CarDex Privacy Policy

Last updated: September 26, 2026

This Privacy Policy explains how CarDex Tech LLC (“CarDex Tech,” “we,” “us,” or “our”) handles information for the CarDex mobile application and related services (collectively, “CarDex” or the “Services”). CarDex lets people photograph, identify, collect, and share cars as digital cards. This policy applies to CarDex on both iOS and Android unless a section says otherwise.

CarDex Tech operates the Services and is responsible for the personal information described in this policy. The iOS application is currently distributed through TalkUp LLC’s Apple Developer account. In that limited distribution role, TalkUp LLC may receive Apple-provided transaction, subscription, sales, or support information and processes it in support of CarDex Tech. TalkUp LLC does not operate the CarDex service or independently determine how CarDex user data is used.

1. Information We Collect

1.1 Account Information

CarDex may create a guest or anonymous account and also supports sign-in through Google. Sign in with Apple is offered on iOS. When you use a sign-in provider, we receive basic account information such as your name, email address, and a unique account identifier, depending on the information you choose to share. We do not receive or store your Google or Apple password. Firebase Authentication assigns an identifier to each CarDex account, including guest accounts.

1.2 Photos, Scans, Collections, and Location

• Car photos: We process and store photos you submit to identify cars, create digital cards, and display your collection. CarDex may process images to reduce exposure of license plates, but automated processing may not identify every plate or sensitive detail.
• Scan and collection information: We store car identification results, correction requests, card details, garage contents, progress, challenges, achievements, and related activity.
• Location: If you allow location access, CarDex may collect precise or approximate location and save coordinates with a car spot. Location supports maps, nearby context, and a record of where a car was spotted. You can deny or disable location access and still save a car without coordinates.

1.3 Community Content and Interactions

If you use social or community features, we process the profile and content you provide, such as your display name, handle, profile photo, biography, featured badge, public cards, comments, reactions, friend connections and requests, leaderboard participation, blocks, reports, and moderation records. Content you choose to make public can be seen by other users and may be accessible through a public sharing link. Public collection summaries may include spot counts, collection value estimates, experience points, badges, and highlighted cars.

1.4 Purchases and Subscriptions

We and Superwall, our subscription-management provider, process purchase and subscription information such as product and transaction identifiers, purchase amounts and currency, subscription status, and events including trial starts, purchases, trial conversions, renewals, cancellations, expirations, billing issues, plan changes, and refunds. This information may be associated with your CarDex account and device identifiers.

• iOS: Apple processes App Store purchases and payment details.
• Android: Google processes Google Play purchases and payment details.

CarDex Tech and Superwall do not receive your complete payment-card number.

1.5 Device Identifiers, Usage, and Diagnostics

We and our providers may collect IP address, device type, app and operating-system versions, language, country or region, time zone, app installs and launches, session activity, feature interactions, crash and performance information, Firebase installation or app-instance identifiers, and notification tokens. Usage events may include signup, onboarding completion, scans, saved cars, community interactions, and subscription-offer activity. Information associated with your account or device is linked to you rather than anonymous.

• iOS identifiers: We may process Apple’s identifier for vendors (IDFV). If you authorize tracking, iOS providers may also process Apple’s advertising identifier (IDFA).
• Android identifiers: Android providers may process the Google Advertising ID and related app-set or installation identifiers where available and permitted by your Android and Google settings. The Advertising ID may be reset, restricted, or unavailable.

1.6 Information You Provide to Support

If you contact us, request account deletion, appeal a moderation decision, or otherwise communicate with us, we receive the information in your message and any attachments you choose to provide.

2. How We Use Information

• Authenticate you, maintain your account, and sync your garage across supported devices.
• Process photos, identify cars, generate cards, and improve automated results.
• Store and display your photos, cards, saved locations, profile, and collection progress.
• Provide sharing, comments, reactions, friends, leaderboards, reports, blocks, and moderation.
• Deliver subscription offers, verify paid access, restore purchases, and understand subscription performance.
• Provide notifications and reminders you enable.
• Analyze usage, reliability, security, and performance and improve CarDex.
• Measure which campaigns lead to installs, app activity, and subscriptions, subject to platform permissions and your privacy choices.
• Respond to support and deletion requests, enforce our Terms, prevent abuse, and comply with law.

3. Service Providers and Advertising Partners

We disclose information to providers that process it for the purposes described in this policy:

• Google Firebase and Google Cloud — iOS and Android: Firebase provides authentication, database, cloud storage, cloud functions, analytics, messaging, app integrity, and related hosting services. Google Cloud services also support automated car analysis.
• Superwall — iOS and Android: Superwall delivers subscription offers, manages access information, and processes subscription analytics and lifecycle events.
• Google services — primarily Android: Google Play provides Android distribution, billing, subscription management, purchase history, and app-integrity services. Google also provides optional sign-in on both platforms and mapping or location services where used.
• Apple services — iOS only: Apple provides App Store distribution and billing, Sign in with Apple, push-notification delivery, App Tracking Transparency controls, and privacy-preserving attribution such as SKAdNetwork or AdAttributionKit.
• Adjust — iOS only at this time: Adjust provides mobile attribution and analytics and may process device identifiers, device and app metadata, IP address, usage events, and purchase or subscription events to measure how people discover CarDex.
• Meta and TikTok — iOS advertising measurement only at this time: Through Adjust integrations, limited device, installation, app-event, and purchase information may be disclosed to measure and optimize campaigns promoting CarDex. Where permission is required, this occurs subject to that permission.

We do not send car photos or precise saved-spot coordinates through our advertising-attribution integrations. Advertising measurement promotes CarDex; CarDex does not display third-party advertisements inside the App.

Provider information is available from Google Firebase, Superwall, and Adjust.

We may also disclose information to comply with law, enforce legal rights, investigate fraud or safety issues, protect CarDex and its users, complete a corporate transaction, or follow a request you authorize.

4. Advertising Measurement and Platform Choices

Advertising measurement can involve associating activity in CarDex with a campaign or activity from another company’s app or website.

4.1 iOS

On iOS, we ask for permission through Apple’s App Tracking Transparency prompt before tracking that requires permission. If you select “Ask App Not to Track,” we do not access your IDFA or use another identifier to circumvent that choice for cross-company tracking. You can use CarDex and purchase a subscription without granting tracking permission. You can review your choice in Settings > Privacy & Security > Tracking. Apple’s privacy-preserving attribution may still provide limited campaign information without giving us your IDFA.

4.2 Android

On Android, Google provides controls for the Advertising ID and ad privacy features. Depending on your Android version, device, and region, you can reset or delete the Advertising ID and manage ad privacy choices in your device’s Google or Privacy settings. CarDex remains usable if an Advertising ID is unavailable or restricted.

These choices do not stop processing required to provide CarDex, maintain security, manage subscriptions, prevent fraud, or perform analytics that do not constitute cross-company tracking.

5. Public and Community Information

Information you publish can be copied, reshared, or viewed outside your intended audience. Do not post sensitive personal information or content you do not have permission to share. You can remove content where the App provides that control, leave a leaderboard, block another user, or report content or conduct. We may review reports and remove, restrict, or preserve content when needed for safety, enforcement, or legal reasons.

6. Permissions Used by CarDex

• Camera and photos: To capture, select, process, and upload car images.
• Location: To associate a location with a saved car spot when you choose to allow it.
• Notifications: To deliver reminders, community activity, and other enabled alerts.
• Tracking — iOS only: To request permission for advertising measurement that qualifies as tracking under Apple’s rules.
• Advertising ID — Android: Providers may access it for measurement where the identifier is available and use is permitted.

You can manage permissions in iOS Settings or Android Settings. Some features may not work without the permission they require.

7. Data Retention and Account Deletion

• Account, profile, photos, collection, location, and community data: Retained while your account is active and deleted when your account-deletion request is completed. In-app deletion normally removes this data from active CarDex systems immediately; verified email requests are normally completed within 30 days.
• Purchase and subscription records: Retained as needed to provide paid access, handle refunds and support, and meet tax, accounting, and legal obligations. Apple and Google control the primary marketplace transaction records under their own retention requirements.
• Google Analytics for Firebase data: User- and event-level data used in explorations is subject to the property's selected retention setting, which for a standard property is 2 or 14 months. Google's standard aggregated reports are not controlled by that setting.
• Firebase diagnostics: Firebase Crashlytics, currently used by the iOS app, keeps crash traces and associated identifiers for 90 days before removal begins.
• Superwall and Adjust: Subscription and attribution data is retained under our service agreements and each provider's policy, including while needed to provide the service, honor opt-outs and deletion requests, prevent fraud, or meet legal obligations.
• Security, fraud-prevention, and abuse-limit records: Limited pseudonymous identifiers, counts, and timestamps may remain separated from your active profile. They are not automatically deleted with the account and may be retained for the life of the service to prevent repeat abuse, enforce usage limits, resolve a security incident, or comply with law.
• Support and legal records: Retained until the request or dispute is resolved, and afterward only while needed for support history, security, accounting, or a legal obligation.
• Provider recovery copies: Firebase Authentication may take up to 180 days after deletion to remove authentication information from live and backup systems. Other provider recovery copies follow the provider's documented schedule and our agreement with that provider.

Learn how to delete your account in the CarDex account-deletion guide, or delete individual cards, saved spots, and photos while keeping your account. We may preserve specific information for longer if required by law, to protect users, resolve a dispute, or establish or defend legal claims. When possible, retained information is isolated from active product systems.

8. Children’s Privacy

CarDex is intended for users age 13 and older and is not directed to children under 13. We do not knowingly collect personal information from a child under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and delete it.

9. Security and International Processing

We use reasonable administrative, technical, and organizational safeguards to protect information. No storage or transmission method is completely secure. CarDex Tech and its providers may process information in the United States and other countries, which may have different data-protection laws than your country of residence.

10. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information; withdraw consent; or object to or restrict certain processing. Some laws may define disclosures for targeted advertising as “sharing” or a “sale” even when no money is exchanged. You can use the platform controls described above or contact us to exercise applicable rights. We may need to verify your request and may deny or limit it where permitted by law.

11. Changes to This Policy

We may update this Privacy Policy as CarDex, our providers, or legal requirements change. We will post the revised policy and update the “Last updated” date. We will provide additional notice when required by law.

12. Contact Us

If you have questions or want to make a privacy request, email contact@trycardex.com.