MotorDex is a game where you photograph real cars you spot and collect them as trading cards. This policy explains what we collect, why, who we share it with, and the choices and rights you have. We keep only what the game needs, we never sell your data, and you can delete everything yourself, in the app, at any time.
MotorDex is operated by Matteo Farinacci, the data controller for the personal data described in this policy. You can reach us about privacy at matteo.farinacci@gmail.com.
When you first open MotorDex we create an anonymous account with a random internal ID so you can play without signing up. Your catches and gameplay are stored under that ID. You can add an email or Sign in with Apple later to keep your data across devices, and you can delete everything at any time in Settings → Account → Delete Account.
We use it only to run the game: to identify your scans, build your dex and Catch Cards, place catches on your map, sync across your devices, power the friends feed, enforce limits, and provide support. We do not sell your personal data.
For California residents, the categories of personal information we collect are:
Sources: directly from you and your device. Business purposes: operating and securing the game as described in How we use your data. We disclose these categories only to the service providers listed under Third parties. We have not sold or shared any category of personal information in the past 12 months.
When you allow location, we collect your precise geolocation. California (CPRA) treats this as Sensitive Personal Information, and Virginia, Colorado, Connecticut and other states treat it as sensitive data. We collect it only with your consent (the iOS location permission you grant) and use it for one purpose: to place your own catches on your own map. We do not use precise geolocation to infer characteristics about you, we do not disclose it to your friends or any third party, and we do not sell or share it. Because we limit our use to providing the map you asked for, the CPRA Right to Limit Use of Sensitive Personal Information does not change how we handle it — but you can withdraw consent at any time in iOS Settings, and for users under 16 precise-location capture is off.
We share data only with the service providers we need to run MotorDex, who act as our processors under data processing agreements and may only use your data on our instructions:
If we add or change a provider we will update this policy; you may object by contacting us or by deleting your account. We do not use any push-notification service or third-party analytics SDK.
When you scan a car, the photo is sent through our server to Google Gemini to identify it, then stored in our backend so it can appear on your Catch Card and map. We read any date and location embedded in photos you upload. Each photo is served from an unlisted link with a random, unguessable address so it can load on your cards and in your friends' feed — anyone you share a card or link with can open that image. Photos taken in public may incidentally include other people, vehicles (and their plates), or property in the background. Please frame the car and keep identifiable people out of shot; we rely on our legitimate interest in running the game to process these images, we do not list them publicly, and anyone depicted may ask us to remove a photo using the in-app Report tool or the contact email below.
Your Spotter License can show a photo you choose instead of a car. This one is optional and it is the only picture you give us that isn't a car: if you set one, we upload it and show it to the friends you have accepted — nobody else. Like your catch photos it is served from an unlisted link with a random, unguessable address, so anyone you share that link with can open it; please don't use a photo you wouldn't want a friend to save. Choose a car sprite instead and no photo is uploaded at all. You can swap it or switch back to a car at any time, which deletes the previous one from our servers, and deleting your account deletes it too.
Location is optional. With "While Using" permission we attach where you made a catch so it shows on your map; we also read location embedded in photos you upload. Deny or revoke it anytime in iOS Settings — the app still works, those catches just won't have a pin.
When you scan a car, Google Gemini automatically suggests the make and model from your photo. This is an automated process, but it only produces an entertainment label for your Catch Card — it has no legal or similarly significant effect on you, so the special rules on solely-automated decisions in Article 22 GDPR do not apply. Identifications are best-effort and can be wrong; you can re-scan or delete any catch.
We rely on:
Your handle, your dex and level, and the catches you make are visible to friends you add, and friends can react to your catches. Use the in-app Report and Block tools for anything inappropriate — reports are reviewed within 24 hours and violating content or accounts can be removed.
Friends never see the precise GPS of your catches — only a count of how many you have pinned on your map. The exact coordinates of a catch are visible only to you.
We don't use cross-app tracking or third-party analytics SDKs, and our privacy manifest declares no tracking. If we enable ads they are non-personalized by default, and we will ask permission through Apple's App Tracking Transparency before any tracking — you can decline and still use every feature.
We keep your account, catch, and gameplay data until you delete the individual catch or your account, after which it is removed from our live systems immediately and purged from encrypted backups within 30 days. Scan-activity logs used to enforce daily limits are kept for up to 30 days. Purchase records held by Apple and RevenueCat are kept under their own policies and as tax and accounting law requires. Settings → Account → Delete Account permanently deletes your account, catches, photos, friends, reactions, and the reports and blocks tied to your account. This is immediate and can't be undone.
You can ask us to access, correct, delete, or restrict the use of your data, to object to certain processing, and to receive the personal data you gave us in a portable, machine-readable format (data portability). Where we rely on your consent — precise location, and any future ad tracking — you can withdraw it at any time without affecting earlier processing; turn location off in iOS Settings → Privacy → Location Services → MotorDex. You also have the right not to be treated differently for exercising these rights; we do not carry out profiling that has legal or similarly significant effects. To make a request you, or an authorized agent acting for you, can email us, and we will verify the request through your account. We honor a Global Privacy Control signal as an opt-out of sale or sharing. We respond free of charge: under the GDPR/UK GDPR within one month, extendable by up to two further months for complex requests (we'll tell you why); under the CCPA we confirm receipt within 10 business days and respond within 45 days, extendable once by 45 days. If we deny a request, residents of Virginia, Colorado, Connecticut and similar states may appeal by replying to our decision; we will respond within 45 days (60 for Colorado and Connecticut) and, if we still deny it, tell you how to contact your state Attorney General. You also have the right to lodge a complaint with a data protection authority — in the UK the Information Commissioner's Office (ico.org.uk), in the EEA your local Data Protection Authority — though we'd appreciate the chance to resolve your concern first at matteo.farinacci@gmail.com.
For transfers of EEA, UK, or Swiss personal data to the United States we rely on the European Commission's Standard Contractual Clauses, completed for the UK by the ICO's UK Addendum to those Clauses (or the UK IDTA), together with supplementary measures such as encryption in transit and access controls. Where a provider is certified under the EU-US Data Privacy Framework we rely on that certification. Copies of the relevant safeguards are available on request. We protect your data with HTTPS encryption in transit, database row-level security so each user can reach only their own data, encryption at rest provided by our backend, and least-privilege access controls. Catch photos are stored at unlisted web addresses with long, random identifiers: they are not individually encrypted or access-controlled, so anyone who has a photo's link (for example a friend you share a card with) can open it — please keep this in mind before sharing. No system is perfectly secure.
If a personal data breach occurs that is likely to affect your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware where the law requires, and we will tell affected users without undue delay where the breach is likely to result in a high risk to you.
MotorDex is a general-audience app intended for users 13 and older. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. You must be at least 13 to use MotorDex (see our Terms). We ask for your birth year once, and store it only on your device. People under 13 cannot create an account, and for users who tell us they are under 16 we turn precise-location capture off. If you are in the EEA or UK, the age at which you can consent to data processing without a parent varies by country (13 to 16); because we keep consent-based features such as precise location off for everyone under 16, we do not rely on a teenager's own consent for them. We do not sell or share personal information and we do not show personalized ads; if we ever enable advertising that could involve sharing personal information, we will not sell or share the data of any user we know to be under 16 without opt-in consent (from the user if 13-15, or a parent or guardian if under 13), as California law requires. If we learn we have collected data from a child under 13, we will delete it.
If this policy changes we'll update the date above and ask you to review it. Questions or requests: matteo.farinacci@gmail.com.