Privacy Policy

Effective date: September 29, 2026

This policy explains what personal information Oslo collects, how it is used, and the choices and rights you have. It covers the website at osloregistry.com and the application at app.osloregistry.com (together, “Oslo”, “the Oslo Registry”, “Oslo Registry”, “the service”, “we”, “us”).

The Oslo Registry is operated by R3 Design Works, LLC. For anything in this policy, contact us at [email protected].

The short version:

We collect only what the service needs to work: your account details and the content you contribute.
We use no advertising and no tracking cookies. The only cookies are the ones that keep you logged in. We measure traffic with a privacy-first analytics service that sets no cookies, does not fingerprint you, and does not follow you to other sites.
We do not sell or share your personal information with anyone for advertising or marketing.
You can delete your account yourself at any time from your profile settings.

Information we collect

Account information. When you register we collect your email address, username, name, and password (stored only as a secure hash — we cannot read it). Your account settings also store preferences: time zone, preferred currency, mileage unit, measurement system, display theme, which home feed you open on, and whether your name is shown publicly. We record when you verified your email address and the time you last signed in, which we use to keep the account secure.

Content you contribute. The Oslo Registry is a community vehicle registry, and most of what you add is content you choose to publish: vehicle records (including VINs and license plates), posts and comments, photos, locations you attach to posts, mileage readings, sale records (prices, dates, currencies), service records (work performed, parts, and costs), vehicle specifications, registries you create, vehicles and users you follow, garage bookmarks, notification preferences, and reports you file about content.

Contact form. If you use the contact form on osloregistry.com, we collect the name, email address, and message you submit, and use them only to respond to your enquiry.

Technical information. Like nearly every website, our servers keep logs that include your IP address, browser type, and the times and pages of your requests. We use these for security and troubleshooting only.

Traffic measurement. We use a privacy-first analytics service to understand how the service is used in aggregate — which pages are visited, how they perform, and roughly where visitors come from. It sets no cookies, stores nothing on your device, and does not fingerprint you or build a profile of you, so it cannot recognise you between visits or follow you to other websites. Your browser connects to the provider, which sees your IP address to derive an approximate country and then discards it: the address is neither stored nor logged, and no personal information about you is kept. What we can see are counts and totals, never an individual’s browsing history.

How we use your information

To provide the service: authenticate you, display your contributions, and apply your preferences (for example converting prices and mileage to your chosen currency and units).
To send you transactional email: account verification, password resets, notices of material changes to this policy or our Terms of Service, and — only if you turn them on — notification emails. Notification emails are off by default and can be disabled per type in your account settings at any time. Policy-change notices are not optional: they go to every registered account, because they are how we tell you the terms you are using the service under have changed.
To keep the service safe: securing accounts, investigating abuse, moderating reported content, and maintaining the integrity of community records.
To respond when you contact us.

We do not sell personal information, use it for advertising, profile you, or make automated decisions about you.

Legal bases (EEA / UK users)

Where the GDPR or UK GDPR applies, we process your information on these bases: performance of a contract (providing the account and service you signed up for), legitimate interests (security, server logs, aggregate traffic measurement, content moderation, and keeping community vehicle records accurate), consent (optional notification emails — withdraw at any time in your settings), and legal obligation where the law requires it.

Cookies

We use only strictly necessary first-party cookies: session cookies that keep you logged in and a CSRF token cookie that protects forms against forgery. There are no advertising or third-party tracking cookies, and our analytics service sets no cookies of any kind and stores nothing on your device. Because every cookie we set is essential to operating the service, we do not show a cookie consent banner.

Public content — please read this

Oslo Registry is a public, community-maintained registry. Vehicle records, posts, comments, photos, sale records, specifications, and registries are publicly visible, including to visitors without accounts and to search engines. Your username — and your name, if you have enabled “show name” in your settings — appears alongside your contributions.

Service records are the exception: you control their visibility (draft, public, or private). A draft is visible only to you. A private record appears to other users as a placeholder — they can see that a record exists, who added it, and the date it was completed, and nothing else: the description, notes, mileage, costs, currency, shop, parts, and any attached receipts are all withheld. Administrators can see private records in full, and only for running the service — investigating abuse, responding to a report, or answering a legal request.

Vehicle records describe vehicles, not people. Please do not include personal information about other people (such as an owner’s name or address) in vehicle records, posts, or photos.

License plates. Vehicle records may include a license plate, and photos may show one. The only plate-related information we store is what is publicly visible on the vehicle itself: the plate number, its state or region of issue, and the vehicle it belongs to (make, model, and similar vehicle details). We do not obtain, look up, or store vehicle registration or DMV records, and we do not link a plate to the name or identity of a vehicle’s owner or keeper. If a plate connected to you appears on the service and you would like it removed, contact us at [email protected].

Who we share information with

We share personal information only with service providers who help us run Oslo, under contracts that restrict them to using it on our behalf:

Hosting and infrastructure providers that store our servers and database
An email delivery provider that sends transactional and notification emails (they process your email address for that purpose)
A log management provider that stores a copy of our server logs — including IP addresses and the pages requested — for the limited period described under Data retention below
An error tracking provider that receives a report when something in the application breaks. A report can include the user ID and email address of the signed-in account that hit the error, so we can tell which accounts were affected — but never passwords, session cookies, or authentication tokens, which are stripped before the report leaves our servers
An analytics provider that counts page views and performance measurements, as described under Traffic measurement above. It receives no account information and nothing that identifies you; it sees your IP address only to derive an approximate country, and does not store it

Our location autocomplete feature is powered by Google Maps Platform. When it loads, your browser connects to Google, which receives your IP address; Google’s privacy policy governs that connection.

Beyond that, we disclose personal information only if the law requires it, or to protect the safety and integrity of the service and its users.

Data retention

We keep your account information for as long as your account exists. Server logs are kept in two places: on our own servers, where old entries are automatically rotated out as new activity replaces them (we keep a fixed amount of recent activity rather than a fixed number of days), and with our log management provider, where a copy is deleted after 14 days. Error reports are kept by our error tracking provider for 90 days and then deleted. Traffic measurements are aggregate counts that contain no personal information and are not linked to you or to your account, so there is nothing in them to retain against you or to delete.

Backups. We keep encrypted off-site backups of the database and of uploaded files, so the service can be restored after a failure. They are kept on a rolling schedule — the last seven days, then weekly and monthly copies — and the oldest is deleted after about six months. A backup is a snapshot of a moment, so information you have since deleted stays inside one until that copy ages out. We do not open a backup to recover a deleted account or deleted content, and anything that came back during a restore is deleted again.

When you delete your account, we handle your data as described in the next section.

Deleting your account

You can delete your account at any time from Account → Profile in the app. Deletion is permanent — the account cannot be reactivated. When you delete your account:

Your personal data is deleted — email address, first and last name, bio, password, profile photo, and your preferences. We send a confirmation of the deletion to your email address and then remove the address from your account.
Your social activity is deleted — the users, vehicles, and registries you followed, any registries you helped manage, your garage bookmarks, your notification settings, and your notifications. We also delete the notifications other people received about you, so your former username and profile photo do not linger in someone else’s inbox.
Service records you kept private or left as drafts are deleted outright, together with their parts, costs, shop details, and any receipts you attached. You never published them, so we do not keep them.
Content you published to the community registry is kept, but no longer identifies you — vehicle records, posts and their photos, comments, sale records, public service records, vehicle specifications, and registries you created. It is shown attributed to an anonymous “Deleted User”. Files you attached to a public record, such as a service receipt or a sale’s source document, are part of that published record and are kept with it. This keeps the registry’s community-maintained vehicle history intact.
Your username is retired. It is removed from everything published on the service: you are no longer shown as the author of anything, and where someone wrote @yourname in a post, comment, bio, registry description, or record note, it is rewritten to @deleted. The username can never be registered by anyone else, so no one can impersonate your former account.
Reports you filed about other content are kept so that moderation decisions remain reviewable. Reports are never public — only the staff who handle them ever see one.

Two limits, stated plainly rather than left implied:

We can rewrite your @username, but we cannot find every place someone typed your name as ordinary words. If you find your name in content someone else wrote, email us and we will remove it.
A small number of staff who administer the service can still see the retired username attached to the deleted account, so that abuse reports and legal requests about it remain traceable. It is never shown to other users or to visitors.
Backups taken before you deleted your account still contain your data until they age out, as described under Data retention. We do not use them to bring a deleted account back.

We may also delete an account ourselves — for example when we close it for a breach of our Terms of Service, or when you ask us to by email. The result is the same as above, except that we do not send a deletion confirmation to an account we closed for a breach.

If you prefer, you can request deletion by emailing [email protected].

Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy in a portable format, restrict or object to how we process it, and withdraw consent you have given. You can exercise most of these directly in the app (account settings and account deletion); for anything else, email [email protected] and we will respond within the timeframe the law requires. If you are in the EEA or UK, you also have the right to lodge a complaint with your data protection authority.

California residents. You have the right to know what personal information we collect, to delete it, to correct it, and to not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined in the CCPA/CPRA, so there is nothing to opt out of.

International transfers

Our servers are located in the United States of America. If you use Oslo Registry from elsewhere, including the EEA or UK, your information is transferred to and processed in that country.

Children

Oslo Registry is not directed at children. You must be at least 16 years of age to create an account. If we learn that a younger child has created an account, we will delete it.

Changes to this policy

If we make material changes to this policy, we will update the effective date above and email registered users at the address on their account. Continued use of the service after a change takes effect means the updated policy applies.

Contact

Questions about this policy or your data: [email protected].