Privacy Policy

RPMBase is a digital garage for cars you own. Contact for privacy and data requests: support@rpmbase.app.

We act as the controller of personal data processed for the RPMBase service, except where a processor or store acts as an independent controller (for example Apple or Google for store billing).

A registered company name, postal address, MERSIS number, tax number, and named privacy officer are not published on this page. Until those details are published, use support@rpmbase.app as the contact point.

Account data: email address, whether that email is verified, display name, optional profile photo URL from your identity provider, Firebase Auth UID, optional Google or Apple Sign-In identifiers, and the version of the Terms you accepted in the app.

Garage data you enter: vehicles (make, model, year, nickname, notes), optional VIN and plate, mileage and mileage readings, maintenance, fuel, expenses, document metadata and photos you attach (stored as compressed images with your garage record), reminder dates derived from those records, and related notes.

Ask and AI features: questions, conversation history we store so you can continue a chat, receipt images you choose to scan, and short-lived receipt drafts used to fill a save sheet you confirm. Do not submit sensitive personal data you do not want processed for that purpose.

App and device data: language, display currency, notification preferences, Expo push tokens when you allow notifications, and App Check or session tokens used to authenticate API calls.

On-device only: emergency contacts you save in the app stay on the device. They are not uploaded to RPMBase servers.

Website data: waitlist email, locale, source, and a hashed client IP used for abuse limits if you join the list. Optional analytics only after you accept cookies.

Purchase data: subscription status, store product identifiers, and transaction or original purchase identifiers needed to unlock Premium. Payment card details are handled by Apple or Google, not by RPMBase.

Support data: messages you send to support@rpmbase.app, including attachments you choose to include.

Technical logs: our API logs request metadata for operations and security. We configure log redaction for authorization headers and similar secrets. We do not publish a log retention period.

We use your data to provide and improve the garage, reminders, Ask answers based on your records, PDF and share exports, achievements, Premium entitlements, customer support, security, and fraud prevention.

We may use aggregated or de-identified statistics to understand product usage. We do not sell personal data. We do not use your garage records for third-party advertising.

Legal bases typically include performance of a contract (providing the service you request), consent where required (for example optional analytics cookies), and legitimate interests such as securing the service, where those interests are not overridden by your rights.

Firebase Authentication (Google) verifies sign-in. Application data is stored in MongoDB. Hosting for the website and API is on our deployment providers.

Ask and receipt scan call OpenAI's Chat Completions API only after you accept the in-app data-sharing notice. We send your question, recent garage context (make, model, year, nickname, mileage, recent logs, reminders, yearly spend totals), conversation history, and receipt images you scan. Our code does not put VIN or plate into that prompt, even if you stored them on the vehicle. You can withdraw that permission in the app. We do not enable a separate training opt-in in our integration. OpenAI's then-current API data usage terms apply. We do not claim that OpenAI never stores prompts or never uses data for training.

Apple App Store and Google Play process payments as independent controllers. Expo delivers push notifications when you allow them. If a measurement ID is configured and you accept analytics, Google Analytics (gtag) may run on the website.

Transactional support email is handled by the mailbox at support@rpmbase.app and its email provider. If a waitlist webhook is configured by operators, the waitlist payload is also sent to that webhook.

Firebase, MongoDB hosting, OpenAI, Expo, Apple, Google, and website analytics (when enabled) may process data outside your country, including outside Türkiye and the EEA.

This Privacy Policy is not itself a transfer contract. Standard contractual clauses, adequacy decisions, or other transfer tools, if used, depend on operator contracts with those providers. Those contracts are not published here.

We keep account and garage data while your account exists. After a successful deletion, we remove the Firebase Auth user and the Mongo records listed on the Account Deletion page.

Ask conversation documents expire on a 30-day TTL. Receipt drafts expire on a 24-hour TTL. Rate-limit documents expire with their window.

We do not publish a backup retention period. Backup and restore settings are operator-configured and not evidenced in application source.

App stores, payment processors, email providers, and analytics tools may retain records under their own policies. Some security or legal retention may apply when required by law.

Depending on your location, you may have rights to access, correct, delete, export, or restrict processing of personal data, and to object to certain processing. You can update garage data in the app, change notification preferences, restore or cancel Premium in your store account, and request account deletion.

There is no automated privacy portal. Email support@rpmbase.app from your account email. We may need to verify your identity before acting. You can export a garage PDF from Profile while signed in. That PDF is a practical copy of garage records, not a full machine-readable dump of every system field.

Website visitors can accept or refuse analytics cookies. You may withdraw cookie consent using the control on the Cookie Policy page.

RPMBase is not directed to children under 13. You must confirm you are at least 13 years old to create an account. If we learn we collected data from a child under 13 without appropriate consent, we will delete it.

We use industry-standard measures appropriate to our size and risk profile, including encrypted transport (TLS), authenticated access, and least-privilege controls. No method of transmission or storage is completely secure. See the Security page for reporting practices.

We may update this policy. Material changes are posted on this page with an updated date. Continued use after the effective date means you accept the revised policy, except where consent is required by law.

Privacy questions and requests: support@rpmbase.app. Include your account email and whether you use iOS, Android, or the website.

This section is the Turkish personal data disclosure (aydınlatma) for RPMBase processing described in this policy. Explicit consent (açık rıza) is used for optional website analytics cookies. Core garage, account, security, and billing processing is not gated behind a generic KVKK checkbox.

You may request information, access, correction, deletion, restriction of processing, objection, and notification of third parties to whom data was transferred, as provided under KVKK. Send requests to support@rpmbase.app from a verifiable address.

International processing is described in section 5. Publishing this policy does not by itself make an international transfer lawful. Transfer tools in provider contracts are an operator legal matter.

The data controller's registered title, address, and MERSIS number are not published here yet. Use support@rpmbase.app until they are.