KarHub Privacy Policy

Last updated: 13 August 2026

This policy explains what KarHub collects, why, who it is shared with, and what control you have over it. It describes the app as actually built — every third party named below receives data because a specific feature requires it.

KarHub is operated by Challa Hadley ("we", "us"). Contact: 1challahadley@gmail.com

1. Information we collect

1.1 Information you give us

Data	Why	Where it is stored
Email address and password	To create and secure your account	Supabase (passwords are hashed; we never see them)
Vehicle details — VIN, year, make, model, trim, engine	To identify your vehicle and give vehicle-specific answers	Supabase
Odometer readings	Maintenance reminders and due-date calculations	Supabase
Maintenance records — service type, date, mileage, cost, notes	Your service history	Supabase
Registration renewal dates	Reminders	Supabase
Fluid and fuel specifications	Reference and reminders	Supabase
Messages you send Otto (our AI mechanic)	To answer your questions and keep conversation context	Supabase
Photos you send Otto	To answer questions about what is in the photo	Supabase Storage, private to your account

1.2 Information collected automatically

Subscription status. When you subscribe, Apple tells our servers that a subscription exists, when it renews, and when it ends. We receive a transaction identifier, not your payment details.
Usage counts. We record how many AI messages you send and their token/cost totals, to enforce fair-use limits and monitor our own costs.
Technical logs. Our hosting provider records standard server logs (timestamps, request paths, error messages) for security and debugging.

1.3 Location

KarHub asks for your location only to show nearby repair shops.

Your location is not sent to our servers, and it is not stored. The nearby-shop search runs on your device using Apple Maps. If you decline location access, every other feature continues to work.

1.4 What we do not collect

We do not collect your payment card details, contacts, browsing history, or advertising identifiers. We do not use third-party advertising or analytics SDKs. We do not track you across other apps or websites.

2. How we use your information

To provide the app's features
To answer your questions through Otto, using your vehicle records as context
To send maintenance and registration reminders (local notifications on your device)
To verify your subscription and enforce fair-use limits
To diagnose faults and prevent abuse
To comply with legal obligations

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

3. Who we share it with

We use a small number of processors. Each receives only what its function requires.

3.1 Supabase — hosting, database, authentication, file storage

All of your account data, vehicle records and photos are stored on Supabase infrastructure. <https://supabase.com/privacy>

3.2 Google (Gemini API) — Otto

This is the most significant disclosure in this policy, so it is stated plainly.

When you send a message to Otto, we send Google's Gemini API:

your question,
your vehicle details, including your VIN,
your current mileage, maintenance history, registration due date and saved fluid specs,
any photo you attach, and
recent messages in that conversation, for context.

This is what allows it to answer "when was my last oil change" instead of "I don't have access to your records". We use Google's paid API tier, under which Google does not use this data to train its models. We do not send your email address, password, or name.

If you would rather this data not leave our servers, do not use Otto. Every other feature works without it. <https://ai.google.dev/gemini-api/terms>

3.3 NHTSA — VIN decoding and recall lookups

Your VIN is sent to the U.S. National Highway Traffic Safety Administration's public API to decode your vehicle, and your year/make/model is sent to look up recalls. NHTSA is a U.S. government agency and these APIs are public and free.

3.4 Apple — payments and subscriptions

Subscriptions are processed by Apple. Apple handles your payment method; we never see it. Apple tells us that a subscription exists and when its status changes. <https://www.apple.com/legal/privacy/>

3.5 Other disclosures

We may disclose information if required by law, to enforce our Terms, or to protect the rights or safety of users or the public. If ownership of KarHub changes, your information may transfer to the new owner, who would remain bound by this policy.

4. How long we keep it

Account data is kept while your account exists.
When you delete your account, we delete your data. Deletion is available in the app under Settings → Delete Account. It removes your vehicles, mileage logs, maintenance records, registration records, fluid specs, AI conversations and uploaded photos, and your login. This is immediate and cannot be undone.
Backups and server logs may retain copies for a short period before being overwritten in the ordinary course.
We may retain limited records where required by law, for example transaction records for tax.

5. Your rights

You can, at any time:

See your data — everything KarHub holds about you is visible in the app.
Correct it — every record is editable.
Delete it — Settings → Delete Account.
Withdraw location access — iOS Settings → KarHub → Location.
Turn off notifications — iOS Settings → KarHub → Notifications.

Depending on where you live you may have additional rights, including to request a copy of your data in a portable format, to object to or restrict processing, and to complain to a data protection authority. Contact us at 1challahadley@gmail.com and we will respond within the period required by applicable law.

California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not offer financial incentives for it. You may exercise your rights to know, delete and correct using the methods above.

EEA/UK residents: our legal basis is performance of our contract with you (providing the app), our legitimate interests (security, abuse prevention, improving the service), and your consent where asked (location, notifications). Data is stored in the United States; transfers rely on the appropriate safeguards offered by our processors.

6. Security

Passwords are hashed and never visible to us. Data is transmitted over encrypted connections. Database access is restricted by row-level security so one account cannot read another's data, and uploaded photos are stored in a private bucket scoped to your account.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by law.

7. Children

KarHub is not directed to children and is not intended for anyone under 13 (or under 16 in the EEA/UK). We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

8. Changes

If we change this policy materially we will update the date above and notify you in the app before the change takes effect. Continuing to use KarHub after that means you accept the updated policy.

9. Contact

Challa Hadley 1challahadley@gmail.com