Privacy Policy

1. Who is responsible

Cast Garage is operated by MAK Software Solution, who is responsible for the personal information described in this policy. For privacy questions or requests, email [email protected].

2. Information we handle

Depending on the features you use, Cast Garage may handle:

• Account information: your email address, internal account identifier, basic profile details, authentication session, and information returned by a sign-in provider you choose.
• Collection information: Garage and Wishlist items, quantities, notes, tags, storage locations, condition, purchase details, catalog associations, imports, exports, and your edits.
• Photos: images you select or capture for vehicle identification and images you explicitly save with a Garage item.
• Scan results: structured identification results, candidate matches, confirmation status, and feedback. Submitted scan-photo bytes are not included in scan history.
• Technical and security information: app version, platform, device or installation identifiers, app-attestation signals, request identifiers, timestamps, route, response status, duration, and fraud- or abuse-prevention signals. Where used for rate limiting, network addresses are transformed with a keyed hash.
• Purchase and entitlement information: store-signed purchase status and subscription entitlement information. Cast Garage does not receive your full payment-card details.
• Support information: messages and other details you choose to send when requesting help or exercising a privacy right.

3. How information is collected

We receive information directly from you when you create an account, build your collection, upload a photo, import data, or contact us. We also receive limited authentication information from Google or Facebook if you choose an available third-party sign-in method; purchase status from Apple or Google when store features are used; and technical or security signals automatically when the app or website communicates with our services.

Facebook sign-in is available only in approved, configured environments. We request only basic authentication and email permissions; we do not request friends, media, contacts, pages, or advertising data. The app does not save social-provider access or refresh tokens or profile payloads locally. Instagram sign-in is not available.

4. Photo and AI processing

The app removes available image metadata, limits image size, and sends selected scan photos to the Cast Garage backend for identification. The backend validates the image and processes it in request memory. It does not write submitted scan-photo bytes or a scan-photo path to the Cast Garage database, file storage, application logs, analytics, caches, or backups.

When AI identification is available, the backend sends the photo to OpenAI through the Responses API with response storage disabled. OpenAI may retain photos and other request content in abuse-monitoring logs for up to 30 days, or longer when required by law or reasonably necessary to prevent harm. Images flagged as potential child sexual abuse material may be retained for manual review. Disabling response storage does not disable this retention. OpenAI does not use API content to train its models unless the API customer opts in; Cast Garage does not opt in to share scan content for training.

If you explicitly add a scan result to your Garage, the app separately uploads the in-session photos as private Garage images. These saved photos are not public and are not added to the shared catalog.

5. Why information is used

We use information to:

• create and secure your account;
• provide identification, catalog, Garage, Wishlist, import, export, and synchronization features;
• store private Garage photos you choose to retain;
• resolve entitlements and verify store transactions;
• enforce limits and protect the service from fraud, abuse, and unauthorized access;
• investigate failures and maintain service reliability; and
• respond to support, legal, and privacy requests.

Where applicable law requires a legal basis, we rely on performance of our agreement with you, our legitimate interests in operating and securing the service, compliance with legal obligations, or your consent where consent is specifically requested. You may withdraw consent at any time, without affecting earlier lawful processing.

6. Service providers and disclosures

We use service providers only for the functions described below and require them to handle information under their agreements and applicable law:

• Supabase: authentication, database, private file storage, server functions, backups, and operational logging.
• OpenAI: AI-assisted image identification when that feature is enabled.
• Firebase Crashlytics (Google): crash and error diagnostics to investigate failures and maintain app reliability.
• Cloudflare: delivery and security of the public Cast Garage website.
• Google or Facebook: authentication when you select the corresponding sign-in option.
• Apple and Google: app distribution, purchase verification, subscription management, and device/app integrity services.

Cast Garage uses Firebase Crashlytics for operational crash and error diagnostics without a separate consent prompt. Reports can include stack traces, app version/build, operating system and device metadata, and per-installation identifiers. We do not attach account identifiers, collector notes, prices or purchase details, photos or image paths, model names, location, authentication tokens, or AI requests and responses to custom crash reports. Raw exception messages and Flutter diagnostic details are excluded from app-added reports. Cast Garage does not use a separate behavioral-analytics SDK. We may disclose information when required by law, to protect users or the service, or in connection with a business reorganization where legally permitted and properly notified.

Builds with advertising support include Google AdMob (Google Mobile Ads) and Google's User Messaging Platform (UMP). Ad delivery is available only to eligible Free users who confirm they are 18 or older, in approved countries, with fresh server permission and the required consent. Launch access and paid or complimentary Premium block new ad requests. Where consent is required, refusing or withdrawing it blocks ad requests. Required privacy options remain available in Settings even when advertising is disabled.

When advertising is enabled, Google may receive your IP address (which can indicate approximate location), app/ad interactions, performance and diagnostic information, and device or account identifiers for advertising, measurement and fraud prevention. Non-personalized advertising does not mean no data is processed. Android builds remove the advertising-ID permission; we disable the SDK same-app key, mediation initialization and SDK crash reporting. We do not attach Garage contents, scan photos, collector notes, purchase details, email addresses or our account IDs to ad requests. We do not request GPS location for advertising. SDK traffic uses TLS. Google's processing is described in its privacy policy.

Advertising country eligibility uses the connection IP with a local server-side country database, without an external geolocation request. This lookup does not store the IP in its country tables. Country data uses IP Geolocation by DB-IP (Country Lite, CC BY 4.0).

7. Retention and deletion

• Account, collection, Wishlist, import, saved-photo metadata, and scan-result metadata are retained while your account is active or until you delete the relevant item.
• Submitted scan-photo bytes remain transient unless you explicitly save the photos by adding the result to your Garage.
• Private Garage photos are retained until you remove the associated item or delete your account.
• Security, request, transaction, deletion, and support records are retained only as long as reasonably necessary for service operation, fraud prevention, dispute handling, legal compliance, and enforcement.
• Deleted database information may remain temporarily in restricted backups until those backups expire under the hosting provider’s backup cycle. Backup copies are not used to restore a deleted account except where required for disaster recovery and are removed through normal expiry.

You can delete your account in the app under Settings → Account or use the instructions on the account-deletion page. Account deletion removes the account and associated private collection data from the active service and queues separately stored Garage photos for deletion. We may retain minimal records when required by law or necessary to establish, exercise, or defend legal claims.

8. Your choices and rights

You can review and correct collection data in the app, export your collection, remove individual items and photos, choose whether to save scan photos to Garage, sign out, or delete your account. Depending on where you live, you may also have rights to access, correct, receive, delete, restrict, or object to processing of personal information and to complain to a data-protection authority.

Submit a request to [email protected]. We may need to verify that the request relates to your account.

9. International processing

Service providers may process information in countries other than the country where you live. Where required, we rely on contractual or other recognized safeguards for international transfers.

10. Children

Cast Garage is not directed to children under 18, and people under 18 may not create an account. If you believe a child has provided personal information, contact us so we can investigate and delete it where required.

11. Website cookies and logs

The public website does not use advertising or behavioral-analytics cookies. Cloudflare may process standard connection information, such as IP address, browser information, and request time, and may apply strictly necessary security mechanisms to deliver and protect the site.

12. Security

We use safeguards designed to protect information, including encrypted transport, authenticated access, owner-based data controls, private storage for Garage photos, short-lived signed image links, and app or device integrity checks. No transmission or storage system can be guaranteed completely secure.

13. Changes to this policy

We may update this policy as the service or legal requirements change. The current effective date will remain visible here. Material changes will be communicated in the app or by another appropriate method when required.

14. Contact

Operator: MAK Software Solution
Privacy and data requests: [email protected]