Privacy at Treadstock

Last updated: 3 September 2026

Treadstock is software that independent auto shops use to keep track of the tires they store for their customers. This page says what it holds, where it is, who can see it, and what you can ask us to do about it.

It is written for two readers: a shop deciding whether to trust us with their customers' details, and a customer of that shop who wants to know what a tire shop's software knows about them.

Who is responsible for what

If you are a customer of a shop that uses Treadstock, your relationship is with that shop. They decide what to record about you and why; we hold it on their behalf and do only what they ask. If you want your details corrected or removed, ask the shop — they can do it, and if they need our help they will ask us.

If you are a shop, you are responsible for what you record about your customers, and for telling them you use software to do it. We are responsible for holding it securely, doing nothing else with it, and giving it back to you whenever you want.

What Treadstock holds

About a shop's customers

• Name, phone number, and email address if the shop records one
• Licence plate and a description of the vehicle
• Notes the shop types about the set or the customer
• Photographs of tires and of the storage area, taken at the counter
• What the shop charges for storage and whether it has been paid, including whether payment was cash, card, e-transfer or an invoice

We never hold card numbers. The software records *that* a card was used. It has no facility to store, process or transmit a card number, and no payment processor is connected to it.

About a shop's staff

• Name, role, and a one-way hash of their PIN or password — never the PIN or password itself
• Which phones have been registered to the shop
• Sign-ins, and the IP address and browser they came from
• A permanent record of every action taken in the software, and who took it

That last one is the point of the product: a shop needs to be able to answer "what happened to this set of tires", and that means the record cannot be edited or erased after the fact. Shops should tell their staff that the software keeps this record. Employers in some places must have a written policy about electronic monitoring; the terms say so.

What Treadstock does not do

• No advertising, and nothing is sold or shared with advertisers
• No analytics, no tracking pixels, no third-party scripts on the app
• No profiling, no scoring, no automated decisions about anybody
• No artificial intelligence or machine learning anywhere in the product
• Nothing about one shop is shown to another, including what they charge
• No cookies except the one that keeps you signed in

Where it is kept

• The application and its database run on Railway, in a data centre in San Francisco, United States.
• Photographs are stored on Cloudflare R2, in a private bucket.

Your data therefore leaves Canada and is stored in the United States, where it may in principle be subject to lawful access by US authorities. We tell you this plainly because you should be able to decide with it in front of you.

These two companies are the only third parties that hold any of it. Neither is permitted to use it for anything but running the service for us.

How it is protected

• Each shop's records are separated in the database itself, not merely by the application. A rule inside the database refuses to return one shop's rows to another, and an automated test proves two shops cannot see each other on every deployment.
• The application connects to the database with an account that cannot bypass that rule, cannot delete anything, and cannot change the structure of the database.
• Passwords and PINs are stored as argon2id hashes and cannot be recovered by anyone, us included.
• Photographs are never publicly readable. Each view is a link that is signed and stops working after five minutes.
• Everything travels over TLS.
• Every change is written to an append-only record that is chained cryptographically, so an altered or removed entry can be detected.

Our own staff cannot read your customers' data. The screen we use to operate the service shows counts, dates, staff names and whether a shop's records are healthy. It cannot show a customer, a plate, a photograph or a fee. Looking at a shop's data means signing in to that shop with the shop's permission, and that sign-in appears in the shop's own log.

How long it is kept

While a shop is a customer, their records are kept for as long as they want them: a set stored in 2024 is part of the history of that customer's tires and a shop may need it years later.

• A shop can export everything at any time, as spreadsheets, without asking us.
• A shop can ask us to delete the shop entirely. That removes its records, its staff accounts and its photographs, and frees its shop code. What survives is our own note that a shop existed and was deleted, with no personal details in it.
• If a shop stops paying a monthly licence, its records stay reachable for 30 days so they can be exported. We write to them before that window closes.

Photographs are deleted, not hidden. When a shop removes a photo, the file is deleted from storage. The record that a photo existed and was removed — with the reason and who did it — remains in the shop's log, because that is the shop's record of its own actions rather than a copy of the picture.

What you can ask for

Through the shop, you can ask to see what is recorded about you, to have it corrected, or to have it removed. The shop can do the first two themselves immediately. For removal, or if the shop needs a hand, they can reach us and we will help within 30 days.

If you would rather write to us directly:

David McConnell, operating as Treadstock 52 Shannondoe Crescent, Kanata, Ontario K2M 2H1, Canada [email protected]

If you are not satisfied with how we handle it, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, and if you are in Quebec, to the Commission d'accès à l'information.

If something goes wrong

If personal information is lost or exposed in a way that creates a real risk of significant harm, we will tell the affected shops without undue delay and help them meet their own obligation to notify their customers and the regulator. We keep a record of every such incident, whether or not it is reportable.

Changes

If this page changes in a way that affects what we do with your data, we will tell shops by email before it takes effect, not afterwards. The date at the top is the last change.