Privacy Policy
This Privacy Policy describes how Car Lounge ("we", "us", "the app") collects, uses, and shares information when you use our mobile app for iPhone and Android and related services.
Quick links: Location · Sponsored ads · Third-party services · Delete your account · Child Safety Standards
1. Information we collect
Information you provide when you sign up:
- Email address — for account authentication and password reset. If you sign in with Apple (on iPhone, where offered), Apple gives us a token that identifies your Apple account and, if you choose to share it, your email address or an Apple private-relay address. We exchange the one-time code from that sign-in for an Apple refresh token and store it on our servers, where only our server can read it; it is never sent back to your device. We use it for one thing: to revoke Car Lounge's access to your Apple ID when you delete your account, as Apple requires. We never see or store your Apple password.
- Handle and display name — chosen during onboarding, visible to other users.
- Area — the state/region you select to scope meets and local groups. Choosing an area does not require location access; if you allow it, we use your location to suggest one (see Location).
- EULA acceptance timestamp — for compliance recordkeeping.
Information you create using the app:
- Vehicle data — make, model, year, trim, ownership status (current/previous). VIN if you choose VIN entry (decoded via NHTSA, not stored after decode).
- Vehicle photos — exterior and dashboard images you upload for verification. Verification photos are analyzed automatically (see Third-Party Services), and a VIN visible on your dashboard may be read and stored as part of your verification record.
- Profile content — avatar, cover photo, bio, garage customization (themes, animations, banners).
- Posts and reels — text, photos, and short videos you publish, including any vehicle tags you attach.
- Chat messages — messages you send in group chats and direct messages.
- Meet RSVPs and locations — if you host or attend a meet, the location and attendee list are part of the meet record.
- Shop service requests — if you send a request to a shop, the name, phone number, email address, vehicle, and message you enter are sent to that shop. The shop keeps them even if you later delete your account (see what we keep).
- Shop applications — if you apply for a verified shop account, the business name, phone number, website, EIN (US tax ID), and description you enter are reviewed by the Car Lounge team.
- Reports and blocks — users, posts, or messages you report or block.
- Contact email hashes (optional — Find Friends) — if you use Find Friends and grant contacts permission, we compute one-way SHA-256 hashes of your contacts' email addresses on your device and send only those hashes to our server to check which of your contacts are already Car Lounge members. The hashes are compared against member accounts and are not stored after matching. Names, phone numbers, and raw email addresses never leave your device; text invites open in your own messaging app. You can revoke contacts access at any time in your phone's settings (iPhone: Settings → Car Lounge → Contacts; Android: Settings → Apps → Car Lounge → Permissions).
Information collected automatically:
- Account ID — a random identifier assigned at signup, used to link your data within Car Lounge.
- Device push tokens — a token for each phone you're signed in on, used only to deliver push notifications to you. A phone's token is removed when you sign out on that phone, and all of them are deleted with your account. On Android, Google's Firebase Cloud Messaging creates a push token and a Firebase installation ID when the app first opens, even before you allow notifications.
- Usage events and crash reports — see Analytics and crash reports.
- Sponsored ad views — see Sponsored ads.
- Platform (iPhone or Android), OS version, and app version — for compatibility and support.
We do not collect: your location in the background, advertising identifiers (Apple's IDFA or Google's Android advertising ID), your address book itself (the optional Find Friends feature uploads only one-way email hashes as described above — never names, phone numbers, or raw addresses), browsing history, or biometric data outside the Stripe Identity flow described below.
2. Location
Location access is optional, and Car Lounge works without it. If you allow it, Car Lounge uses your location only while the app is open; it never collects location in the background. We use it to:
- Suggest your area (your state) for local groups and meets.
- Alert you to meets near you. Each time you open the app, we save an approximate location (rounded to about 1 km) so that, if nearby meet alerts are on, we can notify you when a meet is posted within the distance you choose (Settings → Change area). This location is stored privately on our servers, is never shown to other users, and is replaced each time it is updated. Turning off location or nearby meet alerts clears it.
- Pin a meet. If you host a meet, you can use your current location to place it on the map. The meet's location is shown to users who can see the meet.
- Live Map (opt-in). Location sharing on the Live Map is off until you turn it on. While it is on, Car Lounge shares your precise location (your phone's GPS position) and direction of travel, updated every few seconds while you move, together with your handle, display name, photo, and primary car. Any signed-in Car Lounge user can see a driver who is sharing (in the app, each user is shown the drivers sharing near their own location).
- Foreground only. Sharing works only while Car Lounge is open on your screen. If you switch away from the app, sharing stops and you are taken off the map (newer versions of the app resume it by themselves if you come back within 15 minutes). Car Lounge never shares or collects your location in the background.
- On until you turn it off. Once on, sharing continues until you tap the stop button, sign out, or turn off location for Car Lounge. In newer versions of the app it continues on every screen; in older versions it also stops when you leave the Live Map.
- Old positions are removed. If your position stops updating without sharing being turned off (for example, the app crashes or loses its connection), it is shown greyed out and is removed from the map no later than 2 hours after the last update.
Maps in the app are displayed by Apple Maps on iPhone and Google Maps on Android. The map provider receives the area of the map being viewed and technical information such as your IP address (see Third-party services).
When the app suggests your area or you place a meet pin, your phone's built-in geocoding service turns the coordinates into a place name, so those coordinates are sent to that service: Apple on iPhone, Google on Android.
You can turn location off at any time in your phone's settings (iPhone: Settings → Car Lounge → Location; Android: Settings → Apps → Car Lounge → Permissions → Location). Your saved locations are deleted when you delete your account.
3. Analytics and crash reports
We do not use third-party analytics or advertising SDKs. Instead:
- Usage events — while you are signed in, the app records simple events in our own database (for example, that the app was opened, a post was created, or you RSVP'd to a meet) so we can understand which features are used. Events are linked to your account, are deleted automatically after 90 days, and are deleted with your account.
- Crash and error reports — when the app hits an error, it sends a report to our own database with the error message and where in the app it happened, plus your platform, OS version, and app version. Reports are deleted automatically after 30 days.
Apple and Google may also share aggregated crash and performance statistics with us if you have allowed your phone to share diagnostics with app developers. The Google Maps SDK and Firebase on Android may collect their own diagnostics under Google's privacy policy.
4. How we use your information
- To run the app: show you feed and reel content, route your messages, host your meets, run vehicle verification.
- To verify accounts (Vehicle, Shop, Identity tiers) and award badges.
- To moderate content for safety using automated text classification (see Third-Party Services).
- To send transactional emails (signup confirmation, password reset) and push notifications you opt into.
- To maintain, secure, and improve the app (crash diagnostics, abuse prevention).
- To comply with legal obligations and respond to lawful requests.
Sponsored ads. Car Lounge shows sponsored ads from shops on Car Lounge, such as the optional “Watch a sponsored ad” offer that earns you Orbs. Ads are not targeted using your personal information, location, or activity, and Premium members don't get them. When you watch one, we record which ad you saw, how long you watched, and any Orbs you earned, so we can credit you, limit how often you see the same ad, prevent fraud, and charge the shop. The shop sees how much of its ad budget has been spent, not who watched. If you tap an ad's link, you leave Car Lounge for the shop's website, which has its own privacy practices.
We do not use your personal data to target ads, do not sell your data, and do not share it with data brokers.
5. Third-party services
To deliver Car Lounge, we transmit the minimum data necessary to the following processors:
- Supabase Inc. — authentication, Postgres database, file storage, and realtime infrastructure. Your account and content are hosted on Supabase. Supabase Privacy Policy
- Apple Inc. — for everyone, on iPhone and Android: our account emails (sign-up confirmation codes and password resets) are sent through Apple's iCloud Mail, which receives your email address and the message. On iPhone also: Sign in with Apple (if you choose that option; when you delete your account we ask Apple to revoke that sign-in), push notification delivery via APNs, Apple Maps, the geocoding described under Location, and in-app purchases if you subscribe or buy Orbs. Apple Privacy Policy
- Google LLC — on Android: push notification delivery via Firebase Cloud Messaging (which receives your device's push token and the notification content), maps via the Google Maps SDK for Android (which receives the map area you view, your IP address, and device and usage information), and the geocoding described under Location. Google Privacy Policy
- Expo (650 Industries, Inc.) — relays push notifications to Apple and Google (it receives your device's push token and the notification content, such as a message preview) and delivers app updates (it receives technical information such as your IP address, platform, app version, and a random installation ID the app sends with each update check). Expo Privacy Policy
- GIPHY — if you search for GIFs, your search terms are sent from your device to GIPHY, along with technical information such as your IP address, and the GIFs you pick are loaded from GIPHY's servers. GIPHY Privacy Policy
- Stripe, Inc. — if you opt into Identity Verification, your government-issued ID document and selfie are submitted to Stripe Identity. Stripe is the data controller for those documents. Stripe Privacy Policy
- Groq, Inc. — automated moderation of text (posts, comments, chat messages) and uploaded images to catch harassment, spam, and illegal content, and AI-assisted vehicle verification (the photos you submit for verification are analyzed to confirm the vehicle matches your claim), using AI models hosted on Groq. We send the content being checked only; we do not send your identity. Groq Privacy Policy
- NHTSA vPIC API — if you enter a VIN, it is decoded by the public NHTSA Vehicle API (no account required, no data retained). NHTSA vPIC
- Vercel Inc. and Cloudflare, Inc. — web hosting for the Car Lounge website (they receive your IP address and browser information when you visit it). Vercel Privacy Policy · Cloudflare Privacy Policy
6. Identity Verification (optional)
If you choose to become Identity Verified for the blue checkmark, you submit a government ID document and a selfie to Stripe Identity. We receive only a verification result (verified / failed / canceled) and never see or store the ID image, selfie, or sensitive fields like Social Security Number. The verification record is held by Stripe under their privacy policy; we hold only the boolean result and a timestamp.
7. User-generated content
Posts, comments, reels, vehicle photos, and chat messages you create are visible according to your audience choice (public feed, group, or direct message). Other users may see, screenshot, save, or report your content. Do not post anything you would not want preserved.
Content you delete is removed from the app within a reasonable period. Backups may retain the content for up to 30 days before purge.
8. Data retention
We retain your data while your account is active. When you delete your account (in the app: Garage tab → gear icon → Danger zone → Delete account), we erase your profile, posts, vehicles, photos, chats, and badges. If you used Sign in with Apple, we also revoke Car Lounge's access to your Apple ID and delete the Apple token we stored for that. Most of it is deleted immediately, and everything, including backup copies, within 30 days. Usage events are deleted after 90 days and crash reports after 30 days even if you keep your account. We may retain transactional records (subscription invoices, abuse-report metadata) longer where required by law or for legitimate fraud prevention. How to delete your account lists exactly what is deleted and what is kept.
9. Your rights and choices
- Access — request a copy of the data we hold about you.
- Correction — edit your profile, vehicles, posts, and settings in the app.
- Deletion — in the app, Garage tab → gear icon → Danger zone → Delete account erases your data. You can also ask us by email without using the app; see How to delete your account.
- Portability — request your data in a portable format.
- Object / restrict — ask us to stop or limit processing.
- Push notifications — turn off in the app (Settings → Notification preferences) or in your phone's settings (iPhone: Settings → Notifications → Car Lounge; Android: Settings → Apps → Car Lounge → Notifications).
- Location, contacts, camera, and photos — allow or revoke access at any time in your phone's settings (iPhone: Settings → Car Lounge; Android: Settings → Apps → Car Lounge → Permissions).
If you reside in the European Economic Area, the United Kingdom, or California, you have additional rights under GDPR, UK GDPR, and CCPA respectively. We honor these requests free of charge.
10. Children's privacy
Car Lounge is rated 17+ and is not directed at children under 17. We do not knowingly collect personal information from anyone under 17. If you believe a child under 17 has provided us with personal information, please contact us and we will delete it promptly. Our Child Safety Standards explain how we prevent and respond to child sexual abuse and exploitation.
11. Security
We use industry-standard encryption (TLS 1.2+) for data in transit, encrypted-at-rest storage via Supabase, and access controls. No system is perfectly secure; please do not transmit information through Car Lounge that you would not want third parties to see.
12. International transfers
Our servers are located in the United States. By using Car Lounge, you consent to the transfer of your information to the United States.
13. Changes to this policy
We may update this Privacy Policy. Material changes will be announced in the app and the "Last updated" date will be revised. Continued use after changes constitutes acceptance.
14. Contact
Questions, requests, or complaints:
Hummus Development LLC
Email: dev.hummus@gmail.com
Support: Car Lounge Support
Account deletion: How to delete your account