Privacy
Privacy Policy
Last updated: 31 October 2026
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Robin Klippert
Lohnstraße, 2
36280 Oberaula
Deutschland
Email: robin@shiftnation.app
2. Cookies and local storage
To keep you signed in, your browser stores your account session in local storage. Local storage also holds your language setting, the state of your notifications and which cars in the feed you have already seen in the last 48 hours. If you open Shiftnation through an invite link, session storage keeps the invite code until you close the tab. If you open Shiftnation through a link that specifies a language, a cookie („lang“) remembers that language for one year. This storage is strictly necessary for the service you asked for (Section 25(2) No. 2 TDDDG), so it needs no consent.
3. Server log files
Each time Shiftnation is accessed, our host Vercel (see section 4) logs the date and time, the address requested including its parameters, the IP address and the browser identifier (user agent). For requests from signed-in users our server adds the user ID, and for errors technical details about the error. We need this data to deliver the content correctly, fix errors, and fend off attacks and report them where necessary. Vercel deletes the logs after 30 days at the latest. The legal basis is Art. 6(1)(f) GDPR.
4. Hosting with Vercel, Speed Insights and Web Analytics
Shiftnation is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA („Vercel“). Its server functions run in Vercel's data centre in Frankfurt am Main. In addition to the server log files, each page load in the browser uses two Vercel telemetry services: Vercel Speed Insights collects performance metrics (Core Web Vitals such as LCP, INP and CLS) together with the page visited, network speed, browser, device type, operating system and country, so that we can monitor and improve loading speed. Vercel Web Analytics records page views with the page address, referrer, country, region and city, browser, operating system and device type, so that we can evaluate reach and usage.
We also count individual events: sign-ups (with sign-in method), clicks on shop and social media links, and views and clicks of Pro profile banners. For Pro banners, the user ID of that Pro profile is sent.
Both services are explicitly cookieless: no cookies are set and no information is stored on or read from your device, so Section 25 TDDDG does not apply. To recognise a visitor, Vercel forms a hash from properties of the request, which is discarded after 24 hours; the data is not linked to your IP address, and no cross-device or cross-site tracking takes place.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technical stability, performance optimisation and needs-based further development of Shiftnation. Since Vercel may also process personal data in the United States, the transfer is based on the EU-U.S. Data Privacy Framework and, additionally, on the European Commission's Standard Contractual Clauses.
5. Database and storage with Supabase
Accounts, content and uploaded images are stored with Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 („Supabase“). The database is located in the Frankfurt am Main data centre. Supabase processes the data on our behalf. Where Supabase or its sub-processors may access data from outside the EU, the European Commission's Standard Contractual Clauses apply. The legal basis is Art. 6(1)(b) GDPR.
6. Registration and sign-in
To create an account, you register with an email address and password or sign in with Google, then choose a username. Supabase (see section 5) also logs the IP address, date and time of registration and sign-in, to prevent misuse and, if necessary, help investigate offences; these logs are deleted after seven days at the latest. This data is not passed on to third parties unless there is a legal obligation to do so or the disclosure serves criminal prosecution. The legal basis is Art. 6(1)(f) GDPR.
For signing in with Google, the sign-in page loads Google Identity Services from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google“). Google receives the IP address and technical browser data. If you choose „Continue with Google“, Google transmits the name, email address and profile picture of your Google account once you confirm; we use these to create your account or sign you in. The legal basis for loading the service is Art. 6(1)(f) GDPR, our legitimate interest in a simple sign-in; for the transmission of the account data, Art. 6(1)(b) GDPR. Google may also process data in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework.
Emails confirming your registration, resetting your password and with security notices are sent through the mailbox.org email service of Heinlein Hosting GmbH, Schwedter Straße 8/9A, 10119 Berlin, Germany. The legal basis is Art. 6(1)(b) GDPR.
7. Your account and your content
We store what you provide yourself: your email address and username, and optionally your country, postcode and social media handles; your cars with photos, videos, entries, maintenance, MOT dates, lap times and parts lists; messages, friendships, blocks, crews, likes, cars you follow, saved searches, invite codes used and in-app notifications; feedback (together with browser identifier, page and app version) and reports of content.
Cars you make public and your username are visible to others. Messages are visible only to the people in the conversation. We sort the feed for you: cars you follow, your friends' cars and cars near you appear higher up. The order is calculated each time and not stored. The legal basis is Art. 6(1)(b) GDPR. If you delete your account in the settings, we delete this data and every image you uploaded.
8. Location
So that Shiftnation can show you cars near you, you can enter a postcode. We never ask for your device location. From the postcode, our server looks up the approximate coordinates through the zippopotam.us service; only the country and postcode are sent there, not your IP address or account. We store your country, postcode and coordinates. Other users never see the coordinates, only a distance to your cars rounded to whole kilometres, measured from their own postcode. The legal basis is Art. 6(1)(a) GDPR. You can remove your location in the settings at any time.
9. Checking car photos
Photos you upload to a car's gallery are checked automatically with Google Cloud Vision from Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. The check detects whether an image shows a car or car part and whether it contains prohibited content. Rejected images are kept for 30 days in non-public storage so that wrong decisions and misuse can be traced; after that they are deleted automatically. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a platform free of unlawful and off-topic content. Google may also process data in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework.
10. Push notifications
If you turn on notifications in your browser, we store the address your browser creates for them. Notifications are delivered through your browser maker's push service, such as Google, Mozilla, Apple or Microsoft. The content is encrypted; the push service only learns that a notification is being delivered. Delivery records are deleted after 30 days. The legal basis is Art. 6(1)(a) GDPR. You can turn notifications off at any time in the settings or in your browser.
11. YouTube and Instagram
Car profiles can include a YouTube video or an Instagram post. Only when you start the video does it load through youtube-nocookie.com from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Only when you tap „Load Instagram post“ does the post load from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When you add an Instagram post to your car, our server asks Meta whether it can be embedded; only the post's address is sent.
The providers then receive your IP address and may set cookies. The legal basis is the consent you give by tapping (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); it lasts until you reload the page. Both providers may process data in the United States; Google LLC and Meta Platforms, Inc. are certified under the EU-U.S. Data Privacy Framework.
12. Protection against misuse
To limit automated attacks and mass requests, certain actions store your IP address or user ID together with a counter. These entries are deleted after one day. The legal basis is Art. 6(1)(f) GDPR.
13. Storage period
Where this policy names a period, that period applies. Account data is kept until you delete your account. Otherwise we delete data once its purpose no longer applies and no statutory retention period requires us to keep it.
14. Your rights
You have the right to access the data stored about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). You can withdraw any consent you have given at any time, with effect for the future (Art. 7(3)). To exercise them, write to robin@shiftnation.app.
You can also lodge a complaint with a data protection supervisory authority (Art. 77). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.
15. Right to object
Where we process data on the basis of Art. 6(1)(f) GDPR, you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Send your objection to robin@shiftnation.app.
16. Obligation to provide data
An account requires an email address and a username. Without them no account can be created. Everything else is optional.
17. Automated decision-making
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.