Privacy Policy
Last updated 10 November 2026
CarFX helps you track what your vehicles cost. We collect only what the app needs to do that, we do not sell your data, and we do not use advertising or tracking.
Who we are
CarFX (“we”, “us”) is the controller of the personal data described here, under the EU General Data Protection Regulation (GDPR).
This policy covers the CarFX mobile app and the website car-fx.com. Questions about it go to [email protected].
What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Sign-in email and password (stored only as a secure hash), or your Apple ID or Google account sign-in | To create your account and sign you in | Contract |
| Display name and contact email | To personalise the app and reply when you contact us | Contract |
| Vehicles, expenses, odometer readings, notes, reminders and expense categories | To provide the app’s cost tracking, reports and reminders | Contract |
| Preferences (currency, units, date format) | To show your data the way you chose | Contract |
| Subscription status (plan, renewal and expiry, an anonymous purchase ID) | To give you the features of your plan | Contract |
| A record of changes to your account and vehicles | To keep the service secure and investigate problems | Legitimate interest |
| IP address, held briefly in memory | To limit abuse such as repeated failed requests | Legitimate interest |
| Messages you send us | To answer them | Legitimate interest |
We do not collect your location, contacts, photos or payment card details. Payments are handled entirely by Apple (and Google Play on Android); we only learn whether your subscription is active. The app has no advertising, analytics or tracking SDKs. Reminder badges on the app icon are created on your phone and never sent to us.
Who else handles your data
We use a small number of service providers, each bound by a data processing agreement and allowed to use your data only to provide their service to us.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Sign-in and database | EU (Frankfurt, Germany) |
| Railway | Runs the CarFX server | EU (Netherlands) |
| Cloudflare | Secure network delivery | Global network |
| RevenueCat | Keeps track of subscription status | United States |
| Apple / Google | Sign in with Apple and Google, app stores, payments | Under their own privacy policies |
| Proton | Our support email | Switzerland |
Your app data is stored in the EU. Where a provider handles data outside the EU, the transfer is covered by the European Commission’s Standard Contractual Clauses or an adequacy decision. We do not sell or rent your data, and we share it with authorities only when the law requires it.
How long we keep it
We keep your data for as long as you have a CarFX account.
You can delete your account at any time in Settings → User profile → Delete CarFX account. This immediately and permanently deletes your profile, vehicles, expenses, reminders, categories and preferences. If you signed in with Apple, it also revokes CarFX’s access to your Apple ID. If you signed in with Google, you can also remove CarFX’s access in your Google Account settings.
Two things remain after deletion:
- Your sign-in record (email address) with our sign-in provider. Email [email protected] and we will remove it within 30 days.
- The change record described above, which keeps only an account identifier and no names or contact details. It is kept for up to 12 months for security, then removed.
Subscription and payment records held by Apple, Google and RevenueCat follow their own retention periods, including what tax law requires.
Your rights
You can ask us to access, correct, delete or export your data, to restrict or object to how we use it, and you can withdraw any consent you gave. Much of this you can do yourself in the app: edit your profile, export your expenses as CSV, or delete your account. For anything else, email [email protected]; we reply within 30 days.
You can also complain to your local data protection authority. In Bulgaria that is the Commission for Personal Data Protection (cpdp.bg).
Security
All data travels encrypted (HTTPS). Passwords are stored only as secure hashes, and each account can reach only its own data.
Children
CarFX is not intended for children under 16, and we do not knowingly collect their data.
Changes to this policy
We will post any changes here and update the date at the top. If a change is significant, we will also tell you in the app.