Privacy Policy

CarSpot (“we”, “us”) lets you identify cars and build a collection. This policy explains how your data is used when you use our app and website.

Photos and AI identification

When you scan a car, the photo you submit is sent to our server, which uses Google's Gemini AI service to identify its make, model and year. If you are signed in and a car is identified, we keep a reduced-size copy of that photo on our servers so we can check identification quality and investigate abuse. Location and other metadata embedded in the photo are removed before it is stored. We automatically blur number plates in the copy we keep. The unblurred copy is deleted 30 days after the scan; the blurred copy is kept until you delete your account, when it is deleted. Automatic blurring can occasionally miss a plate. We also keep a short image fingerprint of each scan photo so we can recognise photos that have already been submitted. Only authorised CarSpot staff can view these copies. We do not use scanned photos to train AI models. Card photos and cutouts are stored on your device, and number plates in them are blurred automatically; a card cannot be shared until this is done. If a card photo still needs blurring, the app sends it to our server to find the plates, and that copy is not stored. Unless you turn it off, the picture on the card for each of your Verified spots is also shared in the CarSpot Feed with your username (see CarSpot Feed below). Stock and studio car images in the app also have number plates blurred. Do not scan people, private information or anything you do not have permission to photograph.

Before the app sends any of your photos to Google Gemini, it asks for your permission and names the service. Gemini is used to identify cars, find number plates to blur, and check pictures before they appear in the CarSpot Feed or as your profile picture. Until you allow it, you can't scan or upload a profile picture, and the app doesn't send card pictures for blurring or to the CarSpot Feed; the rest of the app still works. Your choice is saved on your device for your account and is removed when you delete your account.

Spot Map and location

If you allow location access, it is used to pin your spots on your Spot Map and for location features. The exact locations of your spots stay on your device. When you collect a card, the app sends the town or city, neighbourhood and country of the spot to our servers so we can award First Spot badges and local rarity bonuses, and, for spots that can appear on the Community map, count them in the place figures on our website (see Spotting figures on our website below). When you add a photo from your camera roll, the app also sends the time and location saved in that photo and your phone's current location, so our server can check whether the spot can be Verified. We keep only the results of these checks, such as how old the photo was and the distance in kilometres, not the coordinates. You can decline location permission and still collect cards; spots added from the camera roll without it are not Verified.

Community map

To build the Community map, the app also sends the 1 km grid square that contains each spot, never its exact location. We store the grid square with the card record only for Verified spots, and not when you have turned the Community map off or the spot is near your home area. It is deleted when you delete your account. The Community map combines these squares from all players into a heat map of the rarities spotted in each area. Spots appear no sooner than 24 hours after they are collected, and the map never shows usernames or other profile details. In Settings you can set a private home area, which we store rounded to about 100 metres and show only to you; your spots within 1 km of it never appear on the Community map. You can also stop your spots appearing on the Community map at any time. Both settings apply to your earlier spots as well.

Spotting figures on our website

Our website publishes totals of the cars CarSpot players have spotted: how many times each car model and brand has been spotted, and which cars, brands and card tiers have been spotted in each country, town or city, with neighbourhood totals. The spotting map on our website shows the same totals on a globe, with each town or city drawn as a single point in the middle of the square, about 5 km across, that holds most of its counted spots. The totals count Verified spots that are at least 24 hours old and whose card is still in the player's garage. A spot only counts towards a place when it could also appear on the Community map, so spots near your private home area, and all your spots while the Community map is turned off, are left out of the place figures. The figures never show usernames or other profile details, photos, when a car was spotted or exactly where, and they don't say how many players a figure comes from. They are a snapshot taken each time the website is updated, so deleting a card, turning the Community map off, changing your home area or deleting your account takes effect on the website at its next update.

Leaderboard

The leaderboard in the app ranks players by points earned from Verified spots, by number of Verified spots and by garage value (the estimated value of the car models they have spotted with Verified spots), for the current week and for all time. Other signed-in players can see your username, rank, points, number of spots and garage value there, and a Friends view ranks you only among your friends. It never shows your name, photos or where you spotted cars; tapping a username opens that player's profile (see Friends and profiles below). You appear on it by default, and you can hide yourself at any time from the Leaderboard tab in Community; this applies to every ranking straight away. We keep that choice until you change it or delete your account.

CarSpot Feed

The CarSpot Feed in the app shows cards for the car models spotted most in the last 7 days. When the card for one of your Verified spots shows your own photo or cutout, the app uploads that picture so other signed-in players can see it on that model's card in the Feed, labelled with your username. Tapping your username opens your profile (see Friends and profiles below). Your name, profile picture, and where and when you spotted the car are never shown with it. Cards set to Studio are not shared. Before a picture can appear, our server blurs number plates again and an AI check rejects pictures where a real car is not the main subject, a person's face can be recognised, a number plate can still be read, or anything is unsuitable for a general audience. If either step fails, the picture is not shown. Location and other metadata are removed from the copy we keep. We keep it until you delete the card, set it to Studio, turn sharing off or delete your account, or until we remove it after a report.

Sharing is on unless you turn it off in Settings in the app, under Privacy. Turning it off deletes the pictures you have shared straight away.

Players can report a picture, or hide every picture from the player who took it. A report hides the picture for the player who sent it and sends the picture, both usernames, the car model and the time to the CarSpot team, who use it to enforce our Terms. A picture reported by two players is hidden for everyone until we review it, and a picture we remove cannot be shared again. The player who took a picture is not told who reported it, or that someone hid their pictures. Reports and hidden players are deleted when either account is deleted.

Friends and profiles

Other signed-in players can open your profile by searching for your username, from the leaderboard, from a picture you shared in the CarSpot Feed or from an invite link you share. Your profile shows your username, a profile picture only if you uploaded one yourself (never the photo from your Google or Apple account) and your leaderboard rank and figures, unless you have hidden yourself from the leaderboard. Your garage (the cards you have collected, with each car model, rarity, finish, edition number, Verified status and date) and your Verified spots from the last 30 days are shown only to your friends: players who accepted your friend request or whose request you accepted. These cards are shown with CarSpot's own images, never your photos or where you spotted a car, and cards you delete from your garage stop being shown. You can remove friends, decline requests (the sender isn't told), block players, which also removes them as a friend and stops each of you finding the other, and report players. A report sends your username, theirs, the reason and the time to the CarSpot team, who use it to enforce our Terms. Friendships, requests, blocks and reports are deleted when either account is deleted.

When you choose a profile picture, the app sends it to our server, which crops it to a square, blurs any number plates it finds and uses Google Gemini to check that it is suitable for players of all ages and has no readable number plate. If a check fails or can't be completed, the picture is not used. We store only the checked copy, without location or other metadata, and delete it when you remove or replace it or delete your account.

Account and collection data

We process account details such as your email address, display name, username, optional avatar and authentication information to provide your account. CarSpot may process identification results and collection metadata to deliver its features. Each card you collect is recorded on our servers with the car model, time, finish and coarse place (if location is allowed) to calculate global rarity and the spotting totals on our website, plus the 1 km grid square for spots that can appear on the Community map; these records are linked to your account and deleted when you delete your account. Photos and cutouts on your device can be lost if you remove the app or change devices without transferring your data.

If you sign in with Apple, Apple shares an email address with us, which can be a private relay address that forwards to you, and the first time you sign in, your name if you choose to share it. If you delete your account in the iPhone app, the app asks you to confirm with Apple and then asks Apple to end CarSpot's access to your Apple Account. You can also stop using Sign in with Apple for CarSpot in your Apple Account settings at any time.

Subscriptions and notifications

CarSpot Pro is bought through Apple's App Store on iPhone, or Google Play on Android. Apple or Google processes your payment under its own privacy policy, and we never receive your payment card details. RevenueCat, our subscription provider, receives the details of your purchases from Apple or Google, such as the plan, price, store, and purchase, trial, renewal and expiry dates, linked to your CarSpot account, so the app can check whether you have Pro. We store whether your account has Pro and when it ends, and delete this when you delete your account. When you start a free trial, we also store your device's identifier for the app (Apple's identifier for vendor on iPhone, or the Android ID), the device type (iOS or Android) and the date, so the introduction isn't shown again if CarSpot is reinstalled on that device. This record is linked to your account when you sign in; deleting your account removes the link but keeps the record. Apple, Google and RevenueCat keep their own records of your purchases, which deleting your CarSpot account does not remove.

If you allow notifications, we store a device token for each phone you use CarSpot on, with the language the app is shown in so notifications arrive in that language, and we store which notifications you have chosen. When another player sends you a friend request or accepts yours, we send a notification through Expo and Apple or Google that shows that player's username. Spotting reminders are scheduled on your phone from the dates of your spots and are not sent from our servers. If you start a free trial and allow notifications, the app also schedules a reminder on your phone for the day before the trial ends; it is not sent from our servers either. You can choose which notifications you get in Settings in the app, or turn them all off in your device settings. A phone's token is deleted when you sign out on it, and your tokens and notification choices are deleted when you delete your account.

Service providers and sharing

We use Supabase for authentication, account storage, profile pictures and the pictures shared in the CarSpot Feed; Google's Gemini AI service, which we reach through Replit, the platform that hosts our servers, to identify submitted photos, find number plates to blur and check pictures before they appear in the CarSpot Feed or as profile pictures; RevenueCat for subscriptions; Apple and Google for purchases; and Expo, Apple and Google to deliver notifications. When you open the spotting map on our website, your browser loads the map itself from OpenFreeMap, which receives your IP address and the usual details your browser sends. If you choose to share a card to TikTok, Instagram or messages, your chosen destination handles the content under its own privacy policy. Trading and other community features are coming soon.

We do not sell your personal data. We do not use scanned photos or CarSpot Feed pictures to train models. Data may be processed by service providers where they operate, including outside your country.

Your choices and rights

You may request access, correction or deletion of your account data by contacting us. You can delete your account in the app or follow the instructions on our Delete Account page. You can stop sharing your card pictures in the CarSpot Feed in Settings in the app, which deletes the shared copies straight away. Device-stored photos and exact spot locations can be removed from your device. Applicable privacy laws may give you additional rights.

Security and changes

We use reasonable safeguards for data in transit and stored account information, but no service can guarantee absolute security. We may update this policy; the date above indicates the latest revision.

Contact

For privacy questions or rights requests, email info@carspotapp.com.