Privacy Policy

Version of 28 September 2026 · English reading version · Deutsch

This privacy policy explains how your data is handled in the CarDex app. CarDex is deliberately built to collect as little data as possible: most of your data stays locally on your device. However, some features transfer data to us or to service providers: the vehicle recognition (photo to Google), the global leaderboard (player name + statistics to our server), the optional email sign-in (email address), the Pro subscription (subscription status via RevenueCat) and the voluntary ad videos (Google AdMob, section 10). There are no banners and no ads that pop up on their own — a video only plays if you start it yourself. The Android app currently does not offer ad videos; there, the app does not start the advertising component (section 10). You will find the details below.

Some sections distinguish between app versions (“up to 1.4.1” / “from 1.4.2”). The Android app only exists from version 1.4.2; “from 1.4.2” always applies to it. You can see your installed version on iPhone under Settings → General → iPhone Storage → CarDex, on Android under Settings → Apps → CarDex; from version 1.4.2, it is also shown in the app at the very bottom of the settings.

1. Controller

2. Which data stays locally on your device

Your collection (spotted cars, cards, photos, level, streak, statistics and your unlock status) is stored locally on your device (in the app storage or localStorage/IndexedDB). Your photos only leave the device when you scan, and then only the one scanned photo (section 3). For the leaderboard, the app automatically transfers your player name and a few key figures (section 5). Your collection is not backed up on our server: if you delete the app or choose “Delete all data” („Alle Daten löschen“), your collection, photos, level, statistics and your sign-in are irrevocably gone. “Delete all data” only resets this game progress. The following remain on the device: the start time of your trial week (from app version 1.4.2, section 7), the leaderboard device ID together with your leaderboard settings (opt-out, hidden entries, pending deletion requests; section 5), the app lock setting, the cached Pro status, individual technical flags (e.g. whether the request for an app rating has already been shown) and the data that the integrated services of RevenueCat (section 7) and Google (ad consent, section 10) store on the device themselves. The operating system only removes this data when the app is deleted – on iPhone, not even then for the start time of the trial week in the Keychain (section 7).

Android: For CarDex, the automatic backup of app data to your Google account and the transfer of app data when setting up a new device are switched off. When you uninstall the app, Android deletes the data in CarDex’s app storage, including the start time of the trial week (section 7).

3. Vehicle recognition (photo processing)

When you scan a photo, this one image (reduced in size) is sent to our server (api.car-dex.com) and from there to the AI service Google Gemini API for analysis. The photo is not stored permanently on our server: it is only held in the server’s working memory or cache for the duration of the request, passed on to Google and then discarded. The result (make, model, power, estimated market value) is returned to your app.

• Purpose: recognition of make, model, power and estimated market value.
• Legal basis: Art. 6(1)(b) GDPR (provision of the feature you requested). Where data of third parties is visible in the photo (e.g. licence plates or people): Art. 6(1)(f) GDPR (legitimate interest in vehicle recognition); this data is neither analysed nor stored.
• Recipient: Google (Gemini API). Where billing is via Google Cloud, the contractual partner is Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland. Google processes photos and responses as our processor under its data processing terms (Data Processing Addendum); other Google companies, in particular Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), may be involved as sub-processors.
• What Google does with the image: Google does not use the photos and responses to improve its own products or AI models. For providers from the European Economic Area, these data rules apply to any use of the Gemini API under the Gemini API Terms of Service (ai.google.dev/gemini-api/terms). Google logs requests and responses for a limited period in order to detect violations of its usage policies and to comply with legally required disclosures.
• Third country: Processing may take place in the USA; the data may also be cached temporarily in other countries in which Google or its subcontractors operate facilities. The transfer is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, under which Google LLC is certified, and otherwise on the EU Standard Contractual Clauses in Google’s data processing terms.
• Tip: If possible, photograph only the vehicle. Avoid recognisable people. Licence plates are not needed for recognition.
• Necessity: Without a photo, recognition cannot be carried out; the rest of the app can still be used.
• Reporting AI-generated texts (Android): The short fun fact on each card is generated automatically by the AI; it may be wrong or inappropriate. In the Android app, you can report it directly on the card. The app then sends the recognised car (make and model) and the reported text to our server (Hetzner, Germany). We store the report only with a timestamp, without IP address and without device ID, and delete it automatically after 90 days at the latest. To prevent misuse, we count reports per IP address in working memory only (section 4). Purpose: review and improvement of the AI texts. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in accurate and appropriate content in the app).

Information on Google’s processing: policies.google.com/privacy · Gemini API Terms of Service: ai.google.dev/gemini-api/terms · Data processing terms: business.safety.google/processorterms

4. Hosting & server logs

Our website and servers are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in Germany (processor under Art. 28 GDPR). When the website is accessed and with every request from the app to our server (scan, leaderboard, sign-in), the web server automatically processes technically necessary access data in log files (IP address, time, requested URL, amount of data, browser/operating system). These log files are deleted automatically after about one week, at the latest after 8 days. In addition, we count requests per IP address – for sign-in requests also per email address – in order to limit the number of requests and prevent misuse. These counters are kept only in working memory, are not written to disk and are deleted by an automatic clean-up run no later than 25 hours after the respective request. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation).

5. Global leaderboard

CarDex has a global leaderboard. Once you have accepted the Terms of Use at the first start, the app automatically sends your game progress to our server (Hetzner, Germany) every time the app starts and after every change, where it is stored and shown in the public ranking. App versions up to 1.4.1 already send an entry with the default name “Spotter” and zero values at the very first start – before consent; from version 1.4.2, this only happens after consent. Participation is voluntary: you can opt out at any time (see “Deletion”); after that, the app sends no more data to the leaderboard.

• Data processed: your player name (“Spotter” by default, changeable in the settings), a randomly generated, pseudonymous device ID (no link to your name, your Apple Account or your Google account), your game statistics (number of spots, of which Legendary, Dex progress, estimated garage value, duel record, level) and the time of the last update. If you report an entry, we store with the reported entry a non-reversible check value (hash) of your device ID and the time of the report, so that each user is only counted once.
• Publicly visible: player name, rank and the respective ranking value. The device ID itself is not published; for the report feature, the server only delivers a non-reversible check value (hash) derived from it. Only someone who knows the device ID – i.e. your app – can change or delete your entry. Because the ID itself used to be delivered with the ranking, the app replaces it once with a new one from version 1.4.2 and deletes the old entry. Please do not use your real name or any personal data as your player name.
• Purpose: display of the global ranking (competition/game feature).
• Legal basis: Art. 6(1)(b) GDPR (game feature under our Terms of Use); for the entry that app versions up to 1.4.1 send before consent, Art. 6(1)(f) GDPR (legitimate interest in a working ranking; only the default name, zero values and the random device ID are transferred). Report check values: Art. 6(1)(f) GDPR (moderation, protection against misuse).
• Recipients: only our server (Hetzner, Germany) — no disclosure to third parties, no third country.
• Storage period / deletion: Your entry remains stored until you delete it, but no longer than 12 months after its last update; after that, we delete it automatically (e.g. if you no longer use or have deleted the app). Via Settings → “Remove from leaderboard” („Aus Bestenliste entfernen“) (or “Delete account”, „Konto löschen“), the app stops reporting data to the leaderboard immediately and instructs our server to delete your entry; if the server can be reached, the entry is deleted immediately. From version 1.4.2, the app only confirms a deletion that has actually taken place, tells you if it did not work (e.g. without an internet connection) and automatically repeats the deletion request at every start until the server confirms the deletion. Versions up to 1.4.1 show “Aus Bestenliste entfernt” (“Removed from leaderboard”) even if the server could not be reached, and do not repeat the request on their own; there, after removing, check whether your name has disappeared from the ranking, and otherwise tap “Aus Bestenliste entfernen” again with an internet connection. Once the app has been deleted, it can no longer remove your entry itself, because the device ID was only stored on the device – in that case, write to us with your player name at info@car-dex.com. “Delete all data” keeps the device ID; your entry is then updated with the reset values. We delete report check values 12 months after the report, at the latest together with the reported entry. The ranking comprises a maximum of 2,000 entries; beyond that, we automatically remove the entries with the fewest spots.
• Moderation: Offensive player names are automatically replaced with “Spotter”. Every user can hide entries for themselves and report them via the report button; entries that have been reported by three different users are automatically hidden for everyone.

6. Sign-in with email (optional)

You can optionally sign in with your email address. Signing in is voluntary — the app can be used in full without it.

• Process & data: You enter your email address, and our server sends you a 6-digit confirmation code (valid for 10 minutes). After you enter it correctly, the app stores a signed sign-in token on your device.
• Storage on our side: We do not keep a user database. Your email address and the code (only as a check value/hash) are held only in our server’s working memory and are not written to disk: the code check value until it has been entered successfully, at the latest 15 minutes after the request (the code is valid for 10 minutes), and the misuse counter with your email address at the latest 25 hours after the request. The app stores your sign-in and email address only on your device. There is no backup or transfer of your garage to other devices; your game progress is not transferred to our server when you sign in.
• Sending: We send the code via the service Brevo (Sendinblue SAS, Paris, or Sendinblue GmbH, Berlin), which we use as a processor (Art. 28 GDPR). Brevo stores the sending data (recipient address, time, delivery status) according to its own deletion periods.
• Purpose: confirmation of your email address and sign-in to the app.
• Legal basis: Art. 6(1)(b) GDPR (feature requested by you).
• Deletion: at any time via Settings → “Delete account” („Konto löschen“) (removes the sign-in from your device and your leaderboard entry) or by email to info@car-dex.com. Step by step, also without the app: Delete account and data (page in German).

Brevo privacy policy: brevo.com/legal/privacypolicy

7. Trial week & subscription (CarDex Pro)

The app manages the free trial week only locally on your device; no data is transferred to us, Apple, Google or RevenueCat for this purpose. From app version 1.4.2, the app also stores the start time of the trial week outside the game progress, so that the trial week only runs once per device, as provided for in the Terms of Use. On iPhone, it is stored in the iOS Keychain of your device. This timestamp remains on the device even after “Delete all data” and after the app is deleted. The app does not transfer it to us or to third parties, and it is not synchronised via iCloud Keychain. Like other Keychain entries, however, iOS may include it in an encrypted device backup (iCloud backup or encrypted backup on a computer); if you set up a new iPhone from such a backup, it is transferred too, and the trial week then also counts as used on the new device. It is removed when the device is reset (“Erase All Content and Settings”), provided you do not restore such a backup afterwards. On Android, the app stores it encrypted in the private app storage (the key is stored in the Android Keystore of your device). It is kept after “Delete all data” and is deleted when the app is uninstalled; it is not backed up to your Google account or transferred to a new device (section 2). On Android, too, the app does not transfer it to us or to third parties. Legal basis: § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act; strictly necessary for the trial week you use) and Art. 6(1)(f) GDPR (legitimate interest in granting the free trial week only once per device). A subscription is purchased via the store from which you installed CarDex: on iPhone via the Apple App Store, on Android via Google Play (contractual partner for the purchase: Google Commerce Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; processed via Google Play Billing). Apple or Google alone is responsible for payment processing (credit card, bank and billing data); we do not receive this payment data. For the technical management of subscriptions (checking the “Pro” status, loading the current prices, restoring purchases), we use RevenueCat, Inc. (1032 E Brandon Blvd #3003, Brandon, FL 33511, USA). For this purpose, the app connects to RevenueCat every time it starts, even if you have not bought anything. A pseudonymous app user ID, device/platform identifiers and the purchase and subscription status are transferred in the process. On Android, RevenueCat also verifies purchases directly with Google Play and, for this purpose, receives information about your purchase from Google (e.g. purchased subscription, purchase ID, term, renewal, cancellation or refund); RevenueCat does not receive your payment data either.

• Purpose: provision and management of the Pro subscription.
• Legal basis: If you have taken out a subscription, Art. 6(1)(b) GDPR (performance of the subscription contract); likewise if you start a purchase or “Restore purchases” yourself in the Pro window. We base the connection to RevenueCat at app start without a subscription (checking whether a subscription exists and loading the current prices) on Art. 6(1)(f) GDPR – our legitimate interest in unlocking an existing subscription for you without any action on your part and in displaying correct, current prices.
• Recipient / third country: RevenueCat, Inc. (USA) as processor; the transfer to the USA is safeguarded by the EU Standard Contractual Clauses.

RevenueCat privacy policy: revenuecat.com/privacy

Google Play (Android): If you download CarDex via Google Play or buy a subscription there, Google processes data in the process under its own responsibility (policies.google.com/privacy). In the Play Console, Google provides us with aggregated statistics (e.g. installations, ratings) and – if you have allowed the sharing of usage and diagnostic data on your device – crash reports.

8. Camera, photos, app lock & sharing

The app only requests access to the camera or the photo library/photo picker when you start a scan yourself. You can revoke this permission at any time in your device settings. The optional app lock with Face ID / Touch ID runs entirely via iOS; on Android, it runs entirely via the device unlock (e.g. fingerprint, face unlock or device PIN). We do not receive any biometric data. When you share a card, the app creates the image on your device and hands it over to the destination you select in the share menu; nothing passes through our server.

9. Note for young users

CarDex is aimed at users aged 13 and over; the app is not intended for children under 13. For the processing of personal data on the basis of consent, Art. 8 GDPR sets an age limit of 16 years; however, we base the server-side features (leaderboard, email sign-in) on the performance of a contract (Art. 6(1)(b)), not on consent. Irrespective of this, the following applies to taking out a paid Pro subscription: minors need the consent of a parent or legal guardian (e.g. via Apple “Family Sharing” / “Ask to Buy” or, on Android, via Google Family Link / purchase approval in Google Play). If you are not yet of legal age, please talk to your parents before making a purchase. Parents can reach us at info@car-dex.com.

10. Advertising (rewarded videos)

After the free trial week, you can unlock individual scans and Car Duels by voluntarily watching a short ad video. In CarDex there are no banners and no ads that pop up on their own — a video only plays when you press a video button yourself (e.g. “Video for 1 scan” or “Watch a video → 1 Car Duel”). With a Pro subscription, you don’t need any videos.

Android: The Android app currently does not offer ad videos. There, the app does not start Google’s advertising component: it does not ask for ad consent (not even at app start), does not request videos, does not preload any and does not transfer any data to Google for this purpose. The information in this section on the Android app (advertising ID, app set ID, consent request) only applies once the Android app offers ad videos; we will then update this policy.

• Service: Google AdMob. The contractual partner is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
• Data processed: the device’s advertising identifier (iPhone: IDFA, Android: advertising ID; only with your permission, see below), IP address, device type, operating system, approximate location (country/region) and information on whether a video was delivered and watched to the end. On Android, the Google component may additionally collect the app set ID (an identifier of Google Play services that only applies to the apps of the same developer on your device; Google uses it, among other things, for analytics and fraud detection), technical performance and diagnostic data (e.g. app start time, crashes of the advertising component) and information on whether a video was tapped.
• When the advertising component is active: From app version 1.4.2, the app only starts Google’s advertising component when you have no ongoing trial week and no Pro subscription, and only after your consent has been clarified (see “Legal basis”). During the trial week and with Pro, it only queries the stored consent status from Google at start, so that you can revoke consent given earlier in the settings. App versions up to 1.4.1 start the advertising component at every app start, including during the trial week and with Pro.
• Preloading: So that a video starts without waiting, the app requests a video from Google in the background in advance. In the process, the data mentioned above is transferred to Google, even if you end up not watching a video. From version 1.4.2, this only happens without a trial week and without a Pro subscription; versions up to 1.4.1 also preload during the trial week and with Pro.
• Purpose: delivery and billing of the videos, fraud detection, reach measurement.
• Consent request: To obtain, store and be able to demonstrate your consent, we use the consent request certified by Google (User Messaging Platform, UMP). For this purpose, the app queries Google at every start – also during the trial week and with Pro, and before you have made a decision – whether consent is required for your device and what its status is; in the process, IP address, device type and the stored consent status, among other things, are transferred to Google. The Google component stores your decision on your device. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to obtain and demonstrate consent) and Art. 6(1)(f) GDPR (legitimate interest in respecting your consent decision and enabling you to revoke it in the app); storing and reading this consent status on your device is permitted without separate consent under § 25(2) no. 2 TDDDG.
• Legal basis: For personalised advertising and access to information on your device (e.g. the advertising identifier), your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. From version 1.4.2, the app only shows you the consent window after the trial week has ended (at the next app start or when you open the scanner, the Car Duel lock or the Pro window); up to 1.4.1, at the first start. iOS only releases your iPhone’s advertising identifier (IDFA) if you allow it in the Apple system window “App Tracking Transparency”; whether this window appears is controlled by Google’s consent request. If it does not appear or you decline, the advertising identifier remains blocked and is not used. On Android, there is no such system window. Where consent is required (e.g. in the European Economic Area), the app only shows Google’s consent request (UMP) there; on Android, Google only uses the advertising ID to the extent that you have agreed in it to access to information on your device. If you have deleted the advertising ID in the Android settings, it cannot be used. If you decline personalised advertising, only non-personalised videos are shown; we base the processing technically required for this (e.g. IP address, device type) on our legitimate interest in financing free use through voluntary videos (Art. 6(1)(f) GDPR).
• Revocation: at any time with effect for the future — in the app under Settings → “Change ad consent” („Werbe-Einwilligung ändern“); tracking permission granted on iOS additionally under Settings → Privacy & Security → Tracking. On Android, you can additionally reset or delete the advertising ID in the device settings (depending on the device under “Google” → “All services” → “Ads” or under “Privacy” → “Ads”).
• Recipient / third country: Google Ireland Ltd.; processing may be carried out by Google LLC in the USA. Safeguarded via the EU-US Data Privacy Framework and additionally the EU Standard Contractual Clauses.
• Storage period: Your consent decision remains stored on your device until you change it or delete the app. Google stores advertising data according to its retention rules; for example, in advertising server logs, parts of the IP address are anonymised or deleted after 9 months and cookie information after 18 months. Details: policies.google.com/technologies/retention.

Younger users: If you are under 16, you cannot effectively consent to personalised advertising yourself under Art. 8 GDPR — please decline the request in that case or ask your parents. Only non-personalised videos will then be shown. See also section 9.

We do not carry out any cross-device profiling for our own purposes.

11. Contact by email

If you write to us at info@car-dex.com (e.g. via the support button in the app), we process your email address, your name (if provided), the content of your message and technical details of the email (e.g. time) in order to answer your request.

• Purpose: processing and answering your request (support, questions, data protection matters).
• Legal basis: Art. 6(1)(b) GDPR, insofar as your request concerns the use of the app or your subscription; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests); for requests regarding your data protection rights, Art. 6(1)(c) GDPR.
• Recipients: Emails to our domain are received by the forwarding service of our domain provider Namecheap, Inc. (4600 East Washington Street, Phoenix, AZ 85034, USA), which forwards them to our mailboxes at Google (Gmail) and/or Microsoft (Outlook.com).
• Third country: Processing also takes place in the USA. Microsoft Corporation and Google LLC are certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission). The transfer to Namecheap is governed by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of Namecheap’s data processing agreement (Data Processing Addendum); available at namecheap.com/legal/universal/data-processing-addendum. You can also request a copy from us.
• Storage period: We delete your request as soon as it has been fully dealt with, unless statutory retention obligations (e.g. for business letters under § 257 HGB, German Commercial Code) require longer storage.

12. Your rights

Under the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can revoke any consent you have given at any time with effect for the future (Art. 7(3)).

• Local data: game progress and sign-in can be deleted yourself via “Delete all data”; everything else the app stores on the device by deleting the app (section 2). The exception on iPhone is the start time of the trial week in the Keychain (section 7).
• Leaderboard: can be deleted yourself via Settings → “Remove from leaderboard”.
• Email sign-in: can be deleted yourself via Settings → “Delete account”. Instructions, also without the app: Delete account and data (page in German).
• Ad consent: can be changed via Settings → “Change ad consent”.
• Other matters: by email to info@car-dex.com.

You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the supervisory authority responsible for us in Lower Saxony (LfD Niedersachsen, the State Commissioner for Data Protection of Lower Saxony).