CarTales

Your data stays under your control

Privacy Policy

CarTales helps you keep track of your car, not of you. We collect only what is needed for your account, sync, photos, and notifications you choose. We do not sell personal data or use it for behavioral advertising.

Effective: 16 July 2026

Only what is neededNo ad profiles or unnecessary permissions
Secure by defaultPasswords and secrets are not stored as plain text
Straightforward deletionDelete your account and data from the app

1. Who handles your data

This Policy applies to the CarTales mobile applications and service. The service operator is the CarTales team (referred to as “we”). For privacy questions, email support@cartales.ru.

By using CarTales, you provide data for the purposes described below. If you disagree with this Policy, do not create an account or delete your existing account.

2. Data we process

  • Account: your name, email address, email-verification status, and a technical user identifier.
  • Car information: the name and model you enter, registration number if provided, mileage and mileage history, service records, dates, intervals, notes, and statuses.
  • Images: a profile picture, car photos, and service documents, only when you choose to upload them.
  • Notifications: app-installation and push-delivery identifiers, platform, app environment, version, locale, and time zone when you enable push notifications.
  • Security and operations: hashes of tokens and one-time codes, sync events, request times, IP address, and limited technical logs needed for security, troubleshooting, and reliable operation.

We do not request precise location, contacts, microphone access, advertising identifiers, payment, or banking information. Photo-library or camera access, if used by the app, serves only an image upload you initiate.

3. Why we use data

We use data only to:

  • create and protect your account, verify email, and restore access;
  • sync records across your devices and provide selected features, including reports;
  • store and display your photos after checking account ownership;
  • send service emails and push reminders you enable;
  • prevent password guessing, abuse, and unauthorized access;
  • diagnose errors, maintain security, and respond to support requests.

We do not use your data for ads, build advertising profiles, or sell personal data.

4. How we protect data

Connections to the production service are protected with HTTPS. Account data requires authentication, and ownership checks run on the server. Photos are kept in private storage and delivered only after an access check.

About passwords: your password is never stored in its original form or with reversible encryption. We store an individually salted PBKDF2-SHA256 cryptographic hash. The password cannot be decrypted or read back from that hash. Refresh tokens, email-verification codes, and password-reset codes are also stored as hashes.

We rate-limit login and code attempts, use short-lived access tokens, and rotate refresh tokens. Still, no storage or transmission method can promise absolute security. Use a unique password and never share verification codes.

5. When data is shared

We do not sell or rent your data. A limited amount may be processed by infrastructure providers that make CarTales work: hosting and databases, private object storage, email delivery, and Firebase Cloud Messaging for push notifications. Apple or Google also process information under their own terms for app distribution and notification delivery.

Providers receive only what a particular function needs. We may also disclose data when required by applicable law or reasonably necessary to protect users, the service, and our legal rights.

6. How long data is kept

Account and car data is kept while your account exists or while needed to provide the service. Codes and sessions have limited validity periods. Technical logs rotate and are retained for a limited operational period.

When you delete the account, associated data is removed from the active database. Private-storage objects are deleted immediately or placed in a protected retry queue, including a delayed pass after any previously issued short-lived upload URL expires. Residual copies may remain in protected backups for up to 14 days and then expire through backup rotation, unless a longer period is required by law, security needs, or dispute resolution.

7. Your choices and rights

You can view and edit information in the app, avoid uploading optional photos, disable push notifications in device settings, and delete individual records.

You may also request information, correction, deletion, processing restrictions, or withdraw consent where applicable law provides these rights. We may need to verify your identity to protect the account.

8. How to delete your account and data

In the app: open profile settings, select “Delete account,” and confirm with your current password. Your account, cars, service records, photos, tokens, and associated data will be permanently deleted.

If you can no longer access the app, email a request from the address linked to your account to support@cartales.ru. We will verify your identity and confirm completion. Uninstalling the app does not by itself delete your account.

9. Children

CarTales is not intended for independent use by children below the digital-consent age in their country. We do not knowingly collect children's data. Contact us if you believe a child provided data without appropriate permission.

10. Changes and contact

We may update this Policy at any time, including without prior notice, when features, security measures, or legal requirements change. The current version will always appear here with a new effective date. If a change materially affects your rights and applicable law requires notice, we will use the notice method required by law.

Privacy questionsCarTales · support@cartales.ru · cartales.ru