Garaj ("we", "us", "our") is a social platform for car enthusiasts. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to the Garaj mobile app and related services.
Effective date: July 24, 2026.
Account: username, email address, and a password (stored hashed) if you sign up with email. If you sign in with Apple or Google instead, we receive basic profile information from that provider and you do not create a password with us. Profile details you choose to add: display name, bio, location, avatar, and cover photo.
Vehicles & content: vehicles you add to your garage (year, make, model, trim, color, mileage, VIN if you choose to share it), posts, photos, maintenance logs, drives, inspections, spot reports, reviews, comments, likes, saves, and messages you send to other users.
Support: messages you send us via email, including any diagnostic information you choose to include.
Device & usage: app version, operating system, device model, crash reports, and feature-usage events tied to your account (for example: "a post was created" or "the feed was refreshed"). These events are used to diagnose bugs and understand which features are used.
Location: when you record a drive, we collect GPS coordinates for the duration of that drive to compute your route, distance, and speed, and you control whether each drive's route and speed are shown publicly. When you choose to add a location to a spot or a post, or set your profile location, we use your current coordinates or a place you search for. Location is collected only while you are actively using one of these features — we do not track your location in the background except during an active drive.
Push tokens: if you enable push notifications, we store a device push token so we can deliver alerts.
To provide and operate the app: sign-in, rendering your garage, delivering posts and notifications, and enabling social features like following and messaging.
To improve the app: analyzing aggregate usage patterns, diagnosing crashes, and measuring which features are adopted.
To communicate: account-related emails, such as verification and password reset.
To keep the community safe: reviewing reports, enforcing community guidelines, and preventing abuse.
Supabase (database, authentication, file storage): stores your account and content.
Apple and Google (sign-in): if you choose to sign in with Apple or Google, that provider authenticates you and shares basic profile information (such as your name and email) with us.
Sentry (error monitoring and crash reporting): receives error and crash reports — including a truncated component stack, device metadata, and your account's user identifier and username so we can trace an issue to a session. Errors captured during normal use, not only hard crashes, may be included. We strip cookies before events are sent and do not send your messages, post contents, or precise location.
PostHog (product analytics): receives feature-usage events and your account's user identifier and public username so we can understand how features are used. This is first-party analytics only — we do not use your device's advertising identifier (IDFA), we do not track you across other companies' apps or websites, and we do not share these events with advertising networks or data brokers. We do not send your email, precise location, VIN, or the contents of your posts to our analytics provider.
Anthropic (AI features): when you use an AI feature — such as identifying a vehicle from a photo, reading a VIN from a photo, estimating market value, scanning a receipt or document, detecting modifications, or generating an inspection or listing — the photo(s) and/or text you submit for that feature are sent to Anthropic's Claude API through our secure server proxy to generate the result. Some AI features may also run a web search to help answer your request. Per Anthropic's API terms, this data is not used to train their models.
Expo (push notifications and app updates): we deliver push notifications through Expo's push service, so a device push token and the notification payload (which may include a message preview) pass through Expo. Expo also delivers over-the-air app updates and receives basic device information when your app checks for one. Apple and Google deliver the finished notification to your device.
OpenStreetMap / Nominatim (geocoding): when you search for a place or attach a location, or when we convert coordinates into a place name, the search text or GPS coordinates are sent to the OpenStreetMap Nominatim service.
Map imagery (CARTO, and Google Maps on Android): to draw maps of drives, spots, and locations, your device requests map tiles from these providers, which reveals your device's IP address and the map area being viewed.
RevenueCat (subscription management): receives a user identifier and your purchase / subscription status to manage your Garaj Pro entitlement. Payment is processed by Apple; we never receive your card details.
Each provider processes data under its own privacy policy. We do not sell your personal information.
Privacy controls: you can change the privacy level of each post, drive, spot, review, or inspection (public, followers-only, or private).
Analytics scope: Garaj uses only first-party, product-usage analytics tied to your account to improve the app; we do not track you across other apps or websites and do not use advertising identifiers. If you would like us to stop collecting product analytics for your account, email us and we will honor the request.
Push notifications: you can disable notifications in the app's settings or from the operating system settings.
Account deletion: at any time, you can permanently delete your account from Profile → Settings → Delete Account. This permanently removes your profile, your personal content (posts, drives, messages, and standalone photos), and any vehicles still in your garage along with the maintenance logs, inspections, drives, reviews, and photos you created on them. One category is retained in de-identified form, explained under "Data Retention" below: content you attached to a vehicle that another member owns — for example a car you transferred to someone else, or a spot you tagged to another member's vehicle — stays with that vehicle but is unlinked from your account.
Data access and correction: email us and we will help you access or correct your data.
We keep your information for as long as your account is active. When you delete your account, we permanently remove your profile, your personal content, and the maintenance logs, inspections, drives, reviews, and photos on vehicles you still own, within 30 days.
Content attached to another member's vehicle: some content lives on a vehicle rather than only on your profile — for example the service history of a car you transferred to another owner (maintenance logs, inspections, drives, reviews, posts, and photos), and spots you tagged to vehicles owned by other members. So the vehicle keeps an accurate history for the person who owns it — much like a paper service book that stays with the car when it is sold — this content is retained, but we unlink it from your account by removing your user identifier so it no longer identifies you.
A vehicle's basic identity record (such as make, model, and VIN) may also remain in our vehicle database in de-identified form, without a link to your account, so its history stays coherent for current or future owners.
Some information (for example, abuse reports and transaction records) may be retained longer where required for legal, safety, or accounting reasons.
Garaj is not directed to children under 13, and we do not knowingly collect information from children under 13. If you believe a child under 13 has created an account, contact us and we will remove it.
We use industry-standard safeguards (encryption in transit, hashed passwords, scoped database access) to protect your information. No system is perfectly secure; please use a strong, unique password and keep your device up to date.
Your information may be processed in the United States or other countries where our service providers operate. By using Garaj, you consent to this transfer.
We may update this Privacy Policy from time to time. Material changes will be communicated through the app or by email. The "effective date" above will reflect the latest version.
Questions about this policy? Email us at mycarsgaraj@gmail.com.