Privacy Policy
Last updated:
This policy explains how the Vehicle Doc Lanka Android app ("the app", "we") handles your information. The app is developed by Brahmiraj Tharmapalan, Sri Lanka, who is responsible for your data. We follow the Sri Lanka Personal Data Protection Act, No. 9 of 2022.
The short version
- Your document photos, document numbers and vehicle numbers never leave your phone.
- You can use the whole app without an account. Email reminders are optional.
- If you turn email reminders on, we store only your email address and, for each document, a vehicle nickname you choose, the document type and its expiry date.
- No ads. We never sell or share your data.
- You can delete your account and all server data at any time.
1. Data kept on your device
The following stays on your phone only. It is never sent to us or anyone else:
- Document photos, document numbers, vehicle numbers, vehicle details and notes.
- It is stored in an encrypted database on your device.
- When you photograph a document, the text is read on your phone (Google ML Kit on-device text recognition). Photos are not uploaded anywhere.
- Expiry notifications are scheduled locally on your device.
- "Add to calendar" writes only to a separate calendar the app creates on your device, not to your personal or synced calendar.
If you uninstall the app or clear its data, this information is deleted. [TODO: confirm whether Android Auto Backup is disabled for the app's data, and update this sentence if it is enabled]
2. Optional email reminders & sign-in
This is the only feature that sends data to our server, and only if you turn it on and sign in. You can sign in in one of two ways:
Continue with Google
We receive only your email address and your Google account ID. We never see your Google password, contacts or any other Google data.
Email and password
- We confirm your email address by sending you a 6-digit code.
- Your password is never stored in readable form — only as a one-way hash (bcrypt) that cannot be turned back into the password.
- Codes expire after 10 minutes and are also stored only as a hash.
What is synced for each reminder
- A vehicle nickname you choose (for example "My Car")
- The document type (for example "Insurance")
- The expiry date
Never photos, document numbers or vehicle numbers — even if you use email reminders.
3. How we use your data
- To email you reminders 30, 7 and 1 days before a document expires.
- To send account emails: email confirmation codes and password reset codes.
- To keep your account secure.
We do not send marketing emails, show ads, or sell, rent or share your data. [TODO: confirm the app uses no analytics or crash-reporting SDKs, or name them here]
4. Service providers
For email reminders we rely on these providers, who process data only on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Neon (managed PostgreSQL, on AWS) | Stores accounts and reminders | Singapore |
| Oracle Cloud | Runs our server | [TODO: server region] |
| Google (Gmail) | Sends reminder and account emails | Global |
| Google (Sign in with Google) | Sign-in, if you choose it | Global |
This means your email address and reminder data may be processed outside Sri Lanka.
5. Security
- All data sent between the app and our server is encrypted (HTTPS/TLS).
- Passwords and codes are stored only as hashes.
- Repeated wrong passwords lock the account for 15 minutes. Resetting your password signs your account out on all devices.
- Our server logs never contain email addresses, passwords, codes or sign-in tokens.
No system is perfectly secure, but we limit what we store so there is little to lose.
6. How long we keep data
- Reminder data is kept while your account exists and you keep the reminder. Deleting a document in the app removes its reminder from our server.
- Unused codes are deleted automatically about a day after they expire.
- Everything else is kept until you delete your account.
7. Deleting your account
In the app, go to Settings → Delete account. This immediately and permanently deletes all your reminders, email history and codes, and erases your email address, password hash and Google account link. A minimal record with no personal data remains only to keep our database consistent. You are signed out everywhere at once.
Can't use the app? See how to request deletion by email.
8. App permissions
- Camera — to photograph your documents.
- Notifications — to remind you before documents expire.
- Calendar— only when you tap "Add to calendar".
- Biometrics — only if you turn on the optional app lock. Your fingerprint or face data stays with Android; the app never receives it.
Each permission is used only for the purpose shown.
9. Your rights
Under Sri Lankan data protection law you can:
- ask what data we hold about you, and get a copy;
- ask us to correct it;
- delete it (delete your account, or email us);
- withdraw consent by turning off email reminders or deleting your account;
- complain to the Data Protection Authority of Sri Lanka.
To use any of these rights, email vehicledoclanka@gmail.com from the email address on your account.
10. Children
The app is meant for vehicle owners and is not directed at children. [TODO: confirm the minimum age, e.g. 18] We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
If this policy changes, we will update this page and the "Last updated" date. Significant changes will also be announced in the app.
12. Contact
Brahmiraj Tharmapalan, Sri Lanka — vehicledoclanka@gmail.com