How We Protect Your Information

CarTurf holds documents that matter — identity papers, vehicle files, and the records we need to register and insure your car. We treat that as private account data, not public website content.

A private server we operate · HTTPS everywhere · Two-factor authentication available

Read the Privacy Policy

Security

What we do to keep your account private

Everything below describes what the apps actually do today.

  • Storage

    A private server we operate

    Account records live in a secure database on a server we run ourselves. Documents are stored privately on that same server, not in a shared public cloud app and not on a public webpage. The website and the mobile app both talk to this server. We do not keep a second copy of your documents in a separate mobile database.

  • In transit

    Encrypted in transit

    Every connection between your browser or phone and CarTurf uses HTTPS.

  • Network

    The website sits on Cloudflare

    carturf.app is served from Cloudflare. Traffic is encrypted, and Cloudflare's network is built to absorb common internet attacks.

  • Sign-in

    Sign-in you control

    Email and password, or Google. Two-factor authentication is optional for customers and available in Settings. Staff accounts that operate the service are required to use it.

  • Sessions

    Sessions stay out of easy reach

    On the web, login sessions use secure, HttpOnly cookies — not local browser storage. On iOS and Android, tokens live in the operating system's secure storage (the same class of vault used for saved passwords). We do not put login tokens in links.

  • Access

    Access is limited by account

    You see your own vehicles, documents, and messages. Other customers cannot browse your files. CarTurf team members can see what they need to process registration, insurance, verification, and support — including identification you upload. That access is part of running the service; it is not a public gallery.

  • Payments

    Payments stay with the payment providers

    Card checkout is handled by Stripe or Airwallex. CarTurf does not store your full card number.

  • Your choice

    You can leave

    Request account closure from Settings. We will process the request as described in the Privacy Policy.

FAQ

Security FAQ

Short answers to the questions customers ask most.

Yes. Your documents, vehicle records, and account details live in a private CarTurf account. They are not published on the open web.

The website at carturf.app runs on Cloudflare. Your browser and phone connect over HTTPS, so information is encrypted while it travels. Account records sit in a secure database on a private server we operate ourselves — not a shared public cloud app. Uploaded files (passports, driving licences, vehicle papers, photos) are stored privately on that same server, next to the database. The iOS and Android app uses this same server: one account, one set of documents, the same access rules.

You sign in with email and password, or with Google. In Settings you can add two-factor authentication (an authenticator app) for an extra step at login. On the website, your session is kept in secure cookies that page scripts cannot read. On the phone, login credentials are stored in the device's secure storage, not in an ordinary file.

Only you and the CarTurf team members who need them to register, insure, or support your vehicle can see your files. Other customers cannot. Card payments go through Stripe or Airwallex; we do not store your full card number.

You can turn on two-factor authentication, reset your password, or request account closure from Settings. How we use personal data is in our Privacy Policy.

In your private CarTurf account, on a private server we operate. Records are in a secure database; files such as passports and vehicle papers are stored privately alongside it. They are not listed on a public webpage and are not meant to be found by search engines.

No. We do not put your account in a shared public cloud app. The database and files live on a private server we operate. The website is still served by Cloudflare; that is the public-facing layer, not where the documents sit.

No. Other customers cannot open your files. The CarTurf team can see identification and vehicle documents you upload because we use them to register, insure, and support the vehicle.

Yes. Both use the same private server and the same account. A document you upload on the website is the document the app sees, and the other way around.

Open Settings and enable two-factor authentication. You will need an authenticator app (such as Google Authenticator or 1Password). After that, signing in with a password also requires a one-time code. Google sign-in uses your Google account's own security, including whatever extra steps you have already turned on there.

No. Card payments are processed by Stripe or Airwallex. We do not keep your full card number.

Questions about a specific document or account?

Contact the team and we'll look at your case. Legal detail is in the Privacy Policy and Terms of Service.

Contact the team