Your garage data stays under your control.

Imanuel Harizi
Paul Ehrlich Strasse 15, 65428 Russelsheim am Main
Privacy contact: imanuel.harizi@proton.me

CapCar stores account details supplied through Supabase authentication and the garage records you create, including vehicle details, maintenance, builds, costs, wishlists, diagnostics, guide progress and visualizer settings. A complete garage snapshot is also kept in browser storage for responsive offline-tolerant use.

When you publish a Vehicle Passport, the selected passport record is available to anyone with its unguessable link until its optional expiry or until you revoke or delete it. Only the final five VIN characters can appear in a shared passport.

If you choose to connect Google, CapCar stores the connected email address and encrypted OAuth tokens. A manual sync checks upcoming calendar dates and recent Gmail subject/date metadata for travel signals; matching subject lines and summary counts may be stored with your private connection. Email bodies are not requested. A calendar event is created only when you explicitly choose Add to calendar.

When you use CapCar AI, your prompt, selected vehicle and route preferences, and only the planning context you choose are sent to your selected AI provider. Your provider key is encrypted at rest and can be disconnected from Account. CapCar does not use the key for other users.

Account, synchronization and export processing is necessary to provide the beta service you request. Security, abuse prevention and short rate-limit records support CapCar’s legitimate interest in operating a reliable private beta. CapCar does not sell garage data.

Netlify delivers the application and Supabase provides authentication and database storage. Opening an interactive 3D view connects your browser to Sketchfab. Vehicle, retailer and AI provider adapters remain in labelled demo mode unless the System page reports an activated external provider.

Google provides the optional Calendar and Gmail connection under Google’s own terms and privacy policy. The connection can be removed at any time from Account, and CapCar then deletes its stored connection record.

Gemini, OpenAI or Anthropic processes AI requests only when you connect that provider. Map and route links may open Google Maps, Apple Maps, Waze or OpenStreetMap under their own terms. CapCar currently uses no advertising tracker, session replay recorder or third-party web font service.

Garage snapshots and private records remain until you delete the garage or account. Expired or revoked Passport records stop being public but remain stored until you delete the link or account. Per-user API rate-limit state is replaced as new request windows begin. Account controls let you export, delete cloud garage data or permanently delete the account.

You can export the complete garage as JSON or CSV, correct records in the garage, revoke public links and delete stored data from Account. Depending on applicable law, you may also request access, rectification, erasure, restriction, portability or object to certain processing through the privacy contact above.

CapCar sends only service and account messages needed to operate the beta. Marketing email or SMS is not enabled. If marketing is introduced, it will require the applicable consent and a clear way to opt out.

If you allow analytics, CapCar uses PostHog Cloud (US) to measure page visits and selected actions, such as saved checklists, registration submissions, vehicle additions and trip creation. A random browser identifier helps measure returning visits; it is not linked to your account email. Browser and device information and IP-based location may be processed by PostHog. We exclude private record content, vehicle identifiers, trip locations and authentication query strings, and disable session recordings and automatic click capture. You can decline or withdraw permission using Analytics settings. This stops future tracking in that browser; it does not automatically delete previously collected events. Analytics does not measure visitors who decline, block tracking or enable Do Not Track.

This notice is a product-level baseline, not a substitute for review against the operator’s final business structure, contracts and deployment configuration. It must be reviewed before a public launch or activation of analytics, advertising, payments or new external providers.