Privacy Policy

Last updated: August 9, 2026

1. Introduction

GearsTrack ("we," "us," or "our") is a vehicle build tracking application operated by Nicholas Arendash as an independent developer. This Privacy Policy describes how we collect, use, store, and share your personal information when you use the GearsTrack website at gearstrack.com and associated mobile applications (collectively, the "Service").

By using the Service you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you create an account we collect your email address and a password. Authentication is handled by Supabase, which stores only a salted hash of your password — we never see or store the password itself. If you sign in with Google, we receive your email address from Google instead of a password.

2.2 Vehicle and Project Data

You may voluntarily provide:

  • Vehicle identification numbers (VINs), make, model, and year
  • Project names, descriptions, and status
  • Parts lists including part names, costs, vendors, and quantities
  • Maintenance and timeline logs
  • Issue/diagnostic records
  • Inspiration board links and notes

2.3 Photos and Media

You may upload photos of your vehicles and projects, and receipts for parts you have bought. Photos are stored in Cloudflare R2 object storage and are associated with your account. Receipts are kept in a separate, non-public R2 bucket readable only by the account that uploaded them. Images attached to a build you choose to make public are served from a public URL.

2.4 Payment Information

If you subscribe to our Pro plan, payment processing is handled entirely by Stripe. We do not receive or store your full credit card number. We may receive limited information from Stripe such as the last four digits of your card, card brand, and billing postal code for receipt and support purposes.

2.5 Advertising and Measurement

We advertise GearsTrack on Meta (Facebook and Instagram) and use the Meta Pixel on our public web pages to measure whether those ads work. The pixel records page views and sign-ups and sets Meta’s own cookies (_fbp, _fbc). We also send the same events to Meta from our servers via the Conversions API. Those server events include a cryptographically hashed version of your email address, your IP address, and your browser user-agent, which Meta uses to match the event to an account. We do not send Meta your plaintext email, your vehicles, or anything else about your builds.

When you arrive from an ad or a link with campaign tags, we store the referring campaign parameters against your account so we can tell which channels bring people in.

Our hosting infrastructure (Cloudflare) may collect basic server logs including IP addresses and request timestamps for security and operational purposes.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Authenticate your identity and manage your account
  • Process subscription payments via Stripe
  • Decode VINs using the public NHTSA API to auto-fill vehicle details
  • Respond to support requests and communications
  • Protect against fraud, abuse, and security threats

4. Third-Party Services

We share data with the following third-party service providers only as necessary to operate the Service:

  • Supabase — authentication and database hosting. Subject to the Supabase Privacy Policy.
  • Stripe — payment processing for Pro subscriptions. Subject to the Stripe Privacy Policy.
  • NHTSA API — we send VINs you provide to the U.S. National Highway Traffic Safety Administration’s public VIN decoder API to retrieve vehicle specifications. No personal information beyond the VIN is transmitted.
  • Meta Platforms — advertising measurement as described in section 2.5, including hashed email, IP address, and user-agent. Subject to the Meta Privacy Policy.
  • Cloudflare — website hosting and image/receipt storage (R2). Subject to the Cloudflare Privacy Policy.
  • Resend — delivery of transactional email (price-drop alerts, maintenance reminders, collaborator invites, comment notifications). Receives your email address and the message content.
  • Apple — if you subscribe inside the iOS app, the purchase is processed by Apple and we receive only a transaction identifier and its status.
  • Price-check providers — when you ask us to check a part’s price we send the product URL you saved to a third-party page-fetching service. No information about you or your account is included.

We do not sell, rent, or trade your personal information. Apart from the advertising measurement described in section 2.5, we do not share your information with third parties for marketing purposes.

5. Data Storage and Security

Your data is stored on Supabase-managed infrastructure. We implement industry-standard security measures including encrypted connections (TLS), row-level security policies on our database, and secure authentication flows. While we strive to protect your data, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your account data and project information for as long as your account is active. If you delete your account, we will delete your personal data and associated project data within 30 days, except where we are required by law to retain it or need it to resolve disputes or enforce our agreements.

7. Your Rights

7.1 All Users

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your account and associated data
  • Export your project data

7.2 European Economic Area (GDPR)

If you are located in the EEA, you have additional rights under the General Data Protection Regulation, including the right to data portability, the right to restrict processing, and the right to object to processing. Our legal basis for processing your data is (a) performance of a contract (providing the Service you signed up for) and (b) legitimate interest (security, fraud prevention, and Service improvement).

To exercise any GDPR right, contact us at [email protected]. We will respond within 30 days.

7.3 California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act grants you the right to know what personal information we collect, request its deletion, and opt out of the sale of personal information. We do not sell personal information. To exercise your CCPA rights, contact us at [email protected].

8. Children’s Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will delete it promptly.

9. Cookies

We set essential cookies for authentication and session management. On our public web pages the Meta Pixel described in section 2.5 also sets Meta’s advertising cookies. You can block these with your browser’s cookie controls or an ad blocker without affecting your ability to use the Service.

10. Affiliate Links

Some links to parts retailers in GearsTrack are affiliate links. If you buy something after following one, we may earn a commission — at no extra cost to you. This includes the vendor links in the "Find Best Price" menu and the "Buy" button on a part you have saved a vendor URL for, where we add our tracking code to the link before opening it.

As an Amazon Associate, GearsTrack earns from qualifying purchases. We also participate in the eBay Partner Network.

Commissions never change what you pay, and they do not influence the order or selection of vendors we show you. Following an affiliate link hands you off to the retailer, whose own privacy policy then applies; we do not send the retailer any information about your account.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after any changes constitutes acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

[email protected]