Privacy Policy

1Who we are

Dereck Ruzzman runs Car Repair Estimate and decides how your data is used. Under EU and UK law, that makes us the controller of your data. "We", "us" and "our" mean Dereck Ruzzman.

This policy covers the Car Repair Estimate iOS app, our server at api.carsrepairestimate.com and our website at carsrepairestimate.com. The website sets no cookies and runs no scripts.

To reach us, email carrepairestimate@apps.support or tap Contact support in the app's Settings.

2What we collect and why

Photos

You take photos in the app or pick them from your library, up to 4 per scan. The picker gives the app only the photos you choose. We use them to find the damage and price the repair.

The app resizes each photo and sends it to our server, which passes it to OpenAI. Our server holds it in memory while the scan runs and does not store it.

On your phone, full-size photos stay in the app's memory. They are not saved to your phone's storage or your camera roll. After a finished scan the app saves one small thumbnail on your phone. The app does not send that thumbnail to us or to OpenAI, but it can be in your device backups.

Photos can show faces, license plates, addresses and other people. Please keep these out where you can.

Your note

You can add a note. The first 2,000 characters go to OpenAI with your photos, to help describe the damage. We do not store the note on our server or your phone. The AI's written findings are stored, though, and they can reflect what your note said.

Please do not put names, injuries or health details in a note.

Car details

You can type what car it is, and we use the first 80 characters. The AI can also read the year, make, model and trim from your photos. Car details go to OpenAI and are saved in your estimate.

Damage areas and warning signs

You can mark damaged panels and tick warning signs, such as a flat tire, leaking fluid, airbags going off, warning lights, or steering and brake problems. Both go to OpenAI. We do not store them as you entered them. Warning signs can add a do-not-drive warning to your estimate, and that saved warning can say you reported them.

Location and currency

We use your location to price labor and parts for where the repair happens. The app does not use GPS and has no location permission.

Each time the app checks your plan with our server, which it does when you open the app and around each scan, our server reads the IP address of your connection and looks up an approximate city and currency in a database on our own server. It sends the answer to your phone. This lookup does not store or log your IP address, and it does not send it to anyone else. If the lookup finds nothing, the app uses the last location it found, or your phone's region setting.

You can change the city and currency in the app's Settings, under Location and currency. You can also change them for a single scan on the details screen. The location and currency set at the time of a scan go to OpenAI and are saved in your estimate.

Your random ID

On first use, the app creates a long random ID and keeps it in your phone's Keychain. It does not contain your name. It stays there if you delete and reinstall the app, and it is included in encrypted backups. It does not sync through iCloud Keychain. In the rare case the Keychain is unavailable, the app stores the ID in its own settings until it can be moved, and deleting the app then removes it.

A new phone gets a new ID, unless you set it up from a backup of your old phone. Restoring your purchase normally brings back your subscription on a new ID, but not your estimate history, which stays under the old ID.

We use it to keep your estimates, count your scans and check your subscription. The app sends it to our server on every call and to RevenueCat. Our server sends it to RevenueCat to check whether you have Pro.

Our database stores a SHA-256 hash of the ID, never the ID itself. Amplitude gets a different hash. A hash is not anonymous: anyone who holds your ID can work it out.

Your estimates

An estimate holds the car, location, severity, any do-not-drive warning, cost and time ranges, photo count, affected parts, line items, possible hidden damage, questions for a shop, and a rough value for your car. We use it to show you the result and bring your history back. It is saved on our server under your hashed ID, and on your phone.

Scan-count rows

Each scan creates a row with a hashed ID, the plan, the scan's status and a date. These rows run the free estimate and the monthly limit.

Purchase data

Apple takes your payment. We never see your card or bank details. RevenueCat receives purchase records (section 4). Our server only learns whether you have Pro and when that access ends. It saves the plan on each scan-count row.

Device and usage data

RevenueCat collects device details, Apple's identifier for vendors (IDFV) and your IP address, and we use these to run purchases. While analytics is on, Amplitude collects the same kinds of data and what you do in the app, and we use that to understand and improve the app. Section 4 lists this.

The switch for analytics is Share app analytics in the app's Settings. If your phone's region setting is in the EU, EEA, UK or Switzerland, it starts off. Everywhere else it starts on, from the first launch. The app goes by that setting, not by where you are. Settings appears once you have a saved estimate, so until then the switch stays as it started. RevenueCat keeps running either way, because subscriptions need it.

Server logs

Each request logs the method, path, status and time taken. A path can include an estimate ID. Each AI call logs the model, time, token counts and status. Our logging code does not record your IP address, your raw ID, your photos or your note.

Error logs give the error's name and message. If a database query fails, the log holds only an error code, not your hashed ID or the data in that query.

Your safety answers

Your answer to "Is everyone OK and away from traffic?" is not sent to our server. But if you tap "Someone is hurt" or the traffic, smoke or fuel option, the app opens an emergency screen, and while analytics is on, Amplitude records that this screen was viewed. The same applies to the do-not-drive screen. So Amplitude can hold a hint that you were in an incident.

Stored on your phone, not on our server

• Your deductible. Used for on-screen sums. It is not sent to us or to any other company, but it can be in your device backups.
• Renewal reminder. An optional local notification, off until you turn it on in Your plan. The app does not use push notifications.
• PDF reports. Saved as a temporary file. You choose where it goes from the share sheet.
• Your settings, such as your location, your AI data sharing choice and your analytics choice. They can be in your device backups. The location at each scan also goes to OpenAI and into your estimate, and while analytics is on, your AI choice is logged in Amplitude (section 3).

What we do not collect

We do not ask for your name, email, phone number or postal address. We do not collect GPS location, contacts or card details. The app does not ask for Apple's tracking permission, so it has no access to your advertising identifier (IDFA). If you email us, we get your email address and message, and use them to reply. Our email provider holds them for us.

What you must provide

You need photos to get an estimate, and you must allow AI data sharing. Your note and car details are optional. RevenueCat's device data is collected automatically while you use the app, and so is Amplitude's data while analytics is on.

3AI and OpenAI

Estimates are made by an AI model from OpenAI. Before your first scan, the app shows what will be sent and asks you to agree. Nothing goes to OpenAI until you tap Agree and continue.

What OpenAI gets: your photos, note, car details, marked panels, warning signs, location and currency.

What OpenAI does not get: your random ID, either hash, or your IP address. OpenAI sees a connection from our server, not from you.

How long OpenAI keeps it: we tell OpenAI not to store the response. Even so, OpenAI says it can keep inputs and outputs for up to 30 days in abuse monitoring logs, or longer if the law requires. Authorized OpenAI staff and contractors can review flagged content. Images flagged as possible child sexual abuse material are kept for manual review, and OpenAI reports apparent cases to NCMEC.

Training: OpenAI's terms say it does not use API data to train its models unless the customer opts in.

Rejected and failed scans: photos rejected as not a car, too blurry or showing no damage still reached OpenAI, and so did failed scans. They do not use up your plan. A request over your limit is stopped before it reaches OpenAI.

How a figure is made: the AI looks at your photos and details. It lists the damage it can see and damage that may be hidden, with parts prices, labor hours and rates for your location. Our server adds these up into a range. No person checks an estimate before you see it.

An estimate is a guide for you. It makes no decision about you with a legal or similarly significant effect. We do not use it for that, and your shop and insurer make their own decisions.

Turning it off: in the app's Settings, tap AI data sharing. The app will then ask again before your next scan, and nothing is sent unless you agree. This does not recall what was already sent or delete your estimates. Your choice is saved on your phone and, while analytics is on, logged as an Amplitude event. It is not saved on our server. Settings appears only once you have a saved estimate. Until then, the only way to clear your permission is to delete the app.

4Who gets your data

We do not sell your personal information. The app shows no ads and has no ad network inside it.

The companies below handle data for the app and website. OpenAI, RevenueCat, Amplitude and Railway each publish data protection terms that limit how they may use data they handle for us, and we expect them to protect it to the same standard as this policy. Apple, and Railway for its own usage data, act on their own behalf under their own policies.

We may add a paywall tool later: its software is already in the app but is not started, so it collects nothing, and we will update this policy before that changes.

How these records connect

The same IDFV goes to RevenueCat and, while analytics is on, to Amplitude, and RevenueCat also holds your raw ID. So the records these companies hold can be linked to each other. Sending Amplitude a hash does not make its data anonymous.

Other disclosures

We may disclose data if the law requires it, or to protect people, our service or our rights. If our business is sold or merged, data may pass to the new owner, and this policy will keep applying until you are told otherwise.

5Legal bases

If you are in the EU, EEA, UK or Switzerland, these are the legal bases we rely on.

6How long we keep data

A daily job on our server removes estimates and scan-count rows once they pass these limits.

7How to delete your data

In the app, open Settings, tap Delete my photos and estimates and confirm. This cannot be undone. If our server cannot be reached, nothing is removed and you can try again.

What this removes

• All your estimates on our server.
• The estimates and thumbnails saved on that phone.

What stays on our side

• Your scan-count rows, for up to 13 months. They hold a hashed ID, the plan, the status and a date. Without them, deleting your data would reset the free estimate.
• Server logs.
• Your raw ID in our server's memory cache, until it clears.
• A scan running at the moment you delete can still finish and save. If that happens, delete again.

What stays on your phone

• Your random ID, so you stay the same user.
• Your settings, including your deductible, location, AI data sharing choice and analytics choice.
• Any temporary PDF, any scheduled renewal reminder, and data stored by the tools in section 4.

What stays elsewhere

• Data held by OpenAI, RevenueCat, Amplitude and Apple. The delete button does not contact them. That includes photos at OpenAI, which can stay there, usually for up to 30 days but longer in some cases (section 3).
• Your device backups, and any PDF you shared.

Deleting does not cancel your subscription. You cancel through Apple (see our Terms of Use).

To ask for data at RevenueCat or Amplitude to be deleted, contact us at carrepairestimate@apps.support. We will act on what we can match to you (see below).

Deleting the app stops all new collection. It does not remove data already held by us or the companies above.

8Your rights

Once you have a saved estimate, you can delete your estimates, turn off AI data sharing and change Share app analytics in the app's Settings. Anyone can contact us with a question.

EU and UK

You have the right to:

• Get a copy of your data and information about how we use it.
• Correct data that is wrong.
• Have your data deleted.
• Restrict how we use it.
• Object to uses based on legitimate interests.
• Receive data you gave us in a portable format.
• Withdraw any consent at any time. This does not affect what happened before.

To stop analytics, turn off Share app analytics in Settings, or leave it off if it started off. Section 4 shows what can still reach Amplitude. RevenueCat keeps running, because subscriptions need it, and the app has no switch for Apple ad attribution. Turning the switch off does not delete what Amplitude already holds. If you email us, we will try to have past records deleted where we can match them to you.

Complaints. You can complain to us at carrepairestimate@apps.support. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome.

You can also complain to a regulator at any time. In the UK that is the Information Commissioner's Office. In the EU, you can complain to the data protection authority where you live, where you work, or where the problem happened.

California

What we collect and who receives it. We get this data from you, your device and Apple. Section 2 gives our purposes and section 6 gives how long we keep each kind.

What Amplitude receives depends on Share app analytics, as section 4 describes.

Selling. We do not sell personal information, including that of anyone under 16, and we have not done so in the past 12 months. The Apple ad attribution flow in section 4 is the one advertising-related data flow we set up in the app. The app cannot turn it off. Contact us if you want past records of it removed.

Sensitive information. The app asks whether anyone is hurt, only to show emergency help. We do not send that answer to our server, but while analytics is on, Amplitude records the emergency screen view (section 2). We do not otherwise ask for sensitive information, and we do not use it to infer things about you. A photo or note could contain it if you include it, so please keep it out.

Your rights. You can ask to know what we collect, delete it, correct it, and opt out of any sale or sharing. You can also ask us to limit any use of sensitive information. We will not treat you worse for using these rights. You can use an authorized agent, who must show that you gave permission. We respond within 45 days.

Signals. The app does not read Do Not Track or Global Privacy Control signals. RevenueCat, and Amplitude while analytics is on, collect data about your use of this app over time, as section 4 describes.

How to make a request

Email carrepairestimate@apps.support or tap Contact support in the app's Settings. We reply within one month in the EU and UK.

We hold no name or email for you, and the app does not show you your random ID. So we will tell you what we need to match a request to your data, which may include details from your App Store receipt. If you have never subscribed, we may have nothing to match you with. If we cannot match a request, we will tell you.

9If you appear in a photo

A user may photograph a car that shows you, your car or your license plate. We get that photo from the user, and we use it only to make their estimate. Our legal basis is in section 5.

Our server does not store it. OpenAI may keep it, usually for up to 30 days but longer in some cases (section 3). Estimates have no field for faces, license plates or VINs. Because we keep no copy, we cannot search for you in photos.

The rights in section 8 apply to you too. Contact us at carrepairestimate@apps.support with any concern.

10International transfers

Your data leaves your country when you use the app. The safeguards below are the ones named in each company's published data protection terms. You can ask us for a copy at carrepairestimate@apps.support.

11Children

The app is not for anyone under 18, and we do not knowingly collect data from them. The app does not ask your age.

Please keep children out of your photos. If you think a child has used the app, contact us at carrepairestimate@apps.support and we will delete what we can match.

12Security

• The app talks to our server over HTTPS.
• Our server does not store photos, and our database holds a hash of your ID, not the ID itself.
• The app has no login or password. A long random ID on your phone is what links you to your estimates, so anyone who got that ID could reach them. Keep your phone locked and your backups secure.

No system is perfectly secure. If a breach affects your data, we will tell you as the law requires. We hold no email for you, so we would do this in an app update or on this page.

13Changes to this policy

We review this policy at least every 12 months. If we change it, we will update the date at the top. For a material change, we will tell you in an app update or on this page before it takes effect. If we want to use your data for a new purpose, we will tell you first and ask for your permission where it is needed.

14Contact

Dereck Ruzzman
carrepairestimate@apps.support