Garage

Privacy Policy

Last updated:

Lire en français

This policy covers the Garage car collection app, its supporting services, and this website. Garage is operated by Nawras M. Amin, an independent developer based in Quebec, Canada, using the brand name Varmada. For privacy questions or requests, contact Varmada's Privacy Officer at garage-support@mail.varmada.com.

Garage's operator determines why and how Garage processes personal information and is its data controller where that term applies. This notice explains processing; it does not replace a permission or consent required for a particular use.

Garage uses your account, capture photos, and optional capture locations to build your collection. Some profile information appears on leaderboards. The sections below explain those uses and the providers involved.

AI processing · Delete your account · Your privacy rights

1. Information Garage receives

Account and sign-in

When you sign in with Apple or Google, Garage receives the account information that provider supplies: an account identifier, email address, name, and profile-image URL when available. Apple may supply a relay email address. Garage stores your chosen username, account role, account timestamps, and the authentication records and sessions needed to keep you signed in. Garage does not receive your Apple or Google password.

Authentication records can include sign-in tokens, their expiry times, session identifiers, IP addresses, and device or browser information supplied with requests. These are used to authenticate requests, maintain sessions, and investigate unauthorized access.

Your captures and collection

A capture upload includes the original photo, a vehicle cutout, capture time, and optional location and subject-position information. Garage stores capture images and derived stickers with identification results, catalog matches, pending-review status, and collection progress. It also records XP awards, medals or related progress, streak information, and collection preferences needed by the features you use.

Photos can contain bystanders, license plates, addresses, or other personal information. Uploaded files may also contain embedded metadata. Keep unnecessary identifying details out of your captures; do not assume a cutout hides the contents of the original upload. Garage does not upload your entire photo library. If you choose an existing photo, the selected image is processed; photo-library access may also be requested when you save an image to your device.

Location and permissions

If you allow location access, Garage can obtain your location while you use location features and save coordinates with a capture. These coordinates can reveal a precise location. You can also choose or correct a spotting location on the map. This supports your capture map and recorded spotting locations. You can deny or revoke location permission in device settings; features that need your current position may then be unavailable. Garage does not request background location tracking.

Camera permission supports capturing vehicles. Notification-permission status is recorded with onboarding preferences when you make that choice. You can change permissions in device settings. Granting a permission does not give Garage unrestricted access to other information on your device.

Preferences and onboarding

Garage stores onboarding choices such as your Buddy name, interests, collection goals, knowledge level, how you heard about the app, preferred spotting settings, and whether you allowed notifications. These choices and completion markers help personalize the app and avoid repeating its introduction.

Local storage and support

Your device stores sign-in information, onboarding drafts and completion records, preferences, analytics checkpoints when enabled, and cached images or temporary capture files. Some onboarding information is saved locally before you finish signing in and synchronized with your account afterward. Files you save to your photo library remain under your control and may be backed up by services you enable on your device.

If you contact support, Garage receives your email address, message, attachments, and any account or technical information you provide. These are used to answer the request, resolve the issue, and keep a record of the resolution. Please avoid sending unrelated sensitive information.

Purchases and technical records

Garage and its subscription provider receive account or app-user identifiers, purchased product, subscription and trial status, transaction references, and renewal or expiry information. Apple or Google handles store payments; Garage does not receive your full payment-card number.

Service requests produce technical records such as IP addresses handled by infrastructure providers, request identifiers, timestamps, outcomes, timings, and errors. Recognition accounting includes the model used, token counts, estimated cost, and the associated account or capture identifiers. These records support reliability, energy limits, security, and cost control.

2. AI identification

Capture images are processed on your device to prepare the subject and sent to Garage's backend. The current recognition configuration sends a prepared version of the full photo to the selected AI provider; a prepared cutout can also be included when that option is enabled. Recognition instructions, earlier answers within the recognition request, and vehicle-catalog candidates are also processed. A full photo may reveal information beyond the vehicle itself.

Garage's recognition integrations include Google Gemini and OpenAI. Anthropic Claude can also process identification images if that integration is enabled. The model used can depend on your membership and the recognition configuration. Not every provider receives every capture.

Current recognition requests do not deliberately include your name, email, or capture coordinates as separate prompt fields. The image itself can still identify a person or place. Garage stores capture coordinates separately when you provide them.

Providers' API terms govern their processing, retention, and safety review. Google's Gemini API terms distinguish paid services, whose prompts and responses are not used to improve its products, from unpaid services, which can be used for improvement and must not receive personal information. OpenAI's API data controls describe no model training by default unless the customer opts in, alongside abuse-monitoring retention and exceptions. Anthropic publishes its commercial retention rules. These descriptions do not establish which account-level options are enabled for a particular request. Garage does not promise zero provider retention or that disabling response storage prevents all safety or legally required retention.

Identification can be inaccurate. Automated results affect collection features, eligibility for a catalog match, and in-app progress; they are not decisions about credit, employment, insurance, or another legal entitlement. Authorized administrators can review pending captures and inspect relevant images to resolve catalog and identification issues.

You can ask support to explain or review an automated result affecting your account, identify the information used, or correct inaccurate information. Include the capture or issue concerned, without resending unrelated personal information. You can decline future AI processing by not submitting further captures; recognition requires that processing.

3. Other users and sharing

Signed-in users can see leaderboard usernames, profile-image URLs supplied by sign-in providers when available, XP for the selected period, and ranks. A profile image from your Google account can therefore appear beside your Garage username. That image may identify you even if your username does not.

Garage's leaderboard responses do not include your email, private account identifier, capture photos, or capture coordinates. Your personal collection is not made public merely because you appear on a leaderboard. Authorized administrative access for support and review is separate from what other players can see.

Leaderboard participation currently follows eligible account progress; there is no in-app private-profile switch. Contact support about a profile disclosure or objection. Changing your sign-in provider's image may not immediately update the copy already held by Garage.

If you export or share a photo, sticker, or screenshot yourself, the recipient and destination service can retain it under their own rules. Garage cannot retract copies other people have saved.

4. Analytics and this website

When configured in a release version of the app, PostHog receives a limited set of onboarding checkpoints and filtered JavaScript error reports. These can include an app-user or account-linked RevenueCat identifier, an onboarding journey identifier, step names and timings, app version, operating system, and sanitized error details. These identifiers are pseudonymous, not necessarily anonymous.

The current integration disables session replay, automatic screen and tap tracking, geographic enrichment, and native crash collection. Capture photos, exact capture coordinates, names, and email addresses are not intentionally included in the analytics event allowlist. Technical information can still be processed by the provider when it receives a network request.

There is currently no in-app analytics opt-out switch. Send an objection or withdrawal request to the privacy contact below. Permission to use your camera or location does not by itself authorize unrelated analytics or advertising.

This website uses Kit's embedded form script to show launch-signup results without leaving Garage. The script records form visits and submission metadata, including page and referrer information, and may use browser identifiers or cookies to recognize visitors after signup. No separate website analytics or advertising pixels are configured. The website has no app-account registration form. Its hosting provider receives normal network and access information, such as IP address, browser request details, and requested files, to deliver and protect the site. The local video preview does not use an embedded social-media player.

The optional launch-notification form is separate from a Garage app account. It submits your email directly to Kit to manage confirmation, your launch-email subscription, and unsubscribe requests. Kit may also process submission and delivery information, such as request metadata and subscription status. Its Data Processing Addendum covers subscriber information processed for Garage; its Privacy Policy covers relevant independent processing. No capture photos or app-account information are submitted through this form. Signing up is optional; it does not create an app account or start a paid subscription. The list is used for Garage launch notifications, not unrelated marketing. Unsubscribe using the email link or contact Garage to request removal. Once launch notifications are complete, list data should be deleted unless another necessary purpose or fresh consent permits retention.

Garage currently has no active rewarded-ad integration. The app does not currently sell personal information or share it for cross-context behavioral advertising. If advertising or materially different tracking is introduced, the policy and any required choices or consent will be updated before that processing begins.

5. Why information is used

Information is used to authenticate you, identify captures, store and synchronize your collection, operate rankings, enforce energy and subscription access, answer support requests, prevent abuse, and maintain the service. It is not a license to use your private captures in unrelated advertising.

Where European or UK data-protection law applies, processing necessary to provide your requested account, recognition, collection, and subscription features is based on the service agreement. Necessary security and proportionate diagnostics may be based on legitimate interests, balanced against your rights. Processing requiring consent must rely on that consent, and legally required records are handled to meet legal obligations. These bases do not replace consent obligations under Canadian or other applicable law.

You can withdraw consent without affecting processing that was lawful before withdrawal. If information is necessary for a feature, withdrawing permission or asking for its deletion can prevent that feature from working. Optional permissions are not a condition of unrelated features. A new, incompatible use requires a lawful basis and any required notice or fresh consent.

6. Providers and disclosures

Service-provider access is for the purposes described above. Apple, Google, and other services may also act independently when you use their own accounts, stores, or maps; their privacy notices govern that independent processing. Garage remains responsible for its own handling of your information. Information may also be disclosed when lawfully required, to address fraud or a security incident, to protect rights or safety, or in a transfer of Garage's operation, subject to applicable privacy obligations and any required notice.

Information may be processed outside Quebec and Canada, including in the United States and other countries where providers operate. Foreign authorities may have lawful access under their local laws. Cross-border processing is subject to applicable assessment, contractual, and transfer requirements. You may request information about relevant destinations and safeguards, including a copy where the law entitles you to one. Garage does not claim a particular certification or signed transfer arrangement merely because a provider offers it.

7. Retention and account deletion

Account, preference, collection, and stored capture information is generally retained while your account is active so Garage can provide your collection across sessions and devices. Operational, recognition, and support records are retained for the purposes described here, including resolving errors, preventing abuse, and meeting legal obligations. Garage does not currently publish a single fixed retention period for all of those records.

Retention must remain tied to a necessary purpose. Relevant criteria include whether the account or request is active, whether a particular incident or dispute is unresolved, and whether a legal recordkeeping duty applies. Information that is no longer needed must be deleted or lawfully anonymized; removing a username alone does not make a record anonymous. You can ask for the retention information applicable to a specific category.

Releasing a capture is not a complete erasure request. It removes collection ownership, but historical analysis, image storage, or progress and accounting records may remain. Uninstalling the app or logging out also does not delete backend records.

Request account deletion: email garage-support@mail.varmada.com with the subject “Garage account deletion.” You can make this request without reinstalling the app. Send it from your sign-in email when possible, or provide your Garage username and explain if you cannot send from an Apple relay address. You can also request deletion of particular photos, locations, or other records instead of your whole account. Do not send passwords, payment-card details, or identity documents unless a proportionate verification step is separately explained.

The in-app account deletion control is not currently available. An account deletion request covers the account and associated personal information under Garage's control, including stored captures and locations, progress, preferences, and linked records held by its service providers, subject to lawful retention exceptions. Deletion can permanently remove your collection and access to it.

Garage will verify the request as needed, explain any necessary additional steps and expected handling time, and confirm the outcome. If information must remain for a legal obligation or a specific security or dispute purpose, Garage will explain the applicable reason and retention limits. Provider and backup copies may have separate deletion cycles; these do not create a general right to retain information indefinitely. Copies you saved to your own photo library or shared with others must be managed separately.

Deletion does not cancel an Apple or Google subscription. Cancel renewal through the store separately; see the billing instructions. A privacy request does not require a new purchase or payment.

8. Your choices and rights

You can control device permissions, stop submitting captures, change the account image with your sign-in provider where supported, cancel a subscription through the store, and contact the developer about your information. Revoking permissions affects future access; it does not automatically erase previously stored photos or locations.

Depending on the law that applies to you, you may request access, correction, deletion, a portable copy, restriction, or an objection to certain processing. You may also withdraw consent where it is the basis for processing and complain to a competent privacy regulator. These rights can have legal exceptions. Send requests or analytics objections to garage-support@mail.varmada.com; Garage will respond within the period required by applicable law.

Requests are handled using information proportionate to verifying your identity and the request. An authorized representative may act for you where allowed, with evidence of authority. If a request is refused, you may ask for reasons and a review by replying to the response; any statutory appeal or complaint rights remain available. Quebec access and rectification requests are subject to a 30-day response period. Other jurisdictions can have different deadlines and permitted extensions.

Quebec residents may contact the Commission d'accès à l'information du Québec. The Office of the Privacy Commissioner of Canada handles matters within its jurisdiction. EEA and UK residents may complain to their competent data-protection authority, including the UK Information Commissioner's Office where applicable. You do not have to exhaust Garage's support process before exercising a legal complaint right.

Where US state privacy law applies, the categories collected, their sources and purposes, and the recipients are described in sections 1–6; retention is described in section 7. Precise location and account-access information can be sensitive personal information. Garage uses these for the requested features and necessary security, rather than targeted advertising or decisions producing legal or similarly significant effects. Applicable rights can include limits on sensitive-data use, an authorized-agent request, and an appeal of a denied request.

Where applicable law provides a right to opt out of the sale or advertising-related sharing of personal information, the current service does not carry out those activities. You will not be treated unfairly for exercising a protected privacy right.

9. Children and security

The Garage app is intended for users aged 13 or older, subject to any higher minimum age required where they live. Where applicable law requires consent from a parent or legal guardian for a minor to use the service or for their personal information to be processed, that consent must be obtained before the relevant use or processing. Garage is not directed to children below the applicable minimum age. If you believe someone below that age, or a minor without required parental or guardian consent, has supplied information, contact the privacy contact so access can be addressed and the information deleted, except where the law requires retention. A parent or guardian can contact Garage about their child's information without creating an account.

Garage uses encrypted network connections in production and authenticated, owner-scoped access to private capture routes, with separate administrative access for maintenance and review. These measures reduce risk; no app, device, or network can guarantee complete security.

Report suspected unauthorized access to the privacy contact promptly. If a confidentiality or security incident triggers a legal notification duty, Garage must notify the affected people and authorities as required; this policy does not waive that duty.

10. Changes and contact

This policy will be revised when practices change. The date above identifies the current version. Material changes will be communicated as required, and new consent will be requested if necessary. Continuing to use Garage does not waive your privacy rights.

Privacy contact: Privacy Officer, Varmada, responsible for protecting personal information for Garage, Quebec, Canada, at garage-support@mail.varmada.com.