Privacy Policy

• Account. Your phone number or email address, to send a one-time sign-in code, and session records so you stay signed in. Neither is shown to other collectors.
• Profile. What you choose to add: a display name, username, photo, banner, bio, city, workplace, Instagram handle and the brands you like. A real name is optional, and anonymous mode shows an alias everywhere other collectors can see you.
• Your cars. Make, model, trim, year, VIN, odometer, options, colors, photos and the acquisition details you enter.
• Documents. Ownership paperwork you submit for verification (title, registration, insurance), odometer photos, window stickers and history reports. Encrypted at rest, never public, and read only by the verification review and the document parser below.
• Activity. Watchlists, invites you send and redeem, badges, and first-party product events such as “car added”, which tell us how the product is used and where sign-ups come from.
• Bug reports. Your description, the screen you were on, viewport and appearance settings, browser or device info, and the element you point at. Reports work signed out, and then carry no account identity.
• Technical. Server logs (IP address, user agent) for security and abuse prevention, and a record of your acceptance of the terms (timestamp, IP, user agent) that the law expects us to keep. We do not collect precise location; your city is only what you type.

• to sign you in and keep your account secure;
• to run the product: your garage, valuations, sharing, the leaderboard, watchlists, invites and badges;
• to estimate market values from your car’s specification and public market data (your identity plays no part in the math);
• to review ownership proof you submit;
• to send the email described below;
• to understand usage through our own event log and privacy-respecting aggregate analytics;
• to prevent abuse and comply with law.

We do not sell personal data, and we do not use it for third-party advertising.

Your public page, the Discover feed, the leaderboard and share previews show only what your settings allow: you control, field by field, whether your collection value, average value, car count, rank, location, Instagram handle, top car, bio and watchlist appear. Anonymous mode hides your name, handle, photo and VINs behind an alias. Share links use unguessable identifiers you can rotate at any time. Sign-in details, documents and odometer paperwork are never public, whatever your settings say.

Service providers who process data on our instructions, each receiving only what its job needs:

• Vercel hosts the service and provides cookieless, aggregate web analytics;
• Neon hosts our database;
• Vercel Blob stores uploaded photos and files;
• Resend delivers our email, including sign-in codes;
• Twilio delivers our text messages, including sign-in codes;
• AI model providers (via Vercel’s AI gateway) transcribe documents and photos you submit, for example reading a VIN off a door-jamb sticker; the file is sent for that one extraction, and we do not permit training on it;
• RevenueCat, Apple and Google handle native subscription billing; we never see your card number;
• Instagram (Meta) only if you connect it, to import photos you select.

Beyond providers, we disclose data if the law requires it, to protect the safety and integrity of the service, or in a corporate transaction such as a merger, where this policy continues to apply to the transferred data.

Strictly necessary. One session cookie keeps you signed in. Arriving through a shared garage link sets a referral cookie for 30 days, so a sign-up can land back on the garage that referred you. On the native app the session token lives in the device’s secure storage.

Preferences. Small settings kept on your device such as the desktop phone frame, dismissed hints and this notice’s dismissal. Turn preference storage off in cookie preferences, reachable from the cookie notice and from your profile’s Settings tab.

Nothing else. No advertising cookies, no third-party trackers, no fingerprinting. Our web analytics are aggregate and set no cookie.

Transactional email covers sign-in codes and account changes, plus verification results and confirmations. Optional email covers badges, the rank digest and product news, each with its own toggle in Profile settings and a one-tap unsubscribe link. Security and account notices cannot be opted out of while you hold an account.

Text messages. Twilio is our SMS processor. We text you for two transactional reasons only: the sign-in code when you use a phone number, and an ownership transfer offer another member addressed to you. We send no marketing texts and never sell or share phone numbers for marketing. Reply STOP to any message to stop them. Message and data rates may apply.

Account data is kept while your account is active. Documents you delete leave the live system promptly, and routine encrypted backups age out on a schedule. Consent records, security logs and records the law requires are kept for as long as required. First-party product events stay identifiable only as long as the analyses above need them.

Traffic is encrypted in transit. Ownership documents are encrypted at rest with AES-256-GCM, are decrypted only for the review and parsing above, and have no public URL. Access to production data is limited and logged. No system is perfectly secure; if a breach affects your data we will notify you as the law requires.

Wherever you live, you can read and correct most of your data in the app, and you can ask us to access, correct, delete or export it by emailing privacy@stradale.xyz from the address or number on your account. Deletion removes your account, cars, photos and documents, apart from records we must keep by law.

European Economic Area and UK. You also have the rights to restrict or object to processing, to data portability, to withdraw consent at any time without affecting prior processing, and to complain to your supervisory authority. We process your data to perform our contract with you, for our legitimate interests in running and securing the service, and with your consent where we ask for it.

California. You have the rights to know, delete, correct and not be discriminated against under the CCPA. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of. An authorized agent may submit requests for you.

The service is not directed at children and requires you to be at least 18. We do not knowingly collect data from anyone under 13; if you believe a child has an account, email us and we will delete it. We operate from the United States and process data there, so using the service from elsewhere transfers your data to the US; where the law requires safeguards for that transfer we rely on our providers’ standard contractual clauses and equivalent mechanisms.

We may update this policy as the product evolves. For material changes we update the date at the top and ask you to accept again in the app; the current version always lives at this address. Privacy questions and requests go to privacy@stradale.xyz, and team@stradale.xyz covers anything else. The data controller is Stradale Technology, Inc.