Privacy Policy
Last updated: September 12, 2026
This policy explains what the MyShop mobile app, the MyShop API and this website (myautoshop.net) actually collect, why, and who it is shared with. It describes the system as it is built today. Where something is not collected, we say so plainly rather than reserving the right to collect it later.
MyShop is a companion app for customers of an independent auto repair shop. You choose a shop, and the app shows you the vehicles, service history, appointments and messages that shop already holds about you.
1. What we collect
Your phone number. This is the only thing you are asked for in order to sign in. It is how your account is identified. We do not ask for an email address, a password, a mailing address or a date of birth, and the app has no field to enter any of them.
A one-time sign-in code. When you request a sign-in, we generate a numeric code and send it to your phone by SMS. The code is stored only as a cryptographic hash, expires after a short period, and is invalidated after a small number of incorrect attempts. It is cleared once used.
Session tokens. After you sign in, the app holds an access token and a refresh token. These are stored in the operating system's encrypted keystore (Keychain on iOS, EncryptedSharedPreferences/Keystore on Android), not in plain files, and they are deleted from the device when you sign out.
Your customer record at the shop. Your first and last name, your phone number as the shop recorded it, the shop you are associated with, and your loyalty level and points. This information originates from the shop's own management system, not from anything you type into the app.
Your vehicles. Make, model, year, engine, VIN, licence plate and recorded mileage. This also comes from the shop's records.
Your service history. Invoices raised by the shop, including the service advisor and technician named on them, mileage in and out, individual line items with descriptions, and the parts, labour, sublet, other and grand totals. Also services the shop has flagged as due or deferred for your vehicle.
Appointments. The dates you propose, any note you write, and the services or rewards you attach to the request; then the shop's response and the final status.
Messages and photos. Messages you exchange with your shop, and any photo you attach to them. You can also set a profile photo and a photo for each vehicle. Photos are read from your camera or photo library only at the moment you choose one; the app does not browse, index or upload your library in the background.
Feedback you volunteer. If you change shops or delete your account, you are asked to pick a reason and may add a note. This is stored and visible to the shop.
Roadside assistance calls. If you tap the roadside assistance button, we record that you placed the call and when. We do not record the call, its contents or your position.
Rewards, achievements and notifications. Which rewards you have collected, which achievements you have earned, and which in-app notifications you have read.
Device platform and push token. Your account record has fields for the platform you use (iOS or Android) and a push notification token, so that the shop can notify you about a new message, invoice or appointment change. Push notifications are not currently active in the app: the build ships with a no-op push implementation, so no push token is generated or sent today. If push is switched on in a future release, the token registered will be the one issued by Apple or Google for your device, and it identifies the app installation rather than you personally.
Shared referral links. If you share a MyShop referral link and someone opens it, we log that the click happened, the time, the browser and operating system family, the device type, the referring page, and a truncated form of the visitor's IP address. IPv4 addresses are truncated to remove the final octet and IPv6 addresses to the first 48 bits, so the value identifies a network region and not a household or a person. This log exists to count how many shares turn into installs. It is generated by the web redirect, not by the app.
2. What we do not collect
No location. The app requests no location permission of any kind. There is no coarse-location, fine-location or background-location declaration in the Android manifest and no location usage description in the iOS app, which means the operating system would refuse a location request even if one were made. The app never asks for, receives, transmits or stores your position. Opening a shop's address hands the address to your device's maps application; MyShop is not told where you are or whether you went.
No payment or financial instrument data. You cannot pay through MyShop. We never see or store a card number, bank detail or payment credential. Invoice totals are amounts your shop has already billed you; they are a record of work done, not a payment method.
No analytics or advertising SDK. The app contains no analytics, attribution, advertising or crash-reporting library. We do not build a usage profile, do not track which screens you visit, and do not share any identifier with an advertising network.
No cookies or trackers on this website. This site is static HTML. It sets no cookies, embeds no tag manager, and runs no third-party analytics or video-tracking script.
No sale of personal information. We do not sell, rent or trade your information, and we do not disclose it for cross-context behavioural advertising.
3. How the information is used
Your phone number and the one-time code are used to verify it is you and to keep you signed in. Everything else is used to show you your own vehicles, service history, appointments, rewards and messages, to pass your appointment requests and messages to your shop, and to notify you when your shop responds. Feedback is used to tell your shop why a customer left. Referral click counts are used to measure whether sharing works. We do not use any of it for profiling or for automated decisions about you.
4. Who it is shared with
Your auto repair shop. This is the point of the app. The shop you select sees your customer record, your vehicles and service history, your appointment requests, your messages and photos, and any feedback you leave. A shop can only see its own customers.
Your shop's management system (Protractor). The shop's records live in its Protractor shop-management system. Our API reads your customer, vehicle and invoice data from it and writes back subscription changes, including the request to unsubscribe you when you delete your account. Protractor's handling of that data is governed by the agreement between Protractor and your shop.
Twilio delivers the sign-in SMS. To send it, Twilio necessarily receives your phone number and the message containing the code.
Postmark is our transactional email provider. It is used for the small number of emails the platform sends, principally invitations to shop staff. Postmark also reports bounces and complaints back to us, and we keep a suppression list of addresses that must not be emailed again. The customer app does not collect an email address, so in ordinary app use there is nothing for us to send you by email.
Apple and Google would receive a push token and the notification payload if and when push notifications are enabled. They are not receiving anything today, because push is not active.
Beyond these, we disclose information only where we are legally required to, or where it is necessary to establish or defend a legal claim. If MyShop were sold or merged, your information would transfer with it, and this policy would continue to apply until you were notified of a replacement.
5. Where your data is held, and for how long
Data is held on servers we operate and is transmitted over TLS. We keep it for as long as you have an account with a shop, because it is the shop's service record for your vehicle. Sign-in codes are short-lived and are cleared as soon as they are used or expire. Session tokens are deleted when you sign out. Referral click logs hold only truncated IP prefixes and are kept in aggregate to count installs.
6. Deleting your account
The app offers My Account → Account settings → Delete my account. We want to be exact about what that does today: it signs you out on every device, revokes all your sessions, deactivates your customer profile so the shop no longer treats you as an app user, and asks your shop's Protractor system to unsubscribe you. It does not, by itself, erase the underlying service history. That history is your shop's business record of work performed on a vehicle, and the shop is generally required to retain it.
If you want your personal data erased rather than deactivated, or you want a copy of it, or you want something corrected, email support@myautoshop.net from a message that identifies the phone number on the account. We will action it, and where the underlying record must be retained by the shop for its own legal or accounting reasons, we will tell you which record and why.
7. Security
All traffic between the app and the API uses TLS. Sign-in codes are hashed, time-limited and attempt-limited. Session tokens live in the platform keystore on your device. No system is perfectly secure, and we do not claim otherwise, but we do not store anything in the categories that cause the most harm when breached: there are no passwords for app users, and no payment credentials anywhere.
8. Children
MyShop is for customers of an auto repair shop and is not directed at children. We do not knowingly collect information from anyone under 13. If you believe we hold information about a child, email support@myautoshop.net and we will delete it.
9. Links to other services
Tapping a shop's address opens your device's maps application, and tapping a phone number opens your dialler. Those are separate services with their own privacy terms, and what you do in them is not visible to MyShop.
10. Changes to this policy
If we change what is collected, we will change this page and update the date at the top before the change ships. We will not quietly broaden collection and leave this page describing the old behaviour.
11. Contact
Questions about this policy, or any request about your data:
support@myautoshop.net
https://www.myautoshop.net