Data Processing Summary

The short version

This page sets out, purpose by purpose, what we process, why, how long we keep it and who receives it. For people in the European Economic Area, the United Kingdom or Switzerland, it also gives the legal basis and the other information required by Articles 13 and 14 of the GDPR and the UK GDPR. Carlore isn't offered there, but if you use it while you're there, these rights still apply to you. This page is a companion to our Privacy Policy; if the two ever differ, the Privacy Policy applies.

1. Controller and contacts

• Controller: Epicalin, LLC, 1810 N Burning Bush Ln, Mount Prospect, Illinois 60056, United States.
• Privacy contact: privacy@carlore.app.

2. What we don't process: your garage

The information you keep in your garage (vehicles, VINs and plates, spec sheets, papers and their images, service history, receipts, costs, mileage, tasks, recall checks, warranties, manuals, notes, the Glovebox, borrower guides and handover packages) is stored on your phone and in your own iCloud Drive or Google Drive, encrypted on your phone with a key we never receive. We don't collect, store, access or otherwise process it, so we are neither its controller nor its processor. Carlore also keeps it out of your phone's own backups, such as iCloud Backup. Text recognition for VINs, door-jamb stickers, papers and receipts runs on your phone. Handover packages, borrower guides, paper copies and exports leave your phone only when you send them yourself. Your use of Carlore to keep records of your own and your household's vehicles is a personal and household activity.

3. Lookups your phone makes directly (not processed by us)

These requests go from your phone straight to the organizations below. They never pass through our servers, and we don't learn what was looked up. Each organization handles the request under its own privacy policy, as an independent party.

• NHTSA, for VIN decoding and recall checks. Data sent: the VIN, or the year, make and model, and your phone's IP address as part of the connection. When: only when you ask Carlore to decode a VIN, tap Check now on a vehicle's recalls, or a recall check you scheduled runs. Sent to: the National Highway Traffic Safety Administration, a US government agency, through its public vPIC and Recalls services. Result: kept in your garage with the date of the check.
• Manufacturers' owner sites, for manual lookup. Data sent: the year, make and model, never the VIN or plate, and your phone's IP address as part of the connection; then, for a manual you confirm, the download request for that file. When: after you add a vehicle or tap Look again, and only if you said yes during setup; you can turn it off in Settings › Privacy & security. Sent to: the manufacturer's public owner site. When nothing is found there, Carlore can open a clearly labeled web search in your browser with the year, make and model filled in; it runs in your browser under your search engine's own policy, and Carlore calls no search service and doesn't see the results. Result: a confirmed manual is kept in your garage as your personal copy; a discarded suggestion is deleted at once and nothing about it is kept.
• Apple and Google, for your own cloud. Your encrypted garage files go to your own iCloud Drive or Google Drive, under your agreement with Apple or Google. For backup and sync, Carlore's Google Drive access covers only its own hidden app folder. Household sharing uses a separate encrypted file you select with the system file picker; access is limited to that file, and it never passes through our servers.

4. Account and sign-in

• Purpose: create and secure your account, verify your email, sign you in with a password, Apple or Google, reset passwords, connect sign-in methods, and end Carlore's access to your Apple sign-in when you delete your account or disconnect Apple.
• Data: email address and whether it's verified; optional display name; password as a salted scrypt hash; Apple or Google account identifier and the email they share; your name if Apple or Google shares it; an encrypted Apple token used to end Carlore's access when you delete your account or disconnect Apple; account status; when you last used Carlore, and on which platform; verification codes and reset links, stored only as hashes.
• Legal basis: performance of a contract (Article 6(1)(b)).
• Retention: until you delete your account; deleted from live systems within 24 hours and from backups within 30 days. If Apple can't be reached to end Carlore's access, only the encrypted Apple token is kept, for up to 30 days, to try again. An account created with an email address and password whose address is never verified is deleted 30 days after the last attempt to sign up with it. Verification codes are deleted within two days of expiring, and reset links within eight days.
• Shared with: Cloudflare (hosting and database, as processor); Apple or Google (identity verification and, for Apple, ending access on deletion, as independent controllers).
• Source: you, and Apple or Google if you sign in with them.
• Required? Yes. You need an account to use Carlore.

5. Consent and age records

• Purpose: record that you confirmed you're 18 or older, and which versions of the Terms of Service and Privacy Policy you accepted; and, in US states whose app store laws require it, check the age range Apple or Google provides and turn away anyone under 18.
• Data: the versions accepted, when, and on which platform, app version and build; when you confirmed your age. Never your date of birth. The age range from Apple or Google is checked on your phone, which remembers only the result and when it last checked; we don't receive or keep it.
• Legal basis: our legitimate interest in being able to show what was agreed and that we don't provide the Service to anyone under 18 (Article 6(1)(f)), and compliance with legal obligations where they apply (Article 6(1)(c)).
• Retention: until you delete your account.
• Shared with: Cloudflare (processor).

6. Signed-in devices and sessions

• Purpose: keep you signed in, show your signed-in devices, let you sign out anywhere, and alert you to sign-ins on other devices.
• Data: platform, your device model as the app reports it (never the name you've given your phone), app version, and when each session was created, last used and ended; refresh tokens stored as hashes.
• Legal basis: performance of a contract (Article 6(1)(b)) and our legitimate interest in account security (Article 6(1)(f)).
• Retention: while the session is active, then 30 days after it's signed out or expires (after 30 days without use).
• Shared with: Cloudflare (processor).

7. Service emails

• Purpose: send verification codes, password reset links, alerts about sign-ins on other devices, support confirmations and replies, deletion confirmations and important notices; and, for Plus Yearly, a confirmation of the renewal terms when you subscribe, reminders 35 and 20 days before each yearly renewal, and notice before any price increase; and, for Plus Lifetime, a receipt. Each billing email goes once, and is tried again daily if sending fails.
• Data: your email address and the message content, including for billing emails your plan, price and renewal date; our delivery record, with the address stored as a one-way hash, the kind of email, when it was sent and whether it was delivered; Cloudflare's delivery log, with the addresses each message was sent from and to and its subject line.
• Legal basis: performance of a contract (Article 6(1)(b)); compliance with legal obligations for the subscription emails (Article 6(1)(c)); and our legitimate interest in account security (Article 6(1)(f)).
• Retention: our delivery records for 30 days; Cloudflare's delivery log for up to 31 days. Cloudflare doesn't keep copies of the messages.
• Shared with: Cloudflare (email sending, as processor).

8. Plus purchases, codes and plans

• Purpose: verify purchases, keep your plan up to date, restore purchases, apply Family Sharing, redeem codes, handle refunds and resolve billing questions.
• Data: a reference derived from your account number that the app gives the store; the product, transaction or order identifiers, whether the purchase is yours or shared through Family Sharing, status, whether it renews, renewal and expiry dates; the price and currency you paid and, for Plus Yearly, the store's price for the next renewal (never the country of purchase); an encrypted Google purchase token; records of the billing emails we send you (which kind, for which purchase and renewal, when, and whether it was sent); codes you redeem; any Plus our team grants you, with an internal note.
• Legal basis: performance of a contract (Article 6(1)(b)); for billing email records, also compliance with legal obligations (Article 6(1)(c)).
• Retention: until you delete your account. Records of reminder and price change emails: two years at most; confirmation and receipt records stay with their purchase. Apple's purchase notifications, which identify a purchase only by Apple's transaction number: 180 days.
• Shared with: Cloudflare (processor); Apple or Google (payment and verification, as independent controllers).
• Source: you, and Apple or Google.

9. Automatic renewal records

• Purpose: keep proof that you agreed to Plus Yearly's automatic renewal, as California law requires.
• Data: the store; the store's transaction references (for Google Play, a one-way hash of the purchase token); the product; whether it was a test purchase; when you agreed; your app version and build; the version of the Subscription Terms you agreed to; and when the subscription ends. No email address or name.
• Legal basis: compliance with legal obligations (Article 6(1)(c)).
• Retention: at least three years, or until one year after your subscription ends if that's later (California Business and Professions Code section 17602(a)(6)), even if you delete your account sooner; then deleted. After an account is deleted, Apple's purchase notifications can still update when an App Store subscription ends, which sets this period.
• Shared with: Cloudflare (processor).
• Source: you, and Apple or Google.

10. Support, problem reports and feature requests in the app

• Purpose: answer your messages, investigate problems, and consider feature requests.
• Data: what you write; your email address; your account, if you're signed in; the platform and app version you sent it from; for problem reports, if you choose, your system version, device model and the last 200 lines of the app's log, with email addresses, tokens, codes, web address details and long numbers removed; any screenshot you attach to a problem report, and up to three photos or screenshots you attach to a feature request (up to 2 MB each); our replies.
• Legal basis: performance of a contract (Article 6(1)(b)) and our legitimate interest in improving the Service (Article 6(1)(f)).
• Retention: until two years after we close the conversation (as resolved, shipped or closed) or, while it's still open, two years after its last message or update, unless you ask us to delete it sooner; screenshots and photos with their conversation and no longer than two years after you send them, or within two days if they never get sent with a message; deleted with your account, screenshots and photos included, if it's linked to your account or email address.
• Shared with: Cloudflare (hosting, storage and email, as processor).

11. Emails you send to our addresses

• Purpose: read and answer emails you send to support@, privacy@, security@ or hello@carlore.app, and handle what you ask for.
• Data: your email address and name as your email shows them, your message and anything you attach, and our replies; Cloudflare's routing log, with the addresses and subject line.
• Legal basis: performance of a contract (Article 6(1)(b)) and our legitimate interest in answering people who contact us (Article 6(1)(f)).
• Retention: up to two years after the conversation ends, unless you ask us to delete it sooner; Cloudflare's routing log for up to 31 days. Deleting your account in the app doesn't delete these emails; ask us, and we will.
• Shared with: Cloudflare (email routing, as processor); Google (Google Workspace, which hosts our team's inbox, as processor).

12. Security, abuse prevention and server logs

• Purpose: keep the Service available and secure, limit request rates, detect and stop abuse, find and fix problems, and enforce our Terms.
• Data: IP address and request details, used in the moment for rate limiting and not kept by our servers; our servers' technical logs, recording for each request its time, kind and full web address, the response and how long it took, and the platform and app version, plus short error messages and the results of scheduled jobs, with no IP addresses, request headers or content you send (for our team's admin requests, the full web address can include the account number or email address they looked up); Cloudflare's sampled security records, which can include IP addresses and the country they come from; account status; our team's audit log of actions taken on accounts, which refers to accounts only by an internal number.
• Legal basis: our legitimate interest in protecting the Service and its users (Article 6(1)(f)), and compliance with legal obligations (Article 6(1)(c)).
• Retention: server logs for 7 days; Cloudflare's sampled security records for up to 31 days; audit log entries for two years.
• Shared with: Cloudflare (processor).

13. Anonymous diagnostics and crash reports

• Purpose: find and fix problems in the apps.
• Data: the kind and severity of the event; a technical title and message with identifying details removed; app version and build, platform, system version, device model, language and region setting, and app state; for crash reports you choose to send, technical details of the crash. Stored without your account details or IP address.
• Legal basis: your consent (Article 6(1)(a)): for diagnostics, given when you choose to share them during setup or in Settings; for crash reports, given each time you tap Send.
• Retention: deleted 90 days after we receive them.
• Shared with: Cloudflare (processor).
• Your choice: diagnostics are sent only if you choose to share them, and you can turn them off any time in Settings › Privacy & security; crash reports are sent only when you tap Send, and you can turn off being asked.

14. Usage statistics (optional)

• Purpose: understand which parts of Carlore are used, to improve it.
• Data: a random identifier created on your phone for this installation; platform and app version; the names of screens and features used, with times, and a few details such as whether a receipt was scanned or typed, or which cloud you chose. Never garage content (vehicles, VINs, plates, papers, receipts, costs, mileage or anything you type), location or advertising identifiers. The Glovebox never sends a usage event. Stored without your account details or IP address.
• Legal basis: your consent (Article 6(1)(a)), which also covers storing and reading the installation identifier on your phone.
• Retention: individual events for 90 days; daily totals without identifiers indefinitely.
• Shared with: Cloudflare (processor).
• Your choice: off unless you turn it on; withdraw consent any time in Settings › Privacy & security.

15. App settings and feature rollouts

• Purpose: send the app its settings (supported versions, maintenance notices, the features each plan includes, the generic maintenance presets and the list of manufacturers' manual sites), and switch new features on for a share of installations at a time, so changes can be released safely.
• Data: the platform and app version, and a random identifier created on your phone for this purpose, separate from the usage statistics one, sent when the app checks for settings.
• Legal basis: our legitimate interest in releasing changes safely (Article 6(1)(f)), which also covers storing and reading the identifier on your phone where the law allows.
• Retention: used only for the calculation, and not kept.
• Shared with: Cloudflare (processor).

16. Business reporting

• Purpose: understand how Carlore is doing, for example how many people sign up, upgrade or cancel, and which app versions and platforms are in use.
• Data: account and purchase records, used only to produce totals.
• Legal basis: our legitimate interest in running and sustaining the Service (Article 6(1)(f)).
• Retention: totals contain no personal data; the underlying records follow the retention periods above.
• Shared with: none outside Carlore, other than Cloudflare as processor.

17. Privacy requests, deletion records and legal matters

• Purpose: handle your privacy requests, show that we honored them, comply with the law and establish, exercise or defend legal claims.
• Data: your request and our correspondence; for each account deletion, a one-way code derived from the deleted account's internal number, who asked for it and when.
• Legal basis: compliance with legal obligations (Article 6(1)(c)) and our legitimate interests (Article 6(1)(f)).
• Retention: request correspondence for up to two years after the request is complete; deletion records for three years, so we can show deletions were honored. Deletion records contain no email address, name or other details.
• Shared with: Google (our team's inbox, as processor); professional advisers and authorities where the law requires.

18. Backups

• Purpose: recover from technical failures.
• Data: copies of our database (account, purchase, support and deletion records; passwords are left out of our nightly copies).
• Legal basis: our legitimate interest in keeping the Service reliable (Article 6(1)(f)).
• Retention: a rolling 30-day recovery history and nightly copies kept for 30 days. If we ever restore a backup, we delete again anything that had been deleted since.
• Shared with: Cloudflare (processor).

19. Transfers, automated decisions and your rights

• International transfers: Cloudflare and Google process data in the United States and other countries. We rely on the receiving company's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, or on the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss adaptations where needed. You can ask for a copy at privacy@carlore.app.
• Automated decisions and AI: we don't make decisions based solely on automated processing that have legal or similarly significant effects on you, and we don't use personal data to train artificial intelligence or machine learning models.
• Your rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority. Section 13 of our Privacy Policy explains them, and section 14 explains how to use them.