Privacy Policy

Car Manager is a fleet management application that helps individuals and small businesses track vehicles, fuel and maintenance expenses, shifts, and service providers. The App is operated by Sergii Solonyna, a private entrepreneur (FOP) registered in Ukraine, acting as the data controller ("the Operator").

Contact: [email protected]

We use the information to:

• Operate the App, authenticate you, and keep your data in sync across devices.
• Generate reports on your expenses, maintenance schedule, and shift history.
• Send transactional emails (email verification, invitations, billing receipts).
• Detect, prevent and debug technical issues and abuse.
• Process subscription payments via Stripe.
• Comply with legal obligations.

We do not sell your personal data. We do not use your data for advertising.

• Contract: to provide the service you signed up for.
• Legitimate interest: to keep the service safe, debug issues, and prevent abuse.
• Consent: for optional features such as Bluetooth OBD scanning and precise location.
• Legal obligation: to retain billing records and respond to lawful requests.

We share information only with:

• Stripe — payment processing.
• Authentication — handled by self-hosted Better Auth; credentials and session data are stored in our own database, not shared with a third-party authentication service.
• Sentry — crash and performance diagnostics.
• Google — only when you choose Google Sign-In or use Google Maps Places autocomplete.
• Cloud hosting — our database, backend and web application are hosted on cloud infrastructure located in the European Union.
• Law enforcement — when required by valid legal process.

We do not share data with advertisers, data brokers, or analytics resellers.

Your data is hosted on servers located in the European Union. Because the Operator is established in Ukraine, your personal data is accessed from Ukraine for the purpose of operating and maintaining the App, under appropriate safeguards (Standard Contractual Clauses).

Certain service providers may process limited data outside the EU: Stripe (payment processing) and Google (Sign-In and Maps Places) may process data in the United States under Standard Contractual Clauses and/or the EU–US Data Privacy Framework; Sentry (diagnostics) may process data outside the EU under equivalent safeguards.

Where data is transferred outside the EU, we rely on the safeguards offered by these providers under the applicable transfer mechanisms.

• Account data is retained while your account is active. When you request deletion, your account enters a 90-day retention window during which you can cancel; at the end of that window your personal data is anonymised. See Account Deletion for the full procedure. Billing records are retained for 7 years to comply with tax obligations.
• Sentry diagnostic events are retained for 90 days.
• Activity logs are retained for 12 months.

You may at any time:

• Access the personal data we hold about you — via the Profile screen or by emailing us.
• Correct inaccurate data — directly in the App.
• Delete your account — Profile → Delete account. Deletion begins a 90-day retention window (during which you can cancel by signing in again); your personal data is anonymised at the end of that window.
• Export your data — request via email; we will return a JSON archive within 30 days.
• Object or restrict processing — by email.
• Lodge a complaint with your data protection authority. In Ukraine this is the Ukrainian Parliament Commissioner for Human Rights (Уповноважений Верховної Ради України з прав людини); EU residents may complain to their national supervisory authority.

• HTTPS for all network traffic, with TLS certificates issued by Let's Encrypt.
• Passwords hashed with scrypt (Better Auth default parameters); session tokens stored in iOS Keychain / Android Keystore.
• Access to the production database is restricted to the Operator over SSH key authentication.
• Vulnerability reports may be sent to [email protected].

The App is not directed at children under 16 (or the higher minimum age required by your local law), and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

If you are a resident of California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, to access and delete it, and to opt out of its sale or sharing for targeted advertising. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. To exercise any of these rights, email us at [email protected]. We will not discriminate against you for exercising them.

We may update this policy. Material changes will be announced inside the App and by email. The "Last updated" date at the top reflects the current version.

For privacy questions, data requests, or to exercise your rights:

Email: [email protected]