Privacy Policy
Vintrak, Inc.
Last Updated: August 25, 2026
Vintrak, Inc. ("Vintrak," "we," "us," or "our") respects your privacy. This Privacy Policy describes how we collect, use, disclose, and otherwise process personal information when you visit our website, create an account, use our platform, purchase products or services, communicate with us, or otherwise interact with us online or offline (collectively, the "Services"). By using the Services, you acknowledge the practices described in this Privacy Policy. If you do not agree, please do not use the Services.
1. What this policy covers
This policy describes what Vintrak, Inc. collects, why, and who else sees it. It covers the Vintrak website at vintrak.io, the Vintrak web app, and the Vintrak app for iPhone. It does not cover third-party sites or services we link to, which have their own policies. If something here is unclear, write to legal@vintrak.io and ask.
2. Your account
You can create an account with an email address and a password, with Sign in with Apple, or with Google. Passwords are handled by our authentication provider, Supabase. They are stored hashed and we never see them. If you use Sign in with Apple and choose to hide your email, Apple gives us a private relay address instead of your real one. That relay address is what we store and what we send email to. It works the same way for us as any other address, and we have no way to see the address behind it. If you use Google, we receive the email address and name on the Google account you pick.
3. Your profile
Your profile can hold a display name, a username, a short bio, a profile photo, a cover photo, a location you type in yourself, a profile type, favorite makes, the year you started driving, links to your social accounts, and your notification and appearance preferences. All of it is optional, and you choose whether your profile is public. The location field on your profile is free text that you type. It is not read from your device.
4. Your cars and their records
The core of Vintrak is the record you keep for each car. That can include the year, make, model, trim, color, VIN, mileage, status, purchase price, purchase date, condition, your own notes, and estimated value. Attached to a car you may also keep maintenance history, modifications, fuel fill-ups, service reminders, valuation history, photos, and documents. Documents are whatever you upload, and in practice that often means titles, registrations, insurance, and bills of sale. Those files can contain personal details beyond the car itself, including your name and address. You decide what to upload.
5. Location, and what the app records while you drive
The iPhone app can record a drive. When you start one and give permission, the app reads your precise GPS position continuously, including while the app is in the background, until you stop the drive. It does not track you when a drive is not running. What gets saved is the route itself: a list of latitude, longitude, and timestamp points, reduced to at most 600 points per drive, along with the distance, the duration, the start and end times, and optional labels you give the start and end. That route is stored on our servers with your account and is drawn on a map in the app. A route is a detailed record of where you went. Treat it that way. You can delete a drive from the app at any time. The app also asks for your location, separately, to show local weather on the home screen. For that we round your coordinates to three decimal places, which is roughly a hundred meters, and send them to Open-Meteo. Nothing in that request identifies you, and we do not store the result.
6. Camera and photo library
The iPhone app asks for camera access so you can scan a VIN barcode, photograph a document, and take pictures of your cars. It asks for photo library access so you can pick pictures you already have. We only receive the images you actually choose or capture. The app does not scan or read through your photo library.
7. Notifications
If you turn on notifications, we store a push token issued by Apple through Expo, along with the platform and when we last saw it. The token identifies the installation rather than you personally, but we keep it against your account so we can send reminders about your own cars. Turning notifications off in iOS settings stops them.
8. Payments and subscriptions
Subscriptions bought in the iPhone app go through Apple. Apple processes the payment and tells us it succeeded. We store Apple's transaction identifiers and your plan status. We never see your card. Subscriptions and one-time purchases bought on the web go through Stripe. Stripe processes the payment and we store the Stripe customer identifier and your plan status. We never see your card there either. We do not collect or store card numbers, billing addresses, or phone numbers anywhere in Vintrak.
9. What is public when you choose to share
Several features publish things on purpose, and it is worth being clear about what that means. A public profile is readable by anyone with the link. A share link for a car publishes the parts of that car's record you switch on, and you can revoke the link at any time. Marking a car open to offers publishes your note on that share page and lets anyone with the link send you a message. Wall posts and the Flip leaderboard show your display name. Separately from those choices, profile photos, cover photos, car photos, and wall images are kept in storage that is public by URL. The links are long and unguessable, but they are not secret, and they stay reachable to anyone holding one even after you stop sharing the car. Document files sit in the same kind of storage. On the web, documents are now opened through a link that expires shortly after you click it. The iPhone app still stores a direct link for them. If that matters for a particular document, the safest option is not to upload it.
10. Transferring a car to someone else
If you transfer a car to another Vintrak user, the history you choose to include is copied into their account and becomes theirs. Depending on the switches you set, that can include maintenance records, modifications, valuation history, photos, and documents. Once they accept, that copy is out of your hands. The car moves to your previous cars and you keep your own copy of its history.
11. Messages people send you about a car
If you mark a car open to offers, someone viewing its share page can send you a message. We store the name, email address, and message they enter, and show it to you. Those details belong to the sender rather than to you, and the conversation continues by email outside Vintrak.
12. Information collected automatically
When you use the website or web app, our hosting and database providers record ordinary server information, including your IP address, the pages requested, timestamps, and browser and device details. We use IP addresses to rate-limit abusive requests. We do not use them to build a location profile. The iPhone app talks to our database directly and does not send us separate usage logs.
13. Analytics and error monitoring
On the website and web app we use three tools, and this is the whole list. PostHog records page views and page exits so we can see which parts of the product get used. It only starts after you accept cookies in the banner, and we never tell it who you are, so what it collects is not tied to your account. Session replay is not enabled. Sentry records errors and performance traces so we can find bugs. Sentry receives the request context around an error, which includes your IP address. Before anything leaves our servers we strip authorization headers, anything shaped like an API key, and any name or email field in a request body. Session replay is not enabled here either. Vercel Analytics counts page visits in aggregate. The iPhone app contains no analytics, no crash reporting, and no advertising or tracking software of any kind. We do not use Google Analytics anywhere, and Vintrak does not track you across other companies' apps or websites.
14. AI features
Two features send data to Anthropic, which processes it for us. Valuations send the facts of the car being valued: year, make, model, trim, VIN, color, mileage, condition and your condition notes, purchase price and date, a summary of modifications and maintenance, and any context you type into the valuation form. Your name, email address, and account identifier are not sent. The daily briefing sends automotive news headlines only. Nothing about you or your cars goes with it. Valuations are estimates produced by a model. They can be wrong, and they are not an appraisal.
15. Other services that receive data
Some features work by asking a third party a question. In each case the request contains only what that service needs. Supabase hosts our database, authentication, and file storage. Vercel hosts the website and web app. Apple and Google handle sign-in when you use them. Apple and Stripe handle payments. Resend delivers our email. Anthropic handles the AI features described above. NHTSA receives a VIN when you decode one, and car details when we check for recalls. The EPA fuel economy service receives a year, make, and model. The U.S. Energy Information Administration receives no personal data, only a request for regional fuel prices. Open-Meteo receives rounded coordinates for weather. Zippopotam receives a postal code when the app looks up a place name. GitHub serves manufacturer logos, so it sees a request naming the make of a car you own. QR Server generates the QR code for a share link, so it receives that link. These providers see your IP address as part of receiving the request, as any web service does.
16. How we use what we collect
To run the product and keep your records; to sign you in and keep your account secure; to generate valuations, reports, and share pages you ask for; to send reminders and transactional email; to process payments and manage subscriptions; to answer support requests; to find and fix bugs; to detect and stop abuse; and to comply with the law. We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use your car records or documents to train AI models.
17. How long we keep things
We keep your account and its records for as long as your account exists. When you delete a car, a drive, a document, a note, or a message inside Vintrak, we mark the record deleted and stop showing it. The row stays in our database. We do not currently run a job that permanently erases deleted records after a set period, so we are not going to state a deletion window we do not enforce. Files you have uploaded remain in storage after the record pointing at them is deleted. If you want your account and its contents removed, email legal@vintrak.io and we will do it.
18. Security
Access to your data is enforced in the database itself, so one account cannot read another's records. Traffic is encrypted in transit. Passwords are hashed by our authentication provider. Payment card details never reach our systems. The exception worth repeating is the storage described in section 9: uploaded images, and documents opened from the iPhone app, are reachable by anyone holding the file link. No system is perfectly secure, and we cannot promise otherwise.
19. Your choices and rights
You can edit or delete your profile fields, cars, records, drives, and documents in the product at any time. You can revoke a share link, turn off open to offers, turn notifications off in iOS settings, and decline or withdraw cookie consent on the website. Depending on where you live you may also have the right to ask what we hold about you, get a copy, correct it, or have it deleted, and to appeal if we refuse. Write to legal@vintrak.io. We may need to confirm who you are first.
20. Where your data is processed
Vintrak and its providers process and store data in the United States. If you use Vintrak from elsewhere, your information is transferred to and processed in the United States, which may not offer the same protections as your home country.
21. Legal bases, for regions that require them
Where the law requires a legal basis, we rely on: performing our contract with you, to run the product you signed up for; our legitimate interest in keeping the product working, secure, and improving; your consent, for cookies and analytics on the website and for location, camera, photos, and notifications on your phone, each of which you can withdraw; and compliance with legal obligations.
22. Children
Vintrak is not for children under 18 and we do not knowingly collect their information. If you believe a child has given us information, write to legal@vintrak.io and we will remove it.
23. Changes to this policy
If we change this policy we will update the date at the top and post the new version. If a change is significant we will say so rather than leaving you to notice.
24. Contact
Vintrak, Inc. legal@vintrak.io