Privacy Policy

1. Overview

Minty Auto LLC (“we,” “us,” or “our”) provides the Minty Auto vehicle-maintenance service through our website (mintyauto.app) and our mobile app (the “Service”). This policy explains what information we collect, how we use it, who processes it, how long it is kept and how you can delete it.

2. Information We Collect

Information you provide

• Account information: your name, email address and password. Your password is stored only in hashed form by our authentication provider. If you choose a paid plan when signing up on our website, your password is also held temporarily in encrypted form until your payment is confirmed and your account is created, or until the sign-up expires, and is then removed. If you sign in with Google, we receive your name and email address from Google.
• Vehicle information: make, model, year, VIN, mileage, use type and notes.
• Records you create: service, maintenance and modification records, parts and costs, fuel and tire logs, service schedules and reminders.
• Vehicle photos and receipt images you choose to upload.
• Feedback you submit in the Service, and messages you send to support.
• Preferences such as distance units, currency and theme.

Information collected automatically

• Account and request identifiers, IP address and browser or device information (user agent). These are recorded when you sign up on our website (together with your acceptance of our Terms and this policy), when you submit feedback on our website, during multi-factor authentication attempts, and in the server logs of our hosting and database providers.
• Push notification tokens and your device platform, if you allow notifications.
• App version and platform, attached to feedback you submit.
• Installation identifiers, device information and diagnostic data generated by software components in our Android app (see section 4).

Camera and photos

The mobile app uses your camera, only when you choose to, to scan a VIN. The image is processed on your device to read the VIN and is not uploaded. Photos and receipts are uploaded only when you attach them.

Payments

Subscriptions are paid through Stripe’s secure checkout. On our website, checkout opens in your browser. In our Android app, choosing a paid plan or managing billing opens Stripe’s checkout or billing pages in your device’s web browser. Stripe collects your payment details, and any billing address it requires, directly under its own terms. We do not receive your full card number or billing address; we receive your subscription status, plan, billing period, payment amounts and Stripe customer and subscription identifiers.

We do not collect your precise location, contacts or microphone audio, we do not use an advertising identifier, we do not show ads and we do not sell your personal information.

3. How We Use Information

• To provide the Service: storing your vehicles and records, reminders and notifications, VIN decoding and recall lookups.
• To create and secure your account, including sign-in, multi-factor authentication and protecting sign-up from automated abuse.
• To process subscriptions and payments.
• To send service messages such as account confirmation, password reset and maintenance notifications.
• To respond to feedback and support requests.
• To keep the Service reliable, diagnose problems, and detect and prevent fraud or misuse.
• To comply with legal obligations.

4. Service Providers and Other Organizations

We use service providers that process information on our behalf to operate the Service:

• Supabase — authentication, database, file storage, backups and platform logs.
• Vercel — hosting for our website and servers, including server logs that can contain IP addresses, account identifiers and request details.
• Stripe — payment and subscription processing.
• Google — Google Sign-In (if you choose it); Firebase Cloud Messaging and Firebase Installations, which deliver push notifications to our Android app using an installation identifier, app version and device information; and ML Kit, which reads VINs on your device and sends Google device and app information, performance metrics and installation identifiers for diagnostics (not your images).
• Expo — push notification delivery and app update checks, which use your push token, an app installation identifier, platform and app version.
• Cloudflare — Turnstile bot protection on website sign-up, which evaluates browser and network signals including your IP address.
• Browser push services (operated by your browser’s vendor) — delivery of website notifications if you enable them.
• IONOS — our domain and support email.
• Email delivery — account emails such as confirmations and password resets are sent through our authentication provider or an email delivery service acting on our behalf.
• GitHub — software development infrastructure; it is not used to store your account data.

We also send information to other organizations in these cases:

• NHTSA (U.S. National Highway Traffic Safety Administration): when you decode a VIN or check for recalls, the VIN or the vehicle’s make, model and year is sent to NHTSA’s public services, either directly from the app or through our servers.
• People you choose to share with: a shared service-history link can be viewed by anyone who has the link until you stop sharing it or it expires.
• Legal requirements: when required by law or to protect rights, safety and security.
• Business transfers: as part of a merger, acquisition or sale of assets, subject to this policy.

5. Photos and Receipts

Receipt images are kept in private storage. When you view a receipt, the Service creates a temporary link for your signed-in account that expires after about 10 minutes. Anyone who has that link can open the receipt until it expires, so please do not share it.

Vehicle photos are stored with our storage provider at web addresses that contain random identifiers and are not published, but they are not password-protected: anyone who obtains a photo’s exact address can view it.

Making receipt storage private did not delete or change any stored files. Please avoid uploading images that contain information you would not want others to see, such as full payment card numbers.

6. Data Security

Data is encrypted in transit using HTTPS. Access to your records is restricted to your account, and we apply administrative and technical safeguards and log security events to detect misuse. Multi-factor authentication (MFA) is available and strongly recommended. No method of transmission or storage is completely secure.

7. Data Retention and Deletion

We keep your information while your account is active. You can delete your account, or specific data while keeping your account, as described on our Delete Account and Data page.

Deleting your account immediately removes your profile, login credentials, vehicles (including archived vehicles) and all their records, shared links, uploaded photos and receipts, push notification registrations, subscription records and any sign-up records for your email address from our live database and file storage. Before deletion, we cancel any Stripe subscription that could still bill you; if that cannot be completed, or a subscription started during an earlier, unfinished sign-up is still active, the account is not deleted until this is resolved with our support team. Subscriptions purchased through Apple or Google Play must be cancelled with those stores.

Deleting an individual record or vehicle, or removing or replacing a receipt, also deletes the related receipt or photo files from storage. If a file cannot be deleted at that time (for example, by an older version of our app), it is erased when you delete your account or on request.

If you start a paid sign-up on our website, we keep a record of it (your name, email address, sign-up time, IP address, device information and Stripe identifiers, but not your password). A sign-up that was never paid is removed once Stripe confirms it expired unpaid. Records of completed sign-ups, and of sign-ups whose payment still needs to be matched to an account, are kept until that is resolved or you delete your account.

After account deletion, the following may be retained:

• Feedback you submitted, after your email address, IP address, device information and account link are removed.
• A deletion record with a one-way coded identifier (not your name or email address), the request time and the outcome of each step, to show that the request was completed.
• Server and security logs kept by our hosting and database providers, which may contain your account identifier and IP address until they expire under those providers’ retention schedules. We cannot erase these logs on request.
• Database backups, until they are replaced during the normal backup cycle.
• Payment records kept by Stripe for accounting, tax, fraud-prevention and legal purposes.
• Emails you sent to support, and information we must keep to meet legal obligations.

8. Your Choices and Rights

• View and update your information in the Service, and export your vehicle records.
• Delete individual records, vehicles or your whole account (see section 7).
• Turn notifications and camera access on or off in your device settings.
• Contact us to request access to, correction of or deletion of your information. We will verify your identity before acting on a request.

9. Children's Privacy

The Service is intended only for users age 18 and older. We do not knowingly collect information from individuals under 18.

10. Changes to This Policy

We may update this Privacy Policy periodically. Updated versions will be posted on the website with a revised version number and effective date.

11. Contact Information

Minty Auto LLC
Email: support@mintyauto.app
Website: www.mintyauto.app