Privacy Policy

1. Introduction

Welcome to Car Boot Directory. This policy covers the website at carbootdirectory.co.uk and our Android app, Carboot Directory UK, which is published by the same operator. We are committed to protecting your privacy and collecting as little personal data as we can while still running a useful directory. This policy explains what we collect, why, and the rights you have under UK data protection law (UK GDPR and the Data Protection Act 2018). Where the app and the website differ, we say so.

2. Information we collect

2.1 Information you give us

When you add a sale, leave a review, suggest a correction, report a problem with a listing, or contact us, on the website or in the app, we collect what you type into the form: typically your name, your email address, and the content of your submission (including any organiser or venue details you provide). We also store a one-way hash of your IP address with form submissions, used solely to prevent spam and abuse. We do not store the raw IP address itself. Submissions from the app go through exactly the same moderation as those from the website.

2.2 Email alerts

If you sign up for email alerts, we store your email address and your chosen preferences. We use double opt-in: you will only receive alerts after you confirm your address via the link we send you. Every email includes an unsubscribe link, and unsubscribing takes effect immediately.

2.3 Information collected automatically on the website

Standard, short-lived server logs (IP address, requested page, browser type) are kept by our hosting and content delivery infrastructure for security and error diagnosis. Your browser stores your theme preference and saved favourites locally on your device; that data never reaches our servers. If you accept analytics or advertising cookies via our consent banner, Google Analytics 4 and Google AdSense collect additional information described in section 5 below. See our Cookie Policy for the full list of cookies and how to control them.

2.4 Information collected in the app

The app reads listings, dates and guides from our public API, and sends reviews, corrections, sale submissions and alert sign-ups to the same API. Each request carries an app key that identifies the app itself, not you. Our servers keep the same short-lived logs for app requests as for website requests. Everything else the app collects is described in the next section.

3. The app: accounts, saved sales and push notifications

You can browse the app without an account. If you choose to create one, we use Google's Firebase services to run it.

3.1 Signing in

Firebase Authentication lets you sign in with an email address and password, with your Google account, or with your phone number (we send a one-time code by SMS). We receive the identifier you sign in with (email address, Google account name and email, or phone number) and a Firebase user ID. We never see your password or your Google password.

3.2 What we store about your account

Your account data lives in Cloud Firestore in Google's London region (europe-west2), so it stays in the UK. We store:

A profile: display name, email address, phone number (if you signed in with one), when the account was created and last seen, and your notification preference
An optional home postcode, only if you choose to save one
Your saved (favourite) sales
Your alert preferences
Push device tokens, if you turn on push notifications

3.3 Push notifications

Push notifications are off by default. If you turn them on in the app, we use Firebase Cloud Messaging to deliver them and store a device token so we know where to send them. Turning notifications off deletes the token; we also delete tokens after 90 days of inactivity.

3.4 Analytics and crash reporting in the app

The app only uses Firebase Analytics if you switch it on in the app's settings. It is off by default. When it is on, Google receives basic usage events (screens viewed, features used, device type and approximate location derived from your IP address) so we can see which parts of the app are useful. We do not use the advertising ID, we do not send your search terms, and we have set Google's retention for this data to two months. Crash reporting is likewise only sent if you consent to it. You can switch either off at any time in the app and no further data is sent.

4. Location data

If you allow it, the app uses your device's coarse location on the device itself to sort sales by distance. Your location is sent to our servers in two situations only: as a pair of coordinates when you run a "near me" search, and, if you enable alerts, as a rounded home area so we know which sales to tell you about. We do not store your location together with your identity, except for a home postcode you choose to save in your own profile. You can decline location access and search by town or postcode instead. Postcode look-ups use the postcodes.io service, which receives the postcode you type but nothing else about you.

5. How we use your information

To publish and maintain accurate car boot sale listings
To review and publish your submissions, reviews, corrections and reports
To respond to your messages
To send email alerts and push notifications you have opted in to
To run your app account, saved sales and preferences
To keep the website, app and API secure and prevent spam

Our lawful bases are: performance of our service to you (handling submissions, alerts and your account), our legitimate interests (security, spam prevention), and your consent (marketing emails, push notifications, app analytics and crash reporting, location access), which you can withdraw at any time.

6. Third-party services

We do not sell your personal information. We use the following third-party services:

Google Firebase provides sign-in, the account database, push notifications and (only with your consent) analytics and crash reporting for the app. Google processes this data on our behalf under its data processing terms.
Google Play distributes the app and gives us aggregate crash and "app not responding" statistics for the app as a whole, under Google's own privacy policy.
Cloudflare delivers the website and API and protects them from abuse and attacks. Cloudflare processes connection data (such as your IP address) to route and secure traffic, and may set a small number of strictly-necessary security cookies on the website (see our Cookie Policy).
OpenStreetMap and CARTO supply map tiles for the maps on the website and in the app. Loading a map means your device requests tiles from those servers, which see your IP address as with any web request.
postcodes.io converts postcodes into coordinates for searches.
Our email provider sends transactional email such as alert confirmations and account messages on our behalf.
Google Analytics 4 (GA4) helps us understand how visitors use the website (pages viewed, approximate location, device type). Loads only after you accept analytics cookies in our consent banner.
Google AdSense displays adverts on the website that help fund running the directory. Adverts are shown whether or not you accept advertising cookies: until you accept, Google is told to serve non-personalised, contextual adverts chosen from the page you are reading rather than from a profile of you. Non-personalised adverts do not use cookies or device identifiers for advertising profiling, but Google may still use them for limiting how often you see the same advert, aggregated ad reporting and fraud prevention. If you accept, adverts may be personalised.
Google Search Console is a webmaster tool we use to monitor how the site performs in Google Search. It reads publicly available search data and does not collect visitor data from your browser.

On the website, Google Analytics and Google AdSense are implemented with Google Consent Mode v2: consent signals default to "denied". Analytics only activates once you give consent via our cookie banner; adverts are always shown but remain non-personalised until you accept advertising cookies. We may also disclose information to legal authorities where required by law.

7. Data retention and security

We keep personal data only as long as needed for the purpose it was collected:

Contact messages: while we deal with them
Alert subscriptions: until you unsubscribe
App account data: until you delete your account (see section 8)
Push device tokens: deleted when you turn notifications off, or after 90 days of inactivity
App analytics: two months, per the retention setting we have chosen in Google Analytics
Moderation logs for submissions and reviews: 12 months

We take reasonable technical and organisational measures to protect your information, but no website or app can guarantee absolute security.

8. Deleting your account

You can delete your app account at any time from inside the app: go to More, then Account, then Delete account. This removes your Firebase sign-in and all of your account data from our database immediately. You can also ask us to delete it by email. Full details, including what we keep afterwards, are on our Delete your account and data page.

You have the right to:

Access a copy of the personal data we hold about you
Have inaccurate data corrected
Have your data erased ("right to be forgotten")
Restrict or object to our processing of your data
Receive your data in a portable format
Withdraw consent at any time (for example, unsubscribe from alerts or switch off analytics in the app)

To exercise any of these rights, email [email protected]. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we handle your data.

10. Children's privacy

The website and app are not directed at children under 16, and we do not knowingly collect data from them. You must be 18 or over to submit a sale as an organiser. If you believe a child has given us personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. The new version will be posted here with an updated "Last updated" date, and the app links to this page so you always see the current version.

12. Contact us

If you have any questions about this Privacy Policy, email us at [email protected] or use our contact page.