Your data, in plain English

Help & Rebuild is the UK community app for getting damaged and classic cars back on the road, and the data controller for the personal data described in this policy. We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC229778.

For anything about your data (a question, a copy of what we hold, a correction or a deletion) email car@helpandrebuild.co.uk. We'll sort it within 30 days, as UK GDPR requires.

Content you share with the community (your profile, builds, part lists, diary and listing photos, marketplace listings, messages, likes, comments, ratings and feedback) is stored securely on Help & Rebuild's servers, hosted on Supabase in the EU, so other members can see it and it follows you across devices.

Other signed-in members can see your display name, photo, the town you enter, your membership badge and what you post. Private chats are visible only to the two people in them, and that is enforced by the database, not just the app. Your email address is shown only to you.

Preferences like theme, recent searches, your saved search location and App Lock stay on your device only. The language filter that checks comments, listings and messages before they post runs entirely on your device too.

You sign in with Google or Apple through Rork's secure sign-in service. We only receive your name, email address and profile photo, which create your member profile. Session tokens are kept in the device's encrypted storage and removed when you sign out.

Photos you attach to builds, diary updates, listings, business profiles and your avatar are uploaded to Help & Rebuild's image storage so other members can see them. Your photo library and camera are only opened when you choose to add a photo.

Delete a build, diary entry or listing and its photos disappear from the app straight away. The files behind them are erased when you delete your account, or sooner if you ask.

Your location is used for one thing: finding restoration businesses and parts near you. On iPhone, the app only reads your GPS position when you tap the location button; otherwise, and always on Android, it works from the postcode you type. Either way the result is remembered on your device, never saved to your profile, and only the town you type on your profile is visible to other members.

To find nearby businesses the app sends your search centre and radius to our server, which asks Google's Places service for matching businesses. Google receives the coordinates and a search phrase (such as “classic car restoration specialist”) from our server, never your identity. Our server checks whether you're signed in (to set fair-use limits) but doesn't record who searched, and it keeps each area's results for up to 7 days, keyed by the area and trade rather than by you, so the same neighbourhood is never looked up twice.

Postcodes are turned into map positions (and, on iPhone, your GPS position into a nearest postcode) using postcodes.io, a free public service that receives only the postcode or coordinates. On iPhone, community shop results also come from OpenStreetMap, whose servers are contacted directly from your phone for the area you're searching.

Pro members can type a car's number plate to identify it for parts searching. The plate is sent over an encrypted connection to our server, which asks the DVSA's official vehicle service for the car's identity: make, model, year, engine size, fuel type and colour. No MOT history is shown or stored.

Results are cached on our server for up to 7 days (keyed only by the plate, not by you) to keep lookups fast, and cars you look up are saved to your “My cars” list so you can reuse them. Remove a saved car any time, and they're all deleted with your account.

Besides the photo safety check above, your content only reaches an AI provider when you choose to use one of the Pro and Business AI tools. Every request goes through our own server, which confirms you're signed in, counts how many AI requests your account makes each day to enforce fair-use limits, and forwards the request through Rork's AI gateway. We don't store the photos or text you send; our server keeps a technical log entry (your member ID, which AI model was used and how long it took), nothing more.

When you tap Analyse the damage in the Pro AI Rebuild Assistant, the photos you selected and the vehicle description you typed are sent to Anthropic's Claude vision model, purely to generate the assessment you asked for. Nothing else goes with them: not your name, email address, location, builds, chats or payment details.

Part Match on the Find Parts page sends only the car you selected and the part name you typed to the same Anthropic Claude model. No photos and nothing personal. The Pro Part Number Scanner sends the photo you take or pick of a part's label to Google's Gemini vision model, purely to read the number printed or stamped on it. Numbers are only ever read from your photo, never looked up or guessed, and scanned photos are not added to your profile or shown to other members.

If you run a business, the optional quote-draft tool sends the member's wanted-part request (its text and up to three photos) plus your business name, town, trade and stock list to Anthropic's Claude model to draft a reply, which nobody sees until you review and send it.

Every tool that sends a photo asks for your explicit agreement the first time you use it, and the disclosure stays on screen every time after that. If you never use the AI tools, nothing beyond the photo safety check is shared with an AI provider.

Turn on App Lock to require Face ID, Touch ID, fingerprint or your device passcode whenever the app opens. Biometrics are checked by your device's operating system. The app never sees or stores them.

Adding a phone number to a listing is optional. Turn on “Hide phone on listings” and the server never sends your number to other members; buyers can only reach you through in-app chat. It isn't just hidden in the app, it never leaves the database.

Optional Pro and Business memberships are billed through the App Store or Google Play. We never see or store your card details. Our subscriptions partner, RevenueCat, receives your purchase receipt, an anonymous identifier for your device and your member ID (a random identifier, not your name or email address) so your membership follows your account across devices and tells our server which tier to unlock. Your membership tier (Free, Pro or Business) is shown on your profile badge.

Business listings (name, address, phone, website, opening hours and public ratings) come from our own directory, from Google's Places service, from OpenStreetMap on iPhone, and from members who add or claim a business. This is business contact information and it is shown to every member.

To claim a business you send us a short message and a business email address or mobile number. These are stored with your member ID so our team can review the claim and get back to you, and they aren't shown to other members.

When a member views a business's page or sends an enquiry, an anonymous count is recorded (the business and the event, never who it was) so business owners can see how their profile is doing.

Block anyone from the menu in your chat with them. Blocking is enforced on our servers: blocked members can't send you messages and can't see your listings or your phone number. You can also report builds, comments, listings and members. Reports are stored with your member ID so our team can review them, and reported content is hidden from your view.

If you join the Android waitlist on helpandrebuild.co.uk, we store the email address you enter, and nothing else, on the same EU-hosted servers as the app, purely to let you know when the Android app opens for testing and when it launches. It isn't shared with anyone or used for any other marketing. Email car@helpandrebuild.co.uk at any time to come off the list and we'll delete it.

This website doesn't use analytics or advertising cookies. It is served by Cloudflare, which, like any web host, sees the IP address of each visitor in order to deliver the page. Its typefaces are loaded from Google Fonts, which means Google also receives your device's IP address when a page loads, as with any web font service.

Everything runs on a small number of carefully chosen services. Each receives only what its job needs, under its own privacy terms:

• Supabase: database, file storage and our server functions, hosted in the EU.
• Rork: Apple and Google sign-in, and the gateway our AI requests travel through.
• Anthropic (Claude): the AI Rebuild Assistant, Part Match and business quote drafts.
• Google (Gemini): the photo safety check and the Part Number Scanner.
• Google Places: nearby business search, called from our server.
• postcodes.io: turning UK postcodes into map positions.
• OpenStreetMap (Overpass and Nominatim): community shop results and place lookups on iPhone.
• DVSA: the official vehicle identity behind Reg lookup.
• RevenueCat, with Apple's App Store and Google Play: memberships and billing.
• Cloudflare: hosting for this website.
• Google Fonts: the typefaces on this website.

• What you post: until you delete it or your account.
• Reg lookup results: up to 7 days on our server, keyed by plate.
• Shop search results from Google: up to 7 days, keyed by area, not by you.
• Usage counts for the AI tools and the photo check: one number per account per day and nothing else; once your account is deleted it can no longer be linked to anyone.
• Technical server logs (member ID, tool used, timing, and any refused photo check): held by our hosting provider for a limited period for troubleshooting, then rotated out automatically.
• Waitlist emails: until you ask to come off the list.

Under UK GDPR you're in control of your data. Delete your account at any time from Profile. It permanently removes your profile, builds, listings, messages, photos, ratings and notifications from our servers, and no copies are kept.

Sign-in is handled by Apple or Google through Rork's sign-in service, so we hold no password of yours; once your profile is deleted the link to that sign-in is gone, and signing in again simply starts a brand-new, empty account.

You can also ask us for a copy of your data, or to correct it. Email car@helpandrebuild.co.uk and we'll respond within 30 days.

Help & Rebuild is registered as a data controller with the UK Information Commissioner's Office (ICO), registration number ZC229778.

As the app evolves we'll update this policy and change the date at the top. If a change materially affects how we use your data, we'll flag it in the app.

What changed on 16 September 2026 (the previous version was dated 6 September 2026):

• Added the automated photo safety check that every uploaded photo now passes, and the on-device number-plate hiding on build photos.
• Explained how shop search uses Google's Places service through our server, postcodes.io for postcodes and, on iPhone, OpenStreetMap. This replaces the earlier line that said your position was never uploaded.
• The Part Number Scanner now uses Google's Gemini model rather than Anthropic's Claude, and the typed part-number lookup has been removed from the apps.
• Noted that our server counts AI requests per account for fair-use limits and keeps a technical log without content.
• Corrected the membership section: RevenueCat receives your member ID rather than an anonymous ID.
• Added business claims, anonymous shop analytics, the list of services we rely on and how long we keep things.