Privacy policy

This policy explains what data the Cardashly Android app ("the app") and this website use, why, what we will never do with your data, and the choices and rights you have over it. Cardashly is published by Psychelit. We do not sell your personal data, and the app works without an account.

The short version

We collect as little as possible. We do not sell your data, we do not run advertising or build advertising profiles, and your personal driving and vehicle preferences stay on your device unless you explicitly choose to sign in with Google to back up your garage across devices.

Data that stays on your device

By default, your vehicles, saved places, maintenance records, favorite radio stations, contacts you add inside the app, trip history, and settings are stored locally on your phone. Even if you sign in with Google for cloud backup, your trip GPS tracks and trip history, speed-dial contacts, favorite radio stations, and device-specific settingsremain strictly on your device and are never uploaded to our cloud database. Local data is removed when you clear the app's storage or uninstall it.

Optional Google sign-in and cloud backup

Signing in is completely optional ("Continue as guest" is always available). If you choose to sign in with Google:

• Account identity(Google Firebase Authentication & Google Credential Manager): we receive your Google account user ID (UID), email address, and display name so we can authenticate your session and display your account profile in Settings.
• Synced garage & places (Google Cloud Firestore): the app synchronizes your saved places (including Home, Work, and custom pinned coordinates and addresses), vehicles (brand, model, year, trim, fuel type, body type, tire and service specs, odometer), and maintenance schedules & service logs to a private Firestore collection scoped strictly to your user ID. You can pause automatic sync or restrict it to Wi-Fi / unmetered networks at any time in Settings → Account.
• Purchase entitlement sync (RevenueCat): when you sign in, your account user ID is linked with RevenueCat so any Premium subscription or lifetime purchase you own follows you to a new Android device.

Account and cloud data deletion

If you signed in with Google, you can permanently delete your account and all cloud-synced data at any time:

• Inside the app (instant): open Settings → Account → Delete account and confirm. The app immediately wipes all of your cloud documents in Firestore (places, vehicles, maintenance items, and logs) and permanently deletes your Firebase Authentication user record, while leaving your local on-device data untouched.
• On the web (without the app installed): visit cardashly.com/delete-account or email [email protected] from the Google email address associated with your account with the subject "Delete Cardashly Account". We will permanently delete your account and all cloud-synced data within 7 days.

Permissions and why we ask

• Location: powers the speedometer, heading, maps, turn-by-turn navigation, and local weather. It is used while the dashboard is running, including in a foreground service during an active drive.
• Bluetooth & Nearby devices: connects to an OBD-II adapter you have paired, to read live vehicle data such as speed, RPM, and engine temperature.
• Notification access (optional): lets the dashboard show what is playing in your other media apps (such as Spotify or YouTube Music). We do not store or upload notification content.
• Notifications: driving alerts, navigation cues, and playback controls.

Services that receive data

To provide core features, the app sends only what each service needs:

• Maps and routing (Mapbox, OpenStreetMap Nominatim): your location and search queries, to draw the map, find places, and calculate driving routes.
• Toll prices (HERE, and TollGuru when HERE has no price): the start and end points of a route and its outline, sent through our own server, to estimate the tolls on the route you are previewing. It is only asked for routes that use toll roads, and the answer is cached by area so many drivers share one lookup. We do not link it to your identity and we do not keep a history of the routes you plan.
• Weather: approximate coordinates, to fetch the forecast for where you are or along your route.
• Voice guidance(Microsoft Azure Speech): the text of a navigation prompt (such as "turn right in 200 meters"), to turn it into spoken audio. No personal data is included.
• EV range estimates (electric vehicles only): route points and your vehicle model, to estimate energy consumption along a route.
• Internet radio and music catalogues (Radio Browser, Audius): search terms and the stream you choose to play.
• Vehicle lookup (NHTSA vPIC): the make and model you pick when adding a car.
• App analytics and stability(Google Firebase Analytics and Crashlytics): anonymous usage events, device model, OS version, and crash stack traces, to find bugs and understand which features are used. Firebase Analytics may read your device's advertising ID; you can reset or delete it in Android settings under Privacy > Ads. We do not show ads. These do not include your precise location or contacts.
• Google Play & RevenueCat: purchases and subscriptions are processed by Google Play Billing; we never see your payment card details. RevenueCat verifies purchase entitlements and, when you sign in with Google, links your account user ID so your Premium access transfers across your devices.
• Optional cloud sync(Google Firebase Authentication & Cloud Firestore): if you sign in with Google, your account identity (UID, email, display name) and your synced places, vehicles, and maintenance records are stored in Google Firebase.

Legal bases for processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we process data on these legal bases:

• Contract: to provide optional Google sign-in and cloud backup when you choose to sign in, and to deliver in-app purchases.
• Legitimate interests: to fix crashes, keep the app secure, and provide automotive features, balanced against your privacy.
• Consent: for optional device permissions you grant, such as location, Bluetooth, or notification access. You can revoke consent at any time in device settings.
• Legal obligation: where necessary to comply with applicable laws.

Your privacy rights

You can ask to access, correct, or delete any personal or diagnostic data associated with you, or to restrict or object to our processing. Local vehicle and trip data on your phone can be deleted immediately by clearing the app's data or uninstalling, and cloud-synced data can be deleted anytime in Settings → Account → Delete account or at cardashly.com/delete-account.

California residents: We do not sell your personal information and do not share it for cross-context behavioral advertising. You have the right to know what we process, to request deletion, and not to be treated differently for exercising these rights.

EEA and UK residents: You have the right to lodge a complaint with your local data protection authority.

To exercise any rights, contact us at [email protected].

Tracking signals and automated decisions

We honor Global Privacy Control (GPC) and Do Not Track signals. In practice this changes little, because we do not track you across other apps or websites in the first place. We do not make automated decisions about you that produce legal or similarly significant effects.

International data transfers

Our service providers (such as Mapbox, Google Firebase, and Azure) may process data on servers located outside your country. Where they do, they maintain standard contractual clauses and appropriate safeguards under applicable law.

Data retention and security

Technical diagnostic data is retained only as long as needed to diagnose issues, then deleted. Personal preferences and vehicle records remain on your device until you remove them. If you sign in with Google for cloud backup, your synced records remain in your private Firestore collection until you delete individual items or delete your account (deleted item tombstones are pruned after 30 days). All data transmitted between the app and our cloud services is encrypted in transit over HTTPS/TLS.

This website

cardashly.com uses Vercel Web Analytics and Speed Insights, which are cookie-free and do not identify you. We also use Yandex Metrica, which records anonymized usage to help us improve the site; it does not receive your name or email. If you join the waitlist, your email address is stored by our form provider (Formspree) and used only to tell you when the app launches. Ask us and we will delete it. Some pages embed a demo video from YouTube (using the privacy-enhanced youtube-nocookie.com domain, which loads when you reach the video) and show a badge image served by Product Hunt; those providers receive your IP address and browser details when the content loads, under their own policies.

Children

Cardashly is not directed at children under 13, and we do not knowingly collect data from them.

Your choices

You can deny or revoke any permission in Android settings; the related feature will simply stop working. You can clear the app's data at any time. For privacy inquiries, email [email protected].

Changes

We will update this page if our practices change, and revise the date at the top.