Privacy Policy

Last updated: August 2026

Introduction

Car Reveal is a mobile application and website that uses artificial intelligence to identify cars from photos. This privacy policy explains how we collect, use, store, and protect your personal information when you use our service.

We are committed to protecting your privacy and being transparent about our data practices. This policy describes the minimal data we collect and how it is used to provide you with car identification services.

Data Controller: Delpha Labs, France
Contact: delphalabs@gmail.com

Legal Basis for Processing

We process your personal data under the following legal bases (as required by GDPR):

  • Contractual necessity: Processing your photos for car identification and managing your account are necessary to provide the service you signed up for.
  • Legitimate interest: We process product analytics and limited anti-abuse data to improve the service, secure it, and enforce usage limits.
  • Consent: You consent to data processing when you sign in with Google and use the service.

Data Collection

Car Reveal collects the following types of data:

  • Photos: When you upload a photo to identify a car, we process the image using our AI service. The original full-resolution image is not stored on our servers. In the app, a compressed thumbnail (up to 1200px wide) is saved to Firebase Storage for your scan history. A normal anonymous website result is not persisted; if you choose “Share result,” we store the compressed thumbnail and identification result to create the public link.
  • Public Shared Results: When you choose to share a website result, anyone with its unique link can view the compressed photo and identification details. The link and its stored data expire after 90 days.
  • User Account: If you choose to sign in with Google, we collect your email address for account management purposes. This is stored securely using Firebase Authentication.
  • Scan History: We store information about your car identifications, including the thumbnail image, identified make/model/year, and timestamp. This allows you to access your scan history within the app.
  • Purchase Data: If you buy Car Reveal Pro, your purchase is processed through Google Play or the Apple App Store. We use RevenueCat to manage purchase status and entitlements. We do not directly collect or store your payment information (credit card numbers, billing address, etc.).
  • Product Analytics: We use PostHog within the app. For signed-in users, we send a Firebase user ID, email address, display name when available, app and device properties, and usage events such as screens viewed and scans completed. We use Google Analytics on car-reveal.com; it may use cookies and online identifiers to collect information such as pages visited, session duration, device information, and approximate location.
  • Security and Quota Data: Our web services temporarily process IP addresses for rate limiting, security, and monthly free-scan enforcement. The free web identifier stores a keyed one-way value derived from the IP address with the current month's scan count; it does not store the raw IP address in Firestore.

What we do NOT collect:

  • Original full-resolution images as persistent server-side files
  • EXIF metadata from photos (location, camera settings, etc.)
  • Payment card details

Data Usage

We use the data we collect for the following purposes:

  • Car Identification: Your photos are sent to the OpenAI GPT-4.1 API to identify the make, model, and year range of vehicles. This is the core functionality of our service.
  • Public Sharing: If you press “Share result” on the website, we store and serve the compressed thumbnail and identification details through a public link for up to 90 days.
  • Scan History: We store your scan history so you can access previously identified cars within the app. This includes thumbnails and identification results.
  • Service Improvement: We use product analytics to understand how the app is used, diagnose problems, and improve functionality and user experience.
  • Account Management: Your email address is used to manage your account, enforce scan quotas, and provide customer support if needed.
  • Security and Abuse Prevention: IP addresses and IP-derived hashes are processed to apply web quotas, rate limits, and security controls.
  • Purchase Management: Your Firebase user ID is shared with RevenueCat to manage your purchase status and entitlements.

Data Storage

All data is stored using Firebase (Google Cloud Platform) services:

  • Location: Our Firebase project is deployed in the EU region (europe-west1) to ensure GDPR compliance and data residency requirements.
  • Thumbnails: Compressed thumbnail images (up to 1200px wide) are stored in Firebase Storage for app scan history and for website results that users explicitly share.
  • Scan Data: Car identification results, timestamps, and metadata are stored in Firestore for app scan history. Explicitly shared website results are stored separately for the public link.
  • Authentication: User account information is managed by Firebase Authentication, which uses industry-standard security practices.

All data is encrypted in transit and at rest using Firebase's built-in security measures.

Data Retention

  • Scan data and thumbnails are retained until you delete them individually or delete your account.
  • Firebase account data and associated scan history are deleted when account deletion is completed.
  • Public website shares and their compressed thumbnails expire after 90 days and are removed by an automated cleanup process.
  • Web quota records contain a keyed one-way value derived from the IP address, the current monthly period, scan count, and request/image hashes used to prevent duplicate charging. They are retained as needed to enforce usage limits and prevent abuse; previous-period quota records are removed by an automated cleanup process after a new month begins.
  • Analytics data is retained according to our configured retention periods and the policies of PostHog and Google Analytics. Contact us if you want us to process a deletion request for analytics data associated with your account.
  • Purchase and transaction records may be retained by Google Play, Apple, RevenueCat, or us where needed for purchase restoration, fraud prevention, accounting, or legal compliance.

Deleting your Car Reveal account removes your Firebase account data, scans, and thumbnails from our service. It does not automatically erase records retained independently by app stores or service providers under their own legal obligations and retention policies.

Data Sharing

A result becomes publicly accessible only when you press “Share result.” Anyone with that unique link can view its compressed photo and identification details until the link expires.

We share data only with the following third-party services that are necessary to provide our functionality:

  • OpenAI: Photos are sent to OpenAI's GPT-4.1 API for car identification. OpenAI's API terms state that data submitted via the API is not used for model training. We do not send any personal information beyond the image itself. OpenAI Privacy Policy
  • RevenueCat: Your Firebase user ID and purchase status are managed through RevenueCat for in-app purchase processing. RevenueCat does not receive your email, photos, or scan data from Car Reveal. RevenueCat Privacy Policy
  • PostHog: For signed-in app users, we send a Firebase user ID, email address, display name when available, app and device properties, and product usage events to PostHog for analytics. We do not send car photos or scan-result content to PostHog. PostHog Privacy Policy
  • Google (Firebase & Analytics): We use Firebase for data storage and authentication and Google Analytics on our website to measure traffic and usage. Google Analytics may use cookies and online identifiers. You can opt out using the Google Analytics Opt-out Browser Add-on. Google Privacy Policy

We do not sell your data to third parties. We do not share your personal information with advertisers, data brokers, or any other parties for marketing purposes.

Your Rights

You have the following rights regarding your personal data:

  • Access: You can access all your personal data, including your scan history, through the app.
  • Deletion: You can delete individual scans from your history at any time within the app.
  • Account Deletion: You can delete your account, scans, thumbnails, and Firebase account information at any time. Analytics and store transaction records may require a separate deletion request or may be retained where legally required.
  • Rectification: You can request correction of any inaccurate personal data.
  • Restriction: You can request that we restrict processing of your data in certain circumstances.
  • Complaint: You have the right to lodge a complaint with a supervisory authority (in France, this is the CNIL — cnil.fr).

To exercise any of these rights, please contact us at delphalabs@gmail.com.

Children's Privacy

Car Reveal is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child under 13, please contact us at delphalabs@gmail.com and we will promptly delete it.

Security

We take security seriously and implement the following measures to protect your data:

  • Authentication: All user accounts are protected by Firebase Authentication, which uses industry-standard security practices including OAuth for Google Sign-In.
  • Quota Enforcement: Scan quotas are enforced server-side to prevent abuse and ensure fair usage of the service.
  • Secure API Endpoints: All API endpoints use HTTPS encryption to protect data in transit.
  • Data Encryption: All data stored in Firebase is encrypted at rest using Google Cloud's encryption standards.
  • Access Controls: Data access is restricted to authenticated users and is scoped to their own account data only.

Contact

If you have any questions, concerns, or requests regarding this privacy policy or how we handle your data, please contact us at:

Email: delphalabs@gmail.com

We will respond to your inquiry within 7 business days.

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the new privacy policy on this page and updating the "Last updated" date.

Your continued use of Car Reveal after any changes to this privacy policy constitutes your acceptance of the updated policy.