Privacy Policy

AutoRev is operated by MACH Ventures LLC, trading as AutoRev, a Virginia limited liability company (“AutoRev,” “we,” “us”). This policy covers autorev.app, the early-access list, and the AutoRev app on the web and on iOS and Android, which all use the same servers. It is effective October 15, 2026.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address: used to sign you in and to email you about your account
• Sign-in data: a password (stored only as a hash by Supabase Auth) or, if you use Google sign-in, the name, email and profile picture Google shares
• Profile: display name, profile photo, and the general location (city, state or ZIP code) you give us or accept during onboarding
• Plan: Free or AutoRev Pro, trial status, and your AL fuel balance

1.2 Early-Access List

When you join the early-access list, we store your email address, the car you tell us about (if any), the page you signed up on, the campaign tags and referring site that brought you (Section 6.1), and, if you answer it, how you heard about AutoRev.

1.3 Garage and Build Data

When you use the Garage and Build features, we store what you enter, including:

• Your cars: year, make, model, trim, VIN (if you enter it), mileage, purchase details and notes
• Records: service logs, modifications, builds and parts lists, dyno results, track times and performance goals
• Photos and media you upload to your garage
• Favorites and cars you save

1.4 AL Assistant Conversations

When you use AL, our AI assistant, we store:

• Conversations: your messages and AL's answers
• Attachments: photos (JPEG, PNG, GIF, WebP) and PDF documents you attach, up to 10 MB each
• Voice: if you talk to AL by voice, the transcript of the conversation is saved to your AL history. We do not keep the audio recording
• Ratings: thumbs up or down on an answer, saved with that question and answer
• AL actions: changes AL proposes to your garage, your approvals, and a log of what was changed so you can undo it
• Usage and diagnostics: fuel and tokens used, which tools AL used, timings, and a trace of each request (including the question text) so we can find and fix wrong or slow answers

1.5 Payments

Payments for AutoRev Pro and fuel packs are processed by Stripe. Stripe collects your card details and, where required, your billing address; we never see or store your card number. We send Stripe your email address, display name and account ID, and we store your Stripe customer ID, subscription status and purchase history.

1.6 Feedback and Communications

• Feedback: your message, the email address you give, the page you were on, browser details, any screenshot you attach, and your account if signed in
• Contact form: your name, email address and message. These are emailed to our team inbox; they are not stored in our database
• Account deletion: the reason you choose when you delete your account
• Email: any email you send us

1.7 Automatically Collected Information

• Our page count: for every page view we record the page, the referring site, the campaign tags in the link, your device type, browser and operating system, and an approximate location (country, region and city) that our host derives from your IP address. We do not store your IP address or full user agent in it. Without analytics consent this record is anonymous: no cookie, no identifier stored on your device, and no link to your account. With analytics consent it also carries a random visitor ID, a session ID and, if you are signed in, your account ID
• Product activity (analytics consent): time on page, scroll depth, clicks (the element and a short piece of its text) and which features you use
• Account activity: for signed-in users, our servers record key actions such as signing up, adding a car, asking AL a question, saving a build and starting or ending a subscription, so we can run and improve the service. These records hold IDs and short facts, not your messages
• Signup attribution: when you create an account, the first and last campaign that brought you (source, medium, campaign, content, term, and the type of ad link, never the ad click ID itself), the referring site, landing and signup pages, device type and country
• Server and network logs: our hosting and network providers (Vercel, Cloudflare) process your IP address and request details to deliver and protect the site. Our rate limiter keeps your IP address with a request count for up to 15 minutes, and clears expired counts as new requests arrive
• Error reports: errors, performance data and some session recordings (Section 3.4)
• Precise location: only if you tap to find service centers near you and allow it in your browser. It is used for that search and is not saved to your account

2. How We Use Your Information

2.1 Providing AutoRev

• Run your account, Garage, Build, estimates and AL
• Save your cars, records, builds and conversations across devices
• Process payments and manage your plan and fuel balance

2.2 AL Assistant

• Give AL the context it needs to answer for your exact car: your cars, VIN, mileage, modifications, service history, builds and your general location
• Keep your conversation history so you can follow up
• Meter fuel and enforce usage limits
• Review traces, ratings and errors to fix wrong or slow answers. Our team also gets an internal daily summary of AL usage with counts, topics and cars, never the text of a question
• We do not use your conversations, photos or documents to train or fine-tune AI models

2.3 Improving AutoRev

• Count visits and see which pages, posts and campaigns bring people to AutoRev
• Understand how features are used (with analytics consent)
• Find and fix bugs from error reports and feedback

2.4 Communication

• Send account and service emails: welcome, email confirmation, password reset, payment problems, trial ending, and replies to your feedback
• Tell early-access members when AutoRev opens to them
• Send occasional product updates, which you can unsubscribe from
• Respond to your messages and requests

2.5 Advertising Measurement (Marketing Consent Only)

With your marketing consent, we tell Meta and TikTok when one of our ads led to a visit, signup or purchase (Section 6.1). We do not let them, or anyone else, use your garage, conversations or profile.

2.6 Security and Legal Compliance

• Rate-limit requests and prevent fraud and abuse
• Enforce our Terms of Service
• Comply with legal obligations and respond to lawful requests

3. Third-Party Services

These companies process personal information for us. Each has its own privacy policy. We share only what each service needs to do its job.

3.1 Infrastructure and Hosting

• Supabase: our database and sign-in system, and private storage for the photos and PDFs you attach in AL and for feedback screenshots. Supabase Auth also sends sign-in emails (confirmation and password reset). Privacy policy
• Vercel: hosts the site and app servers, and stores the photos and media you upload to your garage (Vercel Blob). Vercel Speed Insights measures page-load speed in your browser without cookies, on about half of visits. Privacy policy
• Cloudflare: sits in front of autorev.app to deliver and protect it, so it handles every request, including your IP address. Cloudflare Web Analytics measures page loads without cookies. Privacy policy

3.2 AI Services

• Anthropic (Claude): writes every AL answer, typed or spoken. It receives your messages and conversation history, the garage context AL uses (for example your car, VIN, mileage, modifications, service history and general location), the results of AL's searches, and the photos and PDFs you attach. Anthropic fetches each attachment from our private storage through a link that expires after 10 minutes; a PDF is also sent once at upload to count its length. Privacy policy
• OpenAI: turns text into embeddings for search. This includes the search queries AL writes from your question when it searches our knowledge base, which can contain words from your question. OpenAI does not write AL's answers. Privacy policy
• Google (Gemini): a backup model for a few tasks when Anthropic is unavailable: reading a modification list you type, and looking up the versions of a car. It receives that text and the car's year, make, model and trim. Privacy policy
• Exa: web search for AL. It receives the search queries AL writes (which can reflect your question and your car) and the addresses of web pages AL reads. AL will not put a VIN, ZIP code, email address or similar identifier from an attachment into a search unless you typed it in that message. Privacy policy
• ElevenLabs: voice conversations with AL. It receives your voice audio to transcribe it and AL's answer text to speak it. Our ElevenLabs settings turn call recording off and keep no conversation history there. Privacy policy

3.3 Payments and Email

• Stripe: payments for AutoRev Pro and fuel packs (Section 1.5). Privacy policy
• Resend: sends our emails and delivers contact-form messages to our inbox. Privacy policy

3.4 Analytics and Error Monitoring

• Sentry: error and performance monitoring for every visitor, because it is how we find and fix problems. It receives error details, the page and your browser. Only with your analytics consent, it also records about 10% of sessions and every session that hits an error as a replay of the page, with all text, form inputs, images and video hidden. We do not send Sentry your name, email or account ID. Privacy policy
• Google Analytics 4, PostHog and Vercel Analytics: product analytics, only with your analytics consent (Section 6.1). PostHog (U.S. cloud) receives your account ID if you are signed in, never your email, and does not run when your browser sends Do Not Track.

3.5 Advertising Platforms (Marketing Consent Only)

• Meta (Facebook and Instagram): the Meta Pixel and the Conversions API. Privacy policy
• TikTok: the TikTok Pixel and the Events API. Privacy policy
• Google Ads: not in use today. If we start advertising on Google, its conversion tag will load only with your marketing consent, as described in Section 6.1.

3.6 Other Services

• Google Maps Platform and OpenStreetMap (Nominatim): turn a place you type, or your precise location if you allow it, into map results for the service-center finder.
• NHTSA and EPA: U.S. government services. If you enter a VIN, it is sent to NHTSA to decode it; recalls and fuel economy are looked up by year, make and model only.
• Tinify: compresses photos you upload.
• YouTube: when we show a video, its thumbnail loads from YouTube, and the player loads from YouTube when you press play. YouTube may then set its own cookies.
• Expo: delivers push notifications in the mobile app if you turn them on (it receives your device's push token).
• Discord: our team's internal notifications: new signups (with a partly hidden email address: first letters only, domain hidden too; and, when known, the car page, the referring site and the first thing they did), contact-form messages (the topic and a partly hidden email address; your name and message go only to our team inbox), feedback (its length, the page and whether a screenshot is attached; the message stays in our database), error alerts (with email addresses, tokens and quoted values removed) and the daily AL summary described in Section 2.2.

We do not sell your personal information for money. See Section 9 for how U.S. state laws treat advertising measurement.

4. Data Retention & Deletion

4.1 How Long We Keep Your Data

• Account, garage, builds and AL conversations: until you delete them or your account
• Removed cars: hidden right away and permanently deleted, with their photos, after 30 days
• AL attachments that were never sent: deleted within about 3 hours. Some short-lived AL working data is deleted after 7 days
• Page counts and product analytics: deleted automatically 13 months after they are recorded
• AL request traces and error logs: deleted automatically 90 days after they are recorded
• Signup attribution: until you delete your account (Section 4.3)
• Early-access list: until you ask us to remove you, or delete an account with the same confirmed email
• Feedback and screenshots: until you delete your account or ask us
• Contact-form messages and email: in our team inbox and team chat until we delete them
• Your cookie choice: 12 months, then we ask again
• Payment records: as long as tax and accounting rules require
• Service providers (Section 3) keep their own logs and backups for the periods in their policies

4.2 How to Delete Your Data

• Individual items: remove cars, records, builds and other items where the app offers remove or delete
• Clear garage data (Settings → Account → Data & Privacy): deletes all your cars with their service logs, dyno results and performance goals. Photos you uploaded for them are deleted when you delete your account
• Clear AL history (same place): deletes all your AL conversations, messages, ratings and AL action history, and every photo and PDF you attached. Deleting one AL conversation also deletes the files attached in it
• Delete account (Settings → Account): deletes your account immediately (Section 4.3). It cannot be undone
• Anything else, including an early-access entry under another email, feedback or contact messages: email [email protected] with “Delete My Data” in the subject line

4.3 What Happens When You Delete Your Account

• Deleted: your sign-in and profile, your cars and their records, your builds and their parts lists, AL conversations, messages, attachments, voice sessions and ratings, favorites, the photos you uploaded, your feedback screenshots, your signup attribution, our copies of your subscription records, and the early-access or contact-form entry under your account's confirmed email
• Kept but unlinked from you: page counts and product-activity records (your account ID is removed), the reason you gave for leaving, feedback sent signed in or from your email (minus email and screenshots) and accounting records
• Not deleted automatically: an early-access entry under another email, feedback sent signed out under another email or none, and contact messages in our team inbox; email us to delete them
• AutoRev Pro: deleting your account cancels your subscription with Stripe right away, before anything else is deleted; if Stripe can't cancel it, nothing is deleted and you can try again. We then delete your customer record at Stripe, which keeps the payment records it must keep by law
• Deleted data can remain in our providers' backups until those backups expire

4.4 Exceptions to Deletion

We may keep information when we need it to:

• Meet tax, accounting or other legal obligations
• Handle legal claims or disputes
• Investigate fraud, abuse or security incidents

5. Your Rights

5.1 Access and Export

Export My Data (Settings → Account → Data & Privacy) downloads a JSON file with your profile, garage, builds, AL conversations and the other data tied to your account, including the pages you viewed, product events, clicks, your signup attribution and your AL request log (what you asked, when, and how it was answered). Your Garage documents are listed; the files themselves stay in your Garage. It leaves out IP addresses, browser user agents, device push tokens, what our team clicked on our own admin pages, our internal error, metering and accounting logs, Al's log of actions it proposed or took (their results are in your Garage data), and points and badges from retired features; to get those, or a copy of anything else we hold about you, email [email protected] with “Data Access Request” in the subject line.

5.2 Correction

• Change your display name and photo in Settings
• Edit your cars and records in your garage
• Email us to correct anything you cannot change yourself, including your email

5.3 Deletion

See Section 4.2.

5.4 Email

• Every product-update email has an unsubscribe link, where you can stop all emails or only some kinds
• We still send emails you need to use your account, such as email confirmation, password reset and payment problems

5.5 Cookie Choices

You can change or withdraw your analytics and marketing consent at any time (Section 6.2).

6. Cookies & Tracking

The first time you visit, our banner asks for your choice: “Accept all,” “Essential only,” or “Manage options” to choose analytics and marketing separately. Until you choose, only the essential items below run. The banner is shown to every visitor, wherever they are.

6.1 What We Use

Essential (Always On)

• Sign-in: Supabase session cookies (sb-…-auth-token) keep you signed in, for up to 400 days while you keep using the app. Three cookies that last 60 seconds hand off a sign-in or email confirmation
• Your consent choice: stored in your browser (autorev_cookie_consent) and in the ar_consent cookie for 12 months
• Approximate location: user_country and user_region, from your IP address, for 24 hours, to pre-fill your location and show region-appropriate information
• Campaign attribution: when you arrive from a link with campaign tags or an ad click ID, two first-party cookies (ar_ft for the first visit, ar_lt for the latest) keep those tags for 90 days. Only our server can read them. When you join the early-access list or sign up, we save the tags and the type of ad link, never the click ID itself. Nothing from them reaches an ad platform without your marketing consent
• App state: your browser keeps settings such as your theme, the car you picked and unsent AL prompts on your device
• Our anonymous page count (Section 1.7), Sentry error monitoring without replays (Section 3.4), and Vercel Speed Insights and Cloudflare Web Analytics, which use no cookies (Section 3.1)

Analytics (Only With Your Consent)

• Google Analytics 4 (_ga, _ga_* cookies, up to about 13 months)
• PostHog (a ph_* cookie and browser storage, 12 months), sent through our own server; it records the pages you view and the buttons, links and forms you use
• Vercel Analytics (no cookies)
• Our visitor and session IDs (_ar_vid, _ar_sid in browser storage), plus time on page, scroll and click events (Section 1.7)

Marketing (Only With Your Consent)

With marketing consent we load the Meta Pixel (_fbp, _fbc cookies, 90 days) and the TikTok Pixel (_ttp and ttcsid cookies, about 13 months). When you join the early-access list, create an account, see an estimate, or buy a subscription or fuel pack, we also send that event from our servers to Meta (Conversions API) and TikTok (Events API), with a hashed (SHA-256) email address and account ID where we have them, your IP address and browser type, and that platform's browser and click IDs, so the platform can tell whether an ad led to it. A short-lived cookie (ar_conv, 10 minutes) passes the signup event to the pixels so it is counted once. The estimate event names the car model the estimate was for. Ad platforms never receive your name, phone number, garage records or conversations. Google Ads is not in use today; if we start, its tag will run only with marketing consent and will read Google's click ID from the link you arrived by. Without marketing consent, no ad tag loads and no event is sent to an ad platform.

6.2 How to Control Cookies

• Cookie preferences: use the “Cookie preferences” link at the bottom of the site, or this button, to accept, reject or change your choice at any time. Withdrawing stops the tags in that visit: Cookie preferences
• Global Privacy Control: if your browser sends a Global Privacy Control signal, we treat it as an opt-out of marketing: no ad tag loads and no event is sent to Meta, TikTok or Google, whatever was chosen in the banner. It does not change your analytics choice
• Do Not Track: PostHog does not record your visit when your browser sends Do Not Track. Our other services do not respond to Do Not Track; Global Privacy Control is the signal they honor
• Browser settings: you can block or delete cookies and site data. Blocking essential cookies will sign you out and stop some features from working

7. Security Measures

• Encryption in transit: all connections use HTTPS/TLS
• Encryption at rest: managed by Supabase for our database and file storage
• Passwords: stored only as hashes by Supabase Auth; you can also sign in with Google
• Access to your data: database row-level security limits signed-in users to their own records, and account features check that you are signed in
• AL attachments: kept in private storage, in a folder only your account can use, and shared with Anthropic only through links that expire after 10 minutes
• Uploaded garage photos: stored at long, random, unlisted web addresses. Anyone who has the exact address can open the file, so do not upload anything you would not want seen
• Feedback screenshots: private (any not sent with feedback deleted within a day); our team views them through links that expire after 10 minutes
• Abuse protection: rate limits on our servers, plus Supabase Auth and Cloudflare protections
• Secrets: API keys stay on our servers; scheduled jobs authenticate with secret tokens; admin tools are limited to our team

No system is 100% secure. Keep your password private, and if you think someone has accessed your account, change your password and contact us. If a breach affects your personal information, we will notify you as the law requires.

8. Children's Privacy

AutoRev is not intended for children under 13 (or under 16 in the EU), and you must meet that age to use it (see our Terms). We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

9. U.S. State Privacy Rights (Virginia, California)

Residents of Virginia (Virginia Consumer Data Protection Act), California (California Consumer Privacy Act, as amended by the CPRA) and other U.S. states with similar laws have rights over their personal information. We honor the requests below from any U.S. user.

9.1 Your Rights

• Know and access: the categories and specific pieces of personal information we hold, where it came from, why we use it and who receives it
• Correct inaccurate information
• Delete your personal information, subject to the exceptions in Section 4.4
• Portability: a copy in a usable format (Section 5.1)
• Opt out of targeted advertising, and of “sale” or “sharing” (Section 9.3). We do not use your information for profiling that produces legal or similarly significant effects
• Non-discrimination: we will not deny you service, charge you a different price or give you a lower level of service for using these rights

9.2 What We Collect, From Where, and Who Receives It

• Identifiers: email address, account ID, IP address, device and cookie IDs (Sections 1 and 6)
• Commercial information: your plan, subscriptions and fuel purchases (Section 1.5)
• Internet activity: pages viewed, features used, referring sites and campaigns (Sections 1.7 and 6)
• Location: approximate location from your IP address or what you enter; precise location only for a service-center search you start, not saved
• Audio and images: voice conversations with AL (sent to ElevenLabs, not kept as audio), and photos and documents you upload
• Vehicle information: your cars, VIN, mileage, records and builds
• Your content: AL conversations, feedback and messages

We collect this from you, from your device and browser, and from Google if you use Google sign-in. We use it for the purposes in Section 2 and disclose it to the service providers in Section 3.

9.3 Sale, Sharing and Targeted Advertising

We do not sell your personal information for money, and we have not in the past 12 months. If you allow marketing cookies, the Meta and TikTok pixels and server events in Section 6.1 disclose identifiers and activity on AutoRev to those platforms to measure our ads. California law may call this “sharing” for cross-context behavioral advertising, and Virginia and other states may treat it as targeted advertising or a sale. This happens only with your marketing consent, and you can opt out at any time through Cookie preferences or a Global Privacy Control signal, which we honor as an opt-out. We do not knowingly sell or share the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes that require a right to limit under California law.

9.4 How to Make a Request

Email [email protected] with “Privacy Request” in the subject line, from the email address on your account if you have one. We verify requests by confirming you control that email address. You may use an authorized agent; we may ask the agent for your signed permission and ask you to confirm. We respond within 45 days, and tell you if we need up to 45 more.

9.5 Appeals

If we decline your request, you can appeal by replying to our decision or emailing [email protected] with “Privacy Appeal” in the subject line. We will answer within 60 days and explain our decision. If we deny your appeal, Virginia residents can contact the Virginia Attorney General at oag.state.va.us.

10. International Users

AutoRev is operated from the United States for U.S. car owners. If you use it from another country, your information is transferred to and processed in the United States, and by the service providers in Section 3 in the countries where they operate.

10.1 Users in the EEA and UK

We process your information to provide the service you asked for (contract), with your consent (analytics and marketing cookies, precise location), and for our legitimate interests (security, fixing errors, our anonymous page count). You can ask to access, correct, delete, restrict or receive a copy of your information, object to processing, withdraw consent at any time, and complain to your local data protection authority. To make a request, email [email protected].

11. Updates to This Policy

We update this policy when our practices change. The date at the top shows the latest version. For a material change, we will also tell registered users by email or in the app before it takes effect. If you do not agree with a change, you can stop using AutoRev and delete your account.

12. Contact Information

For questions or requests about this policy or your data:

We aim to answer questions within a few business days and formal requests within the times in Section 9.