Privacy

Droove operates droove.pro and is the controller of the personal data described here. Write to hello@droove.pro about anything on this page.

Your email address, because signing in works by sending a link to it. It is never shown on your page.

What you put on your page: your handle, display name, an optional location and one-line bio, and the cars — make, model, year, engine, the years you owned each one and any note you add.

Photographs you upload, after the processing described below.

Ordinary server logs kept by our hosting providers, which include IP addresses, for security and to keep the site running.

Who you follow, and who follows you. A follow is public in both directions: it appears in their followers, in your following, and in the counts on both pages. Unfollowing removes it from both. If you would rather keep a garage to yourself without following it, open it from your own history — nothing is recorded by reading a page.

Cars you save are not public. Keeping a car from the Connector or from somebody’s garage is a private list, under Explore. Nobody is told, and nothing appears on the page of whoever owns the car.

Registration numbers are never recorded. A plate is located in a photograph so that its pixels can be destroyed, and it is read once — before that — so the DVSA can be asked what the car is. The answer comes back as a make, a model, a year, a fuel and an engine size; the registration itself is not returned to your browser, not written to any row, and not put in a log. There is no column in the database for one.

The unblurred photograph never reaches storage. Blurring happens on the server, in the request that receives the upload, and only the blurred image is written. The original exists in memory for the length of that request and is then gone. There is no copy to leak, expire or be asked for later, and no way to undo a blur — including for us.

The page banner is the exception. It is a backdrop — a road, a treeline, a stretch of coast — rather than a picture of a car, so it is cropped and stored without being scanned for plates. If you put a car in it, its plate will be readable. Every photograph attached to a car goes through the blur described above.

So is a profile photograph. If you use one instead of one of the drawn marks, it is squared to the crop you chose and stored, and no model is called on it — it is a picture of you rather than of a car. It is as public as the rest of your page, and removing it deletes the file as well as the link to it.

In order: the file is read, its orientation is settled, and it is sent to Google’s Gemini API to identify the car and locate any number plates. The copy sent to Google is the one you uploaded, before blurring — there is no way to find a plate without looking at it. Google processes it to answer the request and, under its API terms for paid use, does not use it to train models.

If a plate is legible, the characters go to the DVSA’s MOT history service — the same public record behind gov.uk’s “check MOT history” — which answers with what the car is. That request carries the registration and nothing about you. You can do the same thing deliberately by typing a registration on the first screen of the add flow.

The plates are then destroyed in the pixels, the image is resized, and that version is stored. Photographs live in a private bucket and are shown through links that are signed for one hour at a time, so a URL copied out of a page stops working.

Detection is automatic and can miss. It is checked twice — a sweep of the frame, then a close look at each candidate — and the blur is deliberately heavier than it needs to be. It is still a machine looking at a photograph. Look at the result, and if a plate survived, delete the photograph.

Your page is public by design: readable without an account, at an address you chose, and open to search engines. Your handle, display name, location, bio, cars and photographs are all on it. Your email address is not, and neither is anything from §2 beyond what you put on the page.

Supabase — database, file storage and the sign-in link. Vercel — hosting and delivery. Google (Gemini API) — recognising a car from a photograph, locating plates, and drafting a bio when you press the button for one. Google (Analytics) — counting visits, with cookies only if you accept them; see section 11.

These are processors acting on our instructions. Some process data outside the UK and EEA, under the transfer safeguards in their own terms. There is no advertising network, and nothing is sold to anybody.

Performing the contract with you, for everything needed to run your account and your page. Legitimate interests, for keeping the service secure and working. Where consent is the basis — publishing what you chose to publish — you can withdraw it by deleting the material.

Your account and page are kept until you delete them. Deleting your account removes your profile, your cars and your photographs, including the stored files. Backups roll off within 30 days. Server logs are kept for as long as our providers keep them, in the order of weeks.

You can ask for a copy of your data, correct it, delete it, restrict or object to what we do with it, or ask for it in a portable form. Most of this is faster to do yourself from your settings. For the rest, write to us and we will answer within a month.

If you think we have got it wrong you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first.

Signing in needs a cookie that keeps you signed in and the tokens behind it. That one is not optional, and it is all we set without asking.

We also use Google Analytics to see which pages are used and where visitors come from. Until you say yes it sets no cookie and sends only anonymous signals that cannot be tied to you. If you accept, it sets its own cookies (named _ga) to recognise a returning browser, for up to two years. Nothing is used for advertising.

You are asked once, and you can change your answer at any time with “Cookie settings” at the foot of every page.

Droove is not for under-16s. If you believe a child has an account, tell us and it will be removed.

Material changes are notified by email to the address on the account. The date at the top of this page always says when it was last revised.