Security
This page is written for people who want to know, not to reassure. Where something is a deliberate trade-off rather than a guarantee, it says so.
The rules live in the database, not in the app
Every web app ships keys to the browser; that is unavoidable, and Milestamp’s are not secret either. That is why no security rule depends on what the app does. Who may see my data, who may write to it, who may take over a car — all of that is enforced by the database itself, including for someone bypassing the app entirely.
Your cars are yours
A signed-in user sees only their own cars, entries and receipts. There is no screen and no call that lets you look into someone else’s logbook. After a transfer, too, the receipts stay attached to the car and not to the account that once uploaded them.
What a shared link does and does not show
A share link shows the car and the maintenance: date, odometer reading, category, cost and the origin of each entry. Not your name, your address or your email address. The link contains a long, randomly generated code produced by the server and not by your browser — and you can revoke it at any time. On a transfer, every link expires by itself.
What this is not: a share link deliberately has no password, so that you can send it over WhatsApp. Anyone the recipient forwards it to can therefore see the report as well. Share it as deliberately as you would share a photo of your vehicle registration document.
Garages are checked
A garage can only write into a logbook once its RDW accreditation has been checked and its registration approved by hand. Every write is recorded with company, employee and timestamp. A garage can only reach the registration it is looking up at that moment, never a list of all cars.
How that verification works →It is actively attacked
There is a script that signs in as two ordinary users and then tries everything that should not be allowed: reading each other’s cars, downloading each other’s receipts, guessing a transfer code, editing a garage entry. If any of those attempts succeeds, the check fails. That is a stronger guarantee than a sentence on a website saying it is safe.
Found something?
Report it before you share it and it will be fixed. Reports are welcome and taken seriously, including when it turns out afterwards that there was no problem.