Draft — pending legal review. This notice describes how Costometer works today, in plain English, but it has not yet been reviewed by a lawyer.

Privacy

Privacy notice

Last updated 2026-09-15

Costometer is run by Simple Technologies. This notice covers the hosted service at costometer.app. The short version: we collect what we need to run your garage, we don't sell it, and you can take it with you or delete it.

The free calculators

• The FSD, fill-up MPG, EV charging and compare calculators run in your browser. The numbers you type are not sent to us.
• A shareable link or saved image contains only what you chose to share.
• Email it to me: only when you ask, we send the result to the address you give. The email is built from the calculator inputs and fixed wording. We don't keep your address. To stop abuse, we keep a keyed hash of the address and of your IP address for up to 2 days to enforce daily limits; a hash can't be turned back into the address.
• Your light/dark and text-size choices are saved in your browser's local storage on your device, not on our servers.

Your account and signing in

• No passwords. You sign in with a link we email you, or with a passkey. We store your email address, when your account was created and when you last signed in.
• Sign-in links are single-use and expire after 20 minutes. We store only a hash of each link. To slow down abuse, we keep keyed hashes of the email address and IP address that asked for a link, for about a day.
• Passkeys: we store the public key and details your device provides (such as a name you give it). The private key never leaves your device or password manager.
• When you're signed in, your browser holds one essential session cookie. We store only a hash of it. We don't use advertising or tracking cookies.

Your garage

Whatever you add is stored so the garage can work: vehicles (make, model, year, VIN if you enter one, purchase and finance or lease details), costs, recurring payments, maintenance and repair diary entries, service reminders, odometer readings and notification preferences.

• Imports from LubeLogger or Fuelly: we read the CSV file you upload and save the rows you confirm. The file itself isn't kept.
• Vehicle lookups use the EPA fuel-economy catalog we host and, if you decode a VIN, the US government's NHTSA vPIC service.
• Email digests and alerts are sent to your account email at the frequency you choose. You can turn them off in Settings.
• We keep a security and billing audit log (for example, sign-ins by administrators, plan changes and failed payments) to run and protect the service.

Connections, API keys and AI

• Tesla and Smartcar (paid plans): when you connect, the access and refresh tokens are encrypted (AES-GCM) before they're stored. We request and store vehicle data such as odometer, charging and battery readings to calculate costs. We don't request or store your vehicle's location. Disconnecting deletes the tokens.
• Laberty printing (paid plans): your Laberty API key is encrypted before it's stored, and we keep only its last four characters in the clear to show you which key is saved. Slips and labels you print are sent to Laberty, and we log each print request.
• Your own AI key (paid plans): the key you add for Claude, ChatGPT, Gemini or Grok is encrypted before it's stored. When you ask Costometer to read a loan or lease PDF or a receipt, the document goes to the AI provider you chose, under your own account with them. We save the details you confirm, not the document.
• Bank data is never on the hosted service. Bank transactions through SimpleFIN are available only when you self-host on your own Cloudflare account.

Who processes data for us

• Cloudflare hosts the site, the app and its database. We use Cloudflare Web Analytics to count visits; it doesn't use cookies and doesn't see calculator inputs.
• Resend delivers email: sign-in links, emailed results, digests and alerts.
• Stripe handles subscriptions and payments. Your card details go to Stripe, not to us. We store your Stripe customer and subscription IDs and your plan status.
• Tesla, Smartcar, Laberty and your chosen AI provider, only if you connect or use them. Their own privacy policies apply to what they receive.
• Google Fonts serves the typefaces, so your browser requests font files from Google.

We don't sell your data, share it with advertisers or show ads.

Export and deletion

• Export: download your garage data from your account page at any time.
• Delete: delete your account yourself from your account page. That removes your vehicles, costs, reminders, passkeys, sessions, connections and saved keys. Stripe keeps billing records it is required to keep, and our short-lived abuse-prevention hashes expire on their own.
• You can remove a passkey, disconnect a car, remove an API key or turn off digests without deleting your account.

Children

Costometer isn't meant for children under 13, and we don't knowingly collect their information.

Changes

If we change how data is handled, we'll update this page and its date. For significant changes we'll tell signed-up users by email first.

Contact

Questions or requests: costometer@simple-technologies.net. See also the terms of service.