Privacy Notice

1. Overview

CarzBox helps families track a shared toy-car collection. This notice explains what personal information we collect, why we collect it, how we share it, how long we keep it, and the rights and choices you have.

This notice is provided for transparency. It is not a contract, and using CarzBox is not treated as your consent to processing that requires consent — where we rely on your consent (for example, location sharing), we ask for it separately and you can withdraw it at any time.

This notice applies to people in the United States, including California, and to people in the European Economic Area (EEA), the United Kingdom, and Switzerland. Some rights described here depend on where you live.

2. Who we are and how to contact us

CarzBox ("CarzBox", "we", "us") operates this service and is the controller responsible for your personal information.

For any privacy question, or to exercise your rights, contact us at info@carzbox.com.

3. Information we collect

Account details. Your email address. If you sign in with Google, we also receive your name and profile photo from Google. You may set an optional display alias. You sign in with Google or with an email magic link; we do not store a password.

Content you create. Collections, cars, statuses, notes, and photos you upload of your own collection or of store shelves. Photos may sometimes show other people or their property; please upload only photos you have the right to share.

Approximate location. Collected only if you turn it on (it is off by default), and used only to sort the community store feed and to suggest a nearby store when you submit a shelf photo.

Technical data. Basic server logs, IP address, device and browser information, and error reports (through our monitoring provider) that we use to operate, secure, and debug the service.

You must provide an email address to have an account; without it we cannot create or maintain your account. Other information (Google profile, alias, location, content) is optional.

4. How we use your information and our legal bases

To provide the service — sign-in, collections, invitations, the catalog, and the community store feed. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).

To sort the store feed and suggest a nearby store using your approximate location. Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time in your profile.

To keep CarzBox safe and reliable — moderating community photos, preventing abuse, diagnosing errors, and maintaining security. Legal basis: our legitimate interests in a secure, functioning service (GDPR Art. 6(1)(f)).

To communicate with you about invitations and important account or service notices. Legal basis: performance of our contract and our legitimate interests in administering the service.

To comply with legal obligations and to establish, exercise, or defend legal claims. Legal basis: legal obligation and legitimate interests (GDPR Art. 6(1)(c) and (f)).

We do not use your information for advertising, and we do not make decisions with legal or similarly significant effects about you by automated means alone.

5. Sharing and service providers

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We use service providers who process data on our behalf under contract and only on our instructions: Supabase (database, authentication, and file storage), Vercel (hosting), Resend (invitation emails), and Sentry (error monitoring).

Content you add to a shared collection is visible to the other members of that collection. Store shelf photos become visible in the community feed only after an administrator approves them. Approved photos can be reported by other users and removed by an administrator at any time.

We may also disclose information if required by law, to respond to lawful requests, or to protect the rights, safety, and security of CarzBox, our users, or the public.

6. Location data

Location sharing is off by default and is controlled by a setting in your profile. When you turn it on, we use your approximate location only to order the store feed and to suggest a nearby store at the moment you submit a shelf photo.

We do not continuously track your location. You can turn sharing off at any time; doing so does not affect location-based processing that already happened while it was on.

7. Cookies and similar technologies

We use only the cookies and local storage that are necessary to run the service — mainly to keep you signed in through our authentication provider. We do not use advertising or cross-site tracking cookies.

Our error-monitoring provider may set a technical identifier to link error reports to a session for debugging.

You can control cookies through your browser settings, but disabling necessary cookies may prevent you from signing in.

8. International data transfers

CarzBox is operated from the United States, and our service providers store and process data in the United States and possibly other countries.

If you are in the EEA, the United Kingdom, or Switzerland, your personal information is transferred to the United States. Where required, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), and/or a provider’s certification under the EU–US Data Privacy Framework. You can contact us for more information about these safeguards.

9. Data retention and deletion

We keep your account information and content for as long as your account is active. You can delete your account at any time from your profile.

Deleting your account removes the collections you own and the content within them, and removes your personal profile data. Content you contributed to collections owned by other people is reassigned to that collection’s owner so their collection stays intact; this means some content you created may remain in CarzBox after your account is deleted, without your name or profile attached.

We keep server logs and error reports for a limited period for security and troubleshooting, and residual copies may persist in backups for a short time before being overwritten. We may retain limited information longer where necessary to comply with law or resolve disputes.

10. Security

We use technical and organizational measures appropriate to the size of our service to protect your information, including encrypted connections, access controls, and reputable infrastructure providers.

No online service can be completely secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

11. Your privacy rights

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to receive a copy in a portable format, to object to or restrict certain processing, and to withdraw consent where we rely on it.

If you are in the EEA, the UK, or Switzerland, these rights come from the GDPR / UK GDPR. If you are in California, you have rights under the CCPA/CPRA, including the right to know, to delete, to correct, and to opt out of sale or sharing — and we do not sell or share your personal information as those terms are defined by law. We will not discriminate against you for exercising your rights.

To exercise any right, contact us at info@carzbox.com; you can also delete your account and its content directly in the app. We will respond within the time required by law (generally one month under the GDPR, and 45 days under the CCPA). We may need to verify your identity before acting on a request.

If you are in the EEA, the UK, or Switzerland and believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concern first.

12. Children’s privacy

CarzBox is intended for adults (for example, parents and family members) who manage a collection on behalf of a household. It is not directed to children, and children should not create accounts.

We do not knowingly collect personal information from children under 13 (or under the minimum age required in your country, which may be higher in the EEA/UK). If you believe a child has provided us with personal information, contact us at info@carzbox.com and we will delete it.

13. Changes to this notice

We may update this notice from time to time. If we make material changes, we will update the date below and, where appropriate, notify you in the app or by email. Your continued use of CarzBox after an update does not by itself constitute consent to any processing that requires consent.

14. Contact us

Questions about this notice or your personal information? Contact us at info@carzbox.com.