are sent.
• Your password, stored only as a bcrypt hash. We never store, log or have any way to read your actual password.
• The date your account was created.

Vehicle and agreement information

Only what you choose to enter:

• A name for each vehicle.
• Optionally, the vehicle's registration number. This is free-text and entirely optional — MileMinder works without it, and you can leave it blank or remove it at any time.
• Odometer readings you record, each with the date you assign to it. Together these form a dated history of how far the vehicle has travelled.
• Where you set up an allowance, the details of your agreement: start and end dates, annual mileage allowance, starting mileage, and the excess-mileage rate.

MileMinder does not track your location. It has no access to your phone's GPS, no connection to your vehicle, and no journey or route data. It only knows the odometer numbers you type in.

Preferences

• Your currency and distance-unit settings.
• Your alert settings — whether alerts are on, and the threshold you chose.

Technical information

When you sign in we set a single cookie, mm_session, holding a random session token. It is marked HttpOnly (so page scripts cannot read it), SameSite=Lax, and Secure over HTTPS. It lasts 30 days, or until you sign out.

That is the only cookie MileMinder sets. There are no analytics, no tracking pixels, no advertising cookies and no third-party scripts of any kind. Because the session cookie is strictly necessary to sign you in, no cookie consent banner is required.

Messages you send us

If you use the contact form, we receive the name, email address and message you enter, plus whether you opened it as calculator feedback. Calculator figures are not attached. If you use Report a Bug from the app footer, we receive what you type plus a small amount of context collected automatically, so that a fault can be reproduced without you having to describe your setup:

• the page you were on when you opened the form;
• your browser's user-agent string, which names your browser, operating system and device type;
• the size of your browser window;
• the version of MileMinder you were using;
• the email address of the account you were signed in to.

The form shows you each of these before you send it. Nothing else is attached — no odometer readings, no vehicle or agreement details, no screenshot or copy of the page — and none of it is used to profile you, your device or your browsing.

Optional support payments

If you choose to support MileMinder, payment is handled by Stripe. MileMinder receives the payer email address from Stripe only to send a thank-you confirmation. Support payments do not unlock features, change your account, or gate any mileage-tracking functionality.

Why we use it, and our lawful basis

• To provide the service — storing your readings, calculating your position against your allowance, and showing your projections. Lawful basis: performance of a contract with you.
• To send you alerts you have asked for, when you approach or exceed your allowance. Lawful basis: performance of a contract; you can turn alerts off in Settings at any time.
• To keep accounts secure — session management and password resets. Lawful basis: our legitimate interest in protecting accounts against unauthorised access.
• To answer you and fix faults — reading what you send through the contact form or a bug report, including the technical details attached to a bug report, so we can reply to you and diagnose the problem. Lawful basis: our legitimate interest in supporting and maintaining the service.
• To confirm optional support payments — sending a short thank-you email after Stripe confirms payment. Lawful basis: our legitimate interest in acknowledging the support you chose to send.

We do not use your data for profiling or automated decision-making, we do not use it to train machine-learning models, and we do not sell it or share it for advertising.

Who your data is shared with

Your data is not shared with anyone except the service providers needed to run MileMinder:

• An email delivery provider, which handles password reset emails and mileage alerts. It processes your email address and the content of those messages in order to deliver them.
• A payment processor, Stripe, which handles optional support payments and sends MileMinder the payment event needed to send a thank-you confirmation.
• A hosting provider, which runs the servers your data is stored on.

These providers act as processors on our instructions. We may also disclose information where we are legally required to do so.

Where your data is stored, and for how long

Your data is held on servers operated by our hosting provider. We keep it for as long as your account exists. If you delete a vehicle, its readings and agreement details go with it. You can delete your account yourself at any time from Settings; that removes the account and all of its vehicle data immediately and permanently, with no reactivation window. Backups may retain copies for a short period before they age out.

Messages you send us — contact form or bug report — arrive as email and are kept in our inbox only as long as we need them to answer you or fix the fault. Because they are email, deleting your account does not remove them; ask us and we will delete them.

Security

Passwords are hashed with bcrypt. Session and password-reset tokens are stored only as SHA-256 hashes, so the tokens themselves cannot be recovered from our records. Session cookies are HttpOnly and, in the hosted service, sent only over HTTPS. Password reset links are single-use and expire.

No service can promise perfect security, and we would rather be straightforward about that than imply otherwise.

Your rights

Under UK GDPR you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected — most of it you can edit yourself in the app;
• have your data erased — you can do this yourself from Settings;
• receive your data in a portable format;
• restrict or object to how we process it;
• withdraw consent where processing relies on it.

To exercise any of these, use the contact form. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk. We would appreciate the chance to put things right first.

Children

MileMinder is not intended for children and we do not knowingly collect data from anyone under 16.

Changes to this policy

If we change this policy we will update the date at the top of this page, and tell you by email if the change is significant.

Contact

Questions about this policy, or about your data, go to the contact form or email hello@jackbishop.co. A postal address is available on request.