SpotWorth Privacy Policy

Effective date: October 10, 2026 · Version: 3

SpotWorth (the "Service", available at spotworth.app) is operated by AZENSHIALS LLC, a California limited liability company based in San Diego, California ("we", "us"). This policy explains what information the Service handles, why, who it goes to, and the choices you have.

The short version: you don't need an account. Your garage, history and photos stay on your device, unless you choose to back up your garage to the cloud or sign in with Google or Apple to use it on more than one device (see below); photos are never backed up. To identify a car, your photo is sent to Google's Gemini AI service, and on the version of the Service running today Google may use it to improve its products and people at Google may review it, so please avoid photographing people, faces, or anything personal. We don't sell your information, we don't run ads, and we don't track you across other websites.

1. Information the Service handles

What: Photos you scan or upload
When: When you scan or upload a photo
Where it goes: Resized and stripped of location (EXIF/GPS) data on your device, then sent through our server to Google's Gemini API to identify the vehicle (see §3).
How long we keep it: Not stored by us. Our server passes the photo to Google and does not save or log it. A copy is kept on your device (browser storage) for your history and garage until you delete it. Photos that turn out not to show a vehicle, or that show a VIN, are deleted from your device right away.

What: Vehicle identification results (make, model, year range, trim, body style)
When: After a scan
Where it goes: Shown to you; may be held briefly in our server's memory to avoid repeat work.
How long we keep it: Server memory only, cleared when the server restarts. On your device until you delete it.

What: VIN (vehicle identification number), if you type it or photograph a VIN label
When: When you ask for exact factory specs
Where it goes: Sent through our server to the U.S. National Highway Traffic Safety Administration's public VIN decoder (vPIC).
How long we keep it: Not stored or logged by us and not saved in your garage. Decoded specs are kept only in your browser's memory for that page.

What: ZIP code and mileage (optional)
When: When you ask for a local value estimate
Where it goes: Used to look up comparable listings from our market-data provider, if one is enabled (see §3).
How long we keep it: Your ZIP is saved on your device so you don't have to retype it. Our server doesn't save it to disk or logs, but it may hold it in memory, together with the results, for up to about an hour to avoid repeating the same lookup.

What: Anonymous device ID
When: Created the first time you use the Service
Where it goes: A random identifier stored on your device and sent with requests. Not linked to your name, email or phone.
How long we keep it: Used for rate limiting (preventing abuse) and anonymous usage statistics, such as "a profile was viewed for a Toyota Camry".

What: Account details (optional, only if you sign in with Google or Apple)
When: When you choose "Sign in with Google" or "Sign in with Apple"
Where it goes: Stored with Supabase (servers in the United States). We receive from Google or Apple: your email address (with Apple this may be a private relay address if you choose "Hide My Email"), a unique account identifier, and, if provided, your name and a link to your profile picture. We also record when you signed in.
How long we keep it: Used to sign you in, keep your garage in sync across your devices, and send you essential messages about your account or changes to these terms. No marketing emails without your separate consent. Kept until you delete your account (see §4).

What: Cloud backup of your garage (optional, only if you turn it on in Settings, or automatically while you're signed in)
When: When you choose "Back up", or when your garage changes while you're signed in
Where it goes: Stored with our database provider, Supabase (servers in the United States), under your account: an anonymous one created for your device, or your signed-in account.
How long we keep it: Saved: each car's make, model, year or year range, generation, trim, body style, how it was identified (photo, manual pick or VIN), favourite flag, save date, and general specs (engine, fuel economy, safety rating, recall count, curb weight). Not saved: photos, VINs, licence plates, location, ZIP codes or price estimates. Kept until you delete it (see §4).

What: Technical data (IP address, browser type, request times)
When: Every request
Where it goes: Our hosting provider, Vercel, processes this to deliver the Service. We use your IP address briefly, in memory, to limit abuse.
How long we keep it: Kept by Vercel under its own policies. We do not build profiles from it.

What	When	Where it goes	How long we keep it
Photos you scan or upload	When you scan or upload a photo	Resized and stripped of location (EXIF/GPS) data on your device, then sent through our server to Google's Gemini API to identify the vehicle (see §3).	Not stored by us. Our server passes the photo to Google and does not save or log it. A copy is kept on your device (browser storage) for your history and garage until you delete it. Photos that turn out not to show a vehicle, or that show a VIN, are deleted from your device right away.
Vehicle identification results (make, model, year range, trim, body style)	After a scan	Shown to you; may be held briefly in our server's memory to avoid repeat work.	Server memory only, cleared when the server restarts. On your device until you delete it.
VIN (vehicle identification number), if you type it or photograph a VIN label	When you ask for exact factory specs	Sent through our server to the U.S. National Highway Traffic Safety Administration's public VIN decoder (vPIC).	Not stored or logged by us and not saved in your garage. Decoded specs are kept only in your browser's memory for that page.
ZIP code and mileage (optional)	When you ask for a local value estimate	Used to look up comparable listings from our market-data provider, if one is enabled (see §3).	Your ZIP is saved on your device so you don't have to retype it. Our server doesn't save it to disk or logs, but it may hold it in memory, together with the results, for up to about an hour to avoid repeating the same lookup.
Anonymous device ID	Created the first time you use the Service	A random identifier stored on your device and sent with requests. Not linked to your name, email or phone.	Used for rate limiting (preventing abuse) and anonymous usage statistics, such as "a profile was viewed for a Toyota Camry".
Account details (optional, only if you sign in with Google or Apple)	When you choose "Sign in with Google" or "Sign in with Apple"	Stored with Supabase (servers in the United States). We receive from Google or Apple: your email address (with Apple this may be a private relay address if you choose "Hide My Email"), a unique account identifier, and, if provided, your name and a link to your profile picture. We also record when you signed in.	Used to sign you in, keep your garage in sync across your devices, and send you essential messages about your account or changes to these terms. No marketing emails without your separate consent. Kept until you delete your account (see §4).
Cloud backup of your garage (optional, only if you turn it on in Settings, or automatically while you're signed in)	When you choose "Back up", or when your garage changes while you're signed in	Stored with our database provider, Supabase (servers in the United States), under your account: an anonymous one created for your device, or your signed-in account.	Saved: each car's make, model, year or year range, generation, trim, body style, how it was identified (photo, manual pick or VIN), favourite flag, save date, and general specs (engine, fuel economy, safety rating, recall count, curb weight). Not saved: photos, VINs, licence plates, location, ZIP codes or price estimates. Kept until you delete it (see §4).
Technical data (IP address, browser type, request times)	Every request	Our hosting provider, Vercel, processes this to deliver the Service. We use your IP address briefly, in memory, to limit abuse.	Kept by Vercel under its own policies. We do not build profiles from it.

We do not collect: your name, email, phone number, contacts, precise location, payment information, or licence-plate numbers. We don't read licence plates, and we don't let you look up who owns a vehicle. If a plate or a person happens to be visible in a photo, the photo is still sent to Google as described in §3. That's why we ask you to avoid it.

No account, no cookies for tracking. The Service stores your garage, history, photos and settings in your browser's local storage. If you turn on cloud backup or sign in, a sign-in token is also stored there so your device can reach your account. We do not use advertising cookies, analytics trackers, or third-party pixels.

2. How we use information

Only to:

identify vehicles and show specs, recalls, safety ratings, fuel economy and estimated local value;
keep your history and garage on your device and, if you choose, back it up or sync it across your devices;
sign you in, and send you essential messages about your account or changes to our terms;
protect the Service from abuse (rate limits, blocking automated misuse);
understand, in aggregate, which features are used and how accurate the Service is, so we can improve it;
comply with the law and enforce our Terms of Use.

We do not sell or "share" personal information for cross-context behavioral advertising, and we do not use it for advertising.

3. Who receives information

Recipient: Google (Gemini API)
What they receive: Your photo (location data removed)
Why: To identify the vehicle. We currently use Google's unpaid Gemini service. Under Google's terms, Google uses content submitted to the unpaid service to provide, improve and develop its products, and human reviewers may read and annotate it. Google's handling is governed by Google's terms and privacy policy.

Recipient: Vercel
What they receive: Technical request data; your requests pass through its servers
Why: Hosting the website.

Recipient: Supabase
What they receive: Your account details and garage backup, if you sign in or turn on backup (see §1)
Why: Storing your account and backup. Database rules let only your account read or change its rows.

Recipient: Google or Apple, if you choose to sign in with them
What they receive: They handle the sign-in and learn that you signed in to SpotWorth
Why: Authenticating you. Their own privacy policies apply to what they collect.

Recipient: U.S. government data services (NHTSA vPIC, NHTSA recalls/complaints/ratings, EPA fueleconomy.gov) and similar public vehicle databases
What they receive: A VIN (for vPIC), or a make/model/year
Why: To look up official vehicle data.

Recipient: Market-data provider (for example MarketCheck), when enabled
What they receive: Make, model, year, trim, ZIP code, mileage, search radius
Why: To find comparable listings for a value estimate. While the Service shows sample values, no provider receives this.

Recipient: Authorities or others, when legally required
What they receive: What the law requires
Why: To comply with law, protect rights and safety, or in connection with a merger or sale of the business (the new owner would be bound by this policy).

Recipient	What they receive	Why
Google (Gemini API)	Your photo (location data removed)	To identify the vehicle. We currently use Google's unpaid Gemini service. Under Google's terms, Google uses content submitted to the unpaid service to provide, improve and develop its products, and human reviewers may read and annotate it. Google's handling is governed by Google's terms and privacy policy.
Vercel	Technical request data; your requests pass through its servers	Hosting the website.
Supabase	Your account details and garage backup, if you sign in or turn on backup (see §1)	Storing your account and backup. Database rules let only your account read or change its rows.
Google or Apple, if you choose to sign in with them	They handle the sign-in and learn that you signed in to SpotWorth	Authenticating you. Their own privacy policies apply to what they collect.
U.S. government data services (NHTSA vPIC, NHTSA recalls/complaints/ratings, EPA fueleconomy.gov) and similar public vehicle databases	A VIN (for vPIC), or a make/model/year	To look up official vehicle data.
Market-data provider (for example MarketCheck), when enabled	Make, model, year, trim, ZIP code, mileage, search radius	To find comparable listings for a value estimate. While the Service shows sample values, no provider receives this.
Authorities or others, when legally required	What the law requires	To comply with law, protect rights and safety, or in connection with a merger or sale of the business (the new owner would be bound by this policy).

We don't otherwise disclose information to third parties for their own direct-marketing purposes.

4. Your choices and rights

Delete everything: Settings → "Delete all my data" removes your garage, history, photos, preferences and device ID from your device and, if you used cloud backup, deletes your backed-up garage and your cloud account, including any account details from Google or Apple. If you used Sign in with Apple, we'll also ask Apple to revoke SpotWorth's access where we can; you can always remove it yourself in your Apple ID settings under "Sign in with Apple". Clearing your browser's site data removes what's on your device but not a cloud backup; to delete a backup without the app, email us.
If you don't sign in, we hold no profile about you on our servers. Photos and VINs aren't stored by us. The only thing we store is a garage backup you chose to make, tied to an anonymous account. If you sign in, we also hold the account details listed in §1. If you'd like to ask what we have or request deletion anyway, email privacy@spotworth.app and we'll respond within 45 days.
Do Not Track and similar signals: we don't track you across other sites and don't allow third parties to do so on the Service, so we treat every visitor the same whether or not a signal is sent.
California residents: you have the right to know what personal information we collect, to request deletion, and not to be discriminated against for exercising your rights. We don't sell or share personal information. Contact privacy@spotworth.app.

5. Age requirement

The Service is for people 18 and older. It is not directed to children, and we don't knowingly collect information from anyone under 18. If you believe a minor has used the Service, contact us and we'll help remove anything we can.

6. Where the Service is offered

The Service is offered to users in the United States. It is currently not available in the European Economic Area, the United Kingdom or Switzerland.

7. Security

Connections use HTTPS. We avoid storing what we don't need: no photos, VINs or plates on our servers. Cloud backups and account details are protected by database access rules so that only your own account can read them. No method of transmission or storage is perfectly secure, and data stored on your own device is protected by your device's own security.

8. Changes to this policy

If we change this policy, we'll update the effective date and version above. For material changes (for example, storing new kinds of information or adding accounts), we'll show a notice in the app and ask you to accept the updated policy before you continue scanning.

9. Changes since the last version

Version 3 (October 10, 2026): added optional sign-in with Google or Apple, with the account details that come with it, and syncing your garage across devices.

Version 2 (October 10, 2026): added optional cloud backup of your garage (Supabase), and clarified that the server may briefly keep a ZIP code in memory.

10. Contact

AZENSHIALS LLC (SpotWorth) · San Diego, California · privacy@spotworth.app