Privacy Policy

Last updated: September 23, 2026

This Privacy Policy explains what personal information Car Czar ("we," "us") collects, how we use it, whether we share it, and how you can request it be deleted. It applies to carczar.app and the Car Czar application.

What information we collect

When you create an account, we collect information depending on how you sign up:

• If you sign up with Google, Facebook or Apple: the authentication provider (Google, Facebook or Apple), your provider account ID, first and last name, email address, email verification status, profile picture URL, and locale — whatever that provider makes available to us for sign-in. If you use Apple's "Hide My Email", we receive an Apple-generated relay address instead of your real one, and Apple provides your name only the first time you sign in.
• If you sign up with email and password: your first and last name, email address, and password. Your password is stored and hashed by our authentication provider (Supabase Auth) — we never see or store it in plain text.
• For every account, regardless of sign-up method: if you choose to give it, your ZIP code. Google, Facebook and Apple do not provide a ZIP code, so we ask for it once after you sign in; you can skip it and add it later from your profile.

Once you're using Car Czar, we also collect the information you give us to run the service:

• Vehicle details you enter (year, make, model, trim, VIN, license plate, mileage, and any label or notes you add).
• Fill-ups you log (gallons, price, total cost, octane, odometer reading) and, if you allow location, where you were when you logged one — which is how we work out which station it was.
• Service and repair records you log (service type, date, mileage, shop name, complaint, cost, parts, notes).
• Ownership costs you enter, such as insurance premiums, registration fees, loan or lease payments, and what you paid for a vehicle.
• Files you choose to attach — photographs of receipts and invoices, and documents such as a registration or insurance card. These are stored privately: they can only be opened through a short-lived link generated for you, and no other account can reach them.
• Maintenance reminders you set or that we generate for your vehicles.
• Messages you send us through our Contact Us form (name, email, and message content).
• If you use gas prices: when you checked and which stations the check found (identified by Google's ID for each place, not by name or address), any price you report with “Price wrong?”, and — if you tell us — whether you belong to Costco, Sam's Club or BJ's, so we only count their prices when you can buy there.

Photographs taken by the scanner never leave your phone. When you point the camera at a pump display, an odometer or a VIN plate, the reading is worked out on the device itself and only the resulting number is sent to us. The image is not uploaded and not stored. This is different from a receipt you deliberately attach to a record, which is a file you are choosing to keep.

We also use privacy-respecting, self-hosted analytics (Umami) to understand aggregate site usage. Umami does not use cross-site cookies and does not sell or share data with third-party advertisers.

Gas prices and your location

Car Czar reads your location only while you are using a feature that needs it — checking gas prices, logging a fill-up, or finding car seat inspection stations near you — and never in the background.

• Checking gas prices sends your location to Google. When you check prices near you, your phone's location — or, if location is off, the center point of your ZIP code — goes through Car Czar's server to Google Maps, which finds the gas stations around you and their prices. We do not store that location with your check.
• Google's prices are not stored. The station names, addresses and prices Google returns are shown on your phone while the app is open and are not kept, by us or on your phone.
• Logging a fill-up uses your location to name the station. If it is a station Car Czar already knows, that happens without asking anyone. If not, the location is sent through our server to Google Maps once to identify it. The fill-up's location is stored with the fill-up.
• Fill-up reminders stay on your phone. If you turn them on, the reminder is scheduled by your phone from your fill-up history; nothing about it is sent to us or anyone else.

How we use your information

• To create and secure your account, and to authenticate you when you log in.
• To operate the core service: tracking your vehicles' maintenance and repair history, sending reminders, and surfacing relevant, timely recommendations for your specific vehicle.
• To use your home ZIP code to show you things near you, such as nearby car seat inspection stations and gas prices, and to center maps on your area.
• To compare what you paid for gas with the typical price near you, and show you what checking prices saved.
• To send you account-related email, such as a welcome email, email verification, and password reset instructions.
• To respond to messages you send us through the Contact Us form.
• To improve and operate the app, including through the use of AI in how we build and run the product.

We do not use your personal information to serve you third-party advertising, and we do not sell your personal information.

Whether we share your information

We share personal information only in these limited circumstances:

• Service providers who run our infrastructure: Supabase (our database and authentication provider) processes and stores your data on our behalf, under its own data processing terms.
• Sign-in providers: if you use Google, Facebook or Apple to sign in, those providers process your authentication according to their own privacy policies.
• Google Maps: the location sent to find gas stations and prices, or to identify the station for a fill-up, as described above. Google handles it under its own privacy policy.
• Other Car Czar users — gas prices only, anonymously: when you log a fill-up at a station, the price you paid, the grade, and roughly when (to the hour) may be shown to other Car Czar users as what “Car Czar drivers paid” there. Never your name, your account, your vehicle, or the exact time. You can turn this off in your profile under “Share the gas prices you pay”. A price you submit with “Price wrong?” is always shared this way — reporting it is how you share it, and the app says so before you send it.
• Affiliate links: Car Czar is free to use and is funded through affiliate links to relevant products and services (not general advertising). If you click an affiliate link, the third-party site's own privacy policy governs any information you provide there — we don't hand over your Car Czar account data as part of that.
• Legal reasons: if required to comply with a law, regulation, or valid legal process.

We do not sell your personal information to data brokers or advertisers.

How long we keep your information

We keep the information in your account for as long as your account is open, because that is the service: a maintenance and cost history is only useful if it is still there years later when you come to sell the car.

• Records you delete are deleted. When you remove a service record, a cost entry or a whole vehicle, it goes, along with anything attached to it.
• Attached files are removed within about a minute of the record, vehicle or account they belong to being deleted. Deleting a file is a separate step from deleting its record only in the sense that it happens moments later; you do not have to ask for it, and it is not left to a periodic clean-up.
• We keep a short deletion log. For about seven days after a file is removed we retain a note that a file at that location was deleted, and when. The note holds no part of the file itself. It exists so that we can answer the question "was this actually deleted" if you ask.
• Backups. Our database and file storage are backed up on a routine cycle by Supabase. A copy of deleted information can persist in those encrypted backups for a limited period until they are overwritten in the normal course.

Contact form messages are kept while we deal with them and for a reasonable period afterwards. Where the law requires us to retain something — or where we need it to prevent fraud or resolve a dispute — we keep only what is necessary, for only as long as it is necessary.

How to request deletion of your data

To request deletion of your account and associated data (profile, vehicles, fill-ups, service records, cost entries, reminders, gas-price checks and reports, and every file you have attached), email us at privacy@carczar.app from the email address associated with your account. We'll confirm your identity and complete the deletion, except for information we're required to retain for legal, security, or fraud-prevention purposes.

How to contact us

Questions about this policy or how your information is handled? Email us at privacy@carczar.app, or use our Contact Us form.

Changes to this policy

We may update this policy as Car Czar's features change. We'll update the "Last updated" date above when we do.