Skip to content

Privacy Policy

Last updated: September 16, 2026

1. Introduction

GearsTrack ("we," "us," or "our") is a vehicle build tracking application operated by Nicholas Arendash as an independent developer. This Privacy Policy describes how we collect, use, store, and share your personal information when you use the GearsTrack website at gearstrack.com and associated mobile applications (collectively, the "Service").

By using the Service you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you create an account we collect your email address and a password. Authentication is handled by Supabase, which stores only a salted hash of your password — we never see or store the password itself. If you sign in with Google, we receive your email address from Google instead of a password.

2.2 Vehicle and Project Data

You may voluntarily provide:

  • Vehicle identification numbers (VINs), make, model, and year
  • Project names, descriptions, and status
  • Parts lists including part names, costs, vendors, and quantities
  • Maintenance and timeline logs
  • Issue/diagnostic records
  • Inspiration board links and notes

2.3 Photos and Media

You may upload photos and video clips of your vehicles and projects, and receipts for parts you have bought. Photos are stored in Cloudflare R2 object storage, videos are stored in Cloudflare Stream, and both are associated with your account. Receipts are kept in a separate, non-public R2 bucket and are provided only to the project owner or an authorized collaborator when they request a project report. Photos and videos use unguessable public media URLs; GearsTrack exposes those URLs to other people when you choose to publish or share the related build.

2.4 Payment Information

If you subscribe to our Pro plan, payment processing is handled entirely by Stripe. We do not receive or store your full credit card number. We may receive limited information from Stripe such as the last four digits of your card, card brand, and billing postal code for receipt and support purposes.

2.5 Advertising and Measurement

We advertise GearsTrack on Meta (Facebook and Instagram) and use the Meta Pixel on our public web pages to measure whether those ads work. The pixel records page views and sign-ups and sets Meta’s own cookies (_fbp, _fbc). We also send the same events to Meta from our servers via the Conversions API, along with checkout-start, subscription-start, and purchase events for web subscriptions. Purchase events include the plan, currency, and transaction value so we can measure advertising return. Those server events may include a cryptographically hashed version of your email address, your IP address, and your browser user-agent, which Meta uses to match the event to an account. We do not send Meta your plaintext email, your vehicles, or anything else about your builds.

Your choice. If you visit from the European Economic Area, the United Kingdom or Switzerland, none of this runs until you accept it in the prompt shown on your first visit. Everywhere else it runs by default and you can turn it off at any time with the "Your privacy choices" link in the footer of every page. We also honor the Global Privacy Control browser signal as an opt-out. Your decision is stored in a first-party cookie (gt_consent) and, once you have an account, on your account record so our billing systems respect it too.

We do not send Apple in-app purchase events to Meta. Native purchase attribution will remain disabled unless we add an App Tracking Transparency permission flow and you authorize that measurement.

When you arrive from an ad or a link with campaign tags and measurement is allowed, we store the referring campaign parameters against your account so we can tell which channels bring people in.

We use Cloudflare Web Analytics for aggregate page-view counts. It sets no cookies and does not fingerprint or track you across sites. Our hosting infrastructure (Cloudflare) may also collect basic server logs including IP addresses and request timestamps for security and operational purposes.

2.6 Push Notifications

If you allow notifications in the mobile app, we store a device-specific push token and its platform so we can deliver alerts you requested. Transactional alerts, such as package delivery updates, are separate from occasional product updates and requests. Promotional push messages are off by default and are sent only after you explicitly enable them in the app; you can turn them off again at any time in Settings.

2.7 Product Activity and Followed Builds

For signed-in accounts, we record first-party product events such as session starts, creating a project, adding a part or timeline entry, publishing or sharing a build, and enabling a notification. We use this limited activity history to measure whether onboarding works and to improve retention; it does not include your notes, photos, VIN, part names, or issue descriptions. If you explicitly follow a public build, we store that relationship so we can show the follower count and, if you opt into the Weekly Garage Recap, include useful updates from that build. You can unfollow at any time and turn the recap off in Settings.

2.8 Connected Social Accounts and Next-Build Alerts

If you connect X or Instagram, we store the provider account identifier and encrypted access tokens needed to publish only the posts you request. The selected caption and media are sent to that provider when you publish. If you enable a Next Build alert, we send its vehicle criteria, budget, and optional ZIP code and radius to listing providers such as eBay and Auto.dev so we can find matching vehicles.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Authenticate your identity and manage your account
  • Process subscription payments via Stripe
  • Decode VINs using the public NHTSA API to auto-fill vehicle details
  • Respond to support requests and communications
  • Deliver notifications you enable and honor your push preferences
  • Send the Weekly Garage Recap only when you opt in and there is useful activity
  • Measure activation and return usage using first-party product events
  • Send the operator an internal notice (your email address and the time) when an account is created, so new signups can be watched for abuse
  • Send occasional build tips and product updates by email if you left that box ticked at signup — every such email has a one-click unsubscribe link, and the setting lives in Settings → Email
  • Protect against fraud, abuse, and security threats

4. Third-Party Services

We share data with the following third-party service providers only as necessary to operate the Service:

  • Supabase — authentication and database hosting. Subject to the Supabase Privacy Policy.
  • Stripe — payment processing for Pro subscriptions. Subject to the Stripe Privacy Policy.
  • NHTSA API — we send VINs you provide to the U.S. National Highway Traffic Safety Administration’s public VIN decoder API to retrieve vehicle specifications. No personal information beyond the VIN is transmitted.
  • Meta Platforms — advertising measurement as described in section 2.5, including hashed email, IP address, and user-agent. Subject to the Meta Privacy Policy.
  • Cloudflare — website hosting, image/receipt storage (R2), video hosting (Stream), browser rendering for requested reports and share images, and hosting of the AI language model behind the labelled "AI" features. When you use one of those features we send the model only what the feature needs: the part name, your vehicle’s year, make, model and engine, the vendor page you saved, or the issue description you typed — never your email, name, VIN or photos. Cloudflare does not use these requests to train models. Subject to the Cloudflare Privacy Policy.
  • Resend — delivery of transactional email (price-drop alerts, maintenance reminders, collaborator invites, comment notifications). Receives your email address and the message content.
  • Expo, Apple, and Google — delivery of mobile push notifications. They receive the device push token and notification content needed to route a message to your device.
  • Apple — if you subscribe inside the iOS app, the purchase is processed by Apple and we receive only a transaction identifier and its status.
  • EasyPost — when you enable package tracking, we send the carrier and tracking number needed to retrieve delivery status and generate the alerts you requested.
  • X and Instagram — when you connect an account and choose to publish, the provider receives the selected caption and media along with the authorization token required to post for you.
  • eBay and Auto.dev — when you enable a Next Build alert, listing searches can include vehicle criteria, budget, and an optional ZIP code and radius.
  • Price-check providers — when you ask us to check a part’s price we send the product URL you saved to a third-party page-fetching service. No information about you or your account is included.

We do not sell, rent, or trade your personal information. Apart from the advertising measurement described in section 2.5, we do not share your information with third parties for marketing purposes.

5. Data Storage and Security

Your data is stored on Supabase-managed infrastructure. We implement industry-standard security measures including encrypted connections (TLS), row-level security policies on our database, and secure authentication flows. While we strive to protect your data, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your account data and project information for as long as your account is active. If you delete your account, we will delete your personal data and associated project data within 30 days, except where we are required by law to retain it or need it to resolve disputes or enforce our agreements.

7. Your Rights

7.1 All Users

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Delete your account and associated data yourself, at any time, from Settings on the web or in the mobile app (or by emailing us — see Delete Your Account)
  • Take your data with you: each project can be exported as a PDF build report, a parts CSV and a maintenance calendar file from inside the app, and you can download a machine-readable (JSON) copy of your account data at any time from Settings on the web. For anything that download does not cover, email us and we will respond within 30 days

7.2 European Economic Area (GDPR)

If you are located in the EEA, you have additional rights under the General Data Protection Regulation, including the right to data portability, the right to restrict processing, and the right to object to processing. Our legal basis for processing your data is (a) performance of a contract (providing the Service you signed up for) and (b) legitimate interest (security, fraud prevention, and Service improvement).

To exercise any GDPR right, contact us at [email protected]. We will respond within 30 days.

7.3 California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act grants you the right to know what personal information we collect, request its deletion or correction, and opt out of the sale or sharing of personal information. We do not sell personal information. Sending page-view and sign-up events to Meta for advertising measurement (section 2.5) is "sharing" under California law. You can opt out of it at any time with the "Your privacy choices" link in the footer of every page, and we treat a Global Privacy Control browser signal as an opt-out. We will not discriminate against you for exercising these rights. To exercise any other CCPA right, contact us at [email protected].

8. Children’s Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will delete it promptly.

9. Cookies

We set these first-party cookies:

  • sb-access-token, sb-refresh-token — essential; keep you signed in (30 days)
  • gt_consent — essential; remembers your advertising-measurement choice (180 days). gt_cmode records whether your region needs a prior opt-in prompt (180 days)
  • gt_garage_name_asked — preference; stops us re-asking you to name your garage (90 days)

The Meta Pixel described in section 2.5 sets Meta’s advertising cookies (_fbp, _fbc) only when your consent choice allows it. The app also uses browser storage for small conveniences such as remembering a dismissed prompt or an unsent note; this never leaves your browser. Essential cookies cannot be switched off because the Service does not work without them.

10. Affiliate Links

Some links to parts retailers in GearsTrack are affiliate links. If you buy something after following one, we may earn a commission — at no extra cost to you. This includes the vendor links in the "Find Best Price" menu and the "Buy" button on a part you have saved a vendor URL for, where we add our tracking code to the link before opening it.

As an Amazon Associate, GearsTrack earns from qualifying purchases. We also participate in the eBay Partner Network.

Commissions never change what you pay, and they do not influence the order or selection of vendors we show you. Following an affiliate link hands you off to the retailer, whose own privacy policy then applies; we do not send the retailer any information about your account.

To measure which public-build shopping links are useful, we record the retailer, public build, part, referring GearsTrack surface, destination hostname, and click time. This event does not contain your user ID, IP address, a cookie identifier, the destination query string, or the full destination URL.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after any changes constitutes acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

[email protected]