Privacy Policy

1. Who is responsible

Cast Garage is operated by MAK Software Solution, who is responsible for the personal information described in this policy. For privacy questions or requests, email privacy@castgarage.app.

2. Information we handle

Depending on the features you use, Cast Garage may handle:

• Account information: your email address, internal account identifier, basic profile details, authentication session, and information returned by a sign-in provider you choose.
• Collection information: Garage and Wishlist items, quantities, notes, tags, storage locations, condition, purchase details, catalog associations, imports, exports, and your edits.
• Photos: images you select or capture for vehicle identification and images you explicitly save with a Garage item.
• Scan results: structured identification results, candidate matches, confirmation status, and feedback. Submitted scan-photo bytes are not included in scan history.
• Technical and security information: app version, platform, device or installation identifiers, app-attestation signals, request identifiers, timestamps, route, response status, duration, and fraud- or abuse-prevention signals. Where used for rate limiting, network addresses are transformed with a keyed hash.
• Purchase and entitlement information: store-signed purchase status and subscription entitlement information. Cast Garage does not receive your full payment-card details.
• Support information: messages and other details you choose to send when requesting help or exercising a privacy right.

3. How information is collected

We receive information directly from you when you create an account, build your collection, upload a photo, import data, or contact us. We also receive limited authentication information from Google, Facebook, or Instagram if you choose an available third-party sign-in method; purchase status from Apple or Google when store features are used; and technical or security signals automatically when the app or website communicates with our services.

4. Photo and AI processing

The app removes available image metadata, limits image size, and sends selected scan photos to the Cast Garage backend for identification. The backend validates the image and processes it in request memory. It does not write submitted scan-photo bytes or a scan-photo path to the Cast Garage database, file storage, application logs, analytics, caches, or backups.

When AI identification is available, the backend sends the photo to OpenAI through the Responses API with provider-side response storage disabled. Cast Garage requires an approved provider-retention control before enabling real-user photo processing. OpenAI may still process or retain limited information where required under its applicable safety, abuse-monitoring, or legal obligations.

If you explicitly add a scan result to your Garage, the app separately uploads the in-session photos as private Garage images. These saved photos are not public and are not added to the shared catalog.

5. Why information is used

We use information to:

• create and secure your account;
• provide identification, catalog, Garage, Wishlist, import, export, and synchronization features;
• store private Garage photos you choose to retain;
• resolve entitlements and verify store transactions;
• enforce limits and protect the service from fraud, abuse, and unauthorized access;
• investigate failures and maintain service reliability; and
• respond to support, legal, and privacy requests.

Where applicable law requires a legal basis, we rely on performance of our agreement with you, our legitimate interests in operating and securing the service, compliance with legal obligations, or your consent where consent is specifically requested. You may withdraw consent at any time, without affecting earlier lawful processing.

6. Service providers and disclosures

We use service providers only for the functions described below and require them to handle information under their agreements and applicable law:

• Supabase: authentication, database, private file storage, server functions, backups, and operational logging.
• OpenAI: AI-assisted image identification when that feature is enabled.
• Cloudflare: delivery and security of the public Cast Garage website.
• Google, Facebook, or Instagram: authentication when you select the corresponding sign-in option.
• Apple and Google: app distribution, purchase verification, subscription management, and device/app integrity services.

Cast Garage currently contains no third-party advertising, behavioral analytics, or crash-reporting SDK. We may disclose information when required by law, to protect users or the service, or in connection with a business reorganization where legally permitted and properly notified.

7. Retention and deletion

• Account, collection, Wishlist, import, saved-photo metadata, and scan-result metadata are retained while your account is active or until you delete the relevant item.
• Submitted scan-photo bytes remain transient unless you explicitly save the photos by adding the result to your Garage.
• Private Garage photos are retained until you remove the associated item or delete your account.
• Security, request, transaction, deletion, and support records are retained only as long as reasonably necessary for service operation, fraud prevention, dispute handling, legal compliance, and enforcement.
• Deleted database information may remain temporarily in restricted backups until those backups expire under the hosting provider’s backup cycle. Backup copies are not used to restore a deleted account except where required for disaster recovery and are removed through normal expiry.

You can delete your account in the app under Settings → Account or use the instructions on the account-deletion page. Account deletion removes the account and associated private collection data from the active service and queues separately stored Garage photos for deletion. We may retain minimal records when required by law or necessary to establish, exercise, or defend legal claims.

8. Your choices and rights

You can review and correct collection data in the app, export your collection, remove individual items and photos, choose whether to save scan photos to Garage, sign out, or delete your account. Depending on where you live, you may also have rights to access, correct, receive, delete, restrict, or object to processing of personal information and to complain to a data-protection authority.

Submit a request to privacy@castgarage.app. We may need to verify that the request relates to your account.

9. International processing

Service providers may process information in countries other than the country where you live. Where required, we rely on contractual or other recognized safeguards for international transfers.

10. Children

Cast Garage is not directed to children under 16, and people under 16 may not create an account. If you believe a child has provided personal information, contact us so we can investigate and delete it where required.

11. Website cookies and logs

The public website does not use advertising or behavioral-analytics cookies. Cloudflare may process standard connection information, such as IP address, browser information, and request time, and may apply strictly necessary security mechanisms to deliver and protect the site.

12. Security

We use safeguards designed to protect information, including encrypted transport, authenticated access, owner-based data controls, private storage for Garage photos, short-lived signed image links, and app or device integrity checks. No transmission or storage system can be guaranteed completely secure.

13. Changes to this policy

We may update this policy as the service or legal requirements change. The current effective date will remain visible here. Material changes will be communicated in the app or by another appropriate method when required.

14. Contact

Operator: MAK Software Solution
Privacy and data requests: privacy@castgarage.app