PitDex Get the app

Legal

Privacy Policy

Last updated 12 August 2026  ·  Version 1.0

This policy explains what PitDex does with your information — what the app collects, why, who else sees it, and how you get it back or delete it. It covers the PitDex iOS app and this website.

The short version. PitDex needs your camera to identify cars and, if you allow it, your location to pin spots on your own map. Until you create an account, everything stays on your phone. There are no ads, no analytics trackers, and nothing is sold to anyone.

1. Who we are

PitDex is a personal project, built and run by one developer trading as GoCloud, based in London, United Kingdom ("PitDex", "we", "us"). There is no company behind it and no office — just one person and an inbox.

For the purposes of UK GDPR, we are the data controller for the personal data described in this policy. Any question about it, write to info@pitdexapp.com.

2. What we collect

Information you give us

  • Account details — your email address, display name and, if you set one, a profile photo. If you sign in with Apple and choose to hide your email, we only ever receive Apple's relay address.
  • Your spots — the photographs you capture in the app, together with the identification result, timestamp and any notes or favourites you add.
  • Messages to us — anything you send to support, including the contents of the message and your contact details.

Information collected automatically

  • Device and app data — device model, operating system version, app version, language and region.
  • Location — only if you grant permission. See section 4.

There is no analytics SDK in PitDex. We don't track which screens you open or how often you use the app. If you have turned on Apple's "Share with App Developers" setting on your iPhone, Apple may pass us aggregated crash reports through App Store Connect — that is Apple's mechanism, it is anonymised, and you control it in iOS Settings.

We do not collect your contacts, your camera roll as a whole, your health data, your financial details, or your browsing activity on other apps and sites.

3. Photos and identification

Identification is the core of the app, so it is worth being precise about what happens to a photograph you take.

Number plates are blurred first

PitDex can blur number plates on your device before the photo is written to storage or sent anywhere, so no legible registration ever leaves your phone. You control this in Profile → Settings, and it applies to new catches. It is the one piece of other people's personal data the app handles, so it is worth turning on.

What gets sent, and to whom

  • The photo is sent over an encrypted connection to our own backend functions. One identifies the car using Google Gemini 3.5; the other generates the studio artwork that becomes your collectible card.
  • The provider does not store your photos and does not use them to train its models. The image is processed to produce an answer and then discarded.
  • API keys stay on our server. The app itself never holds a key to any AI service.
  • We only access the camera while the scanner is open. PitDex does not read your photo library unless you explicitly pick an image from it.

Where your photos live

  • Without an account, nothing leaves your phone. Your photos and your whole garage are stored only on the device.
  • With an account, your collection is backed up to private storage in our Supabase project, scoped to your user ID, so it survives a lost or replaced phone. That backup is the reason signing in exists.
  • Deleting a card deletes its photo. Deleting your account deletes all of it.

Please be considerate about what you photograph. Frame the car, not the people around it.

4. Location

Location is optional. The app asks for permission the first time you open the map or save a spot, and PitDex works without it — you simply won't get a map of where you found things.

  • We request while-in-use access only. PitDex does not track your location in the background.
  • A spot's coordinates are stored with the spot so it can be pinned on your map. They are private to your account and are not shown to other users.
  • You can withdraw location access at any time in iOS Settings, and remove stored coordinates by deleting the spot.

5. How we use your information

  • To identify the cars you photograph and build your cards.
  • To create and maintain your account, garage, XP, rank and badges.
  • To back your collection up, if you have an account, so it survives a new phone.
  • To send you service messages and, if you enable them, push notifications.
  • To keep the service secure, prevent abuse, and detect fraudulent or automated spotting.
  • To comply with our legal obligations.

We do not sell personal data, and we do not use your data for advertising or profiling.

7. Who we share it with

We share data only with the providers below, who process it on our instructions and only for these purposes. There is no advertising network, data broker or analytics company in that list.

  • Supabase — hosting, database, authentication and image storage for accounts and backed-up garages.
  • Google — the Gemini 3.5 model receives the photograph you capture, returns a result, and retains nothing.
  • Apple — push notifications, and all payments for subscriptions and packs. We never see your card details.

We may also disclose data where required by law, to enforce our Terms of Service, or to protect someone's safety.

8. How long we keep it

  • Without an account — nothing is kept by us at all. Your collection lives on your phone, and deleting the app removes it.
  • With an account — for as long as you keep the account. There is no separate retention period we apply on top of that; you decide how long we hold it.
  • Deleting your account — do it yourself, any time, in Profile → Settings → Delete account. Your garage, photos, spots and account record go with it immediately. No request, no waiting on us.
  • Backups — encrypted database backups roll over on their normal cycle, so residual copies disappear with the rotation rather than being kept deliberately.
  • Purchase records — Apple holds these, not us. We keep only what we must for tax and accounting.

9. Your rights

Depending on where you live, you have some or all of the following rights: to access the data we hold about you, to correct it, to delete it, to restrict or object to processing, to receive a portable copy, and to withdraw consent.

The fastest route for deletion is the app itself: Profile → Settings → Delete account removes everything immediately, without asking us. For anything else, write to info@pitdexapp.com and we will respond within 30 days.

If you are in the UK, you may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EEA, you may complain to your national supervisory authority.

If you are a California resident, you have the right to know what personal information we collect, to request its deletion or correction, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA.

10. Security

Data is encrypted in transit with TLS and at rest by our hosting provider. PitDex is run by one person, so access to production systems means exactly one account, protected by multi-factor authentication. Keys for the AI services are held server-side and never shipped in the app.

No system is perfectly secure, but we will notify you and the ICO without undue delay if a breach affects your personal data.

11. Children

PitDex is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us their data, contact us and we will delete it.

12. International transfers

Your account data and any backed-up photos are stored in Europe. The UK recognises the EEA as providing an adequate level of protection, so no additional safeguard is needed for that leg.

Google may process the photos it identifies outside the UK and EEA, including in the United States. For those transfers we rely on the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, together with Google's commitment not to retain the images or train on them.

13. Changes to this policy

We'll update this page when the app changes. If a change materially affects how we use your data, we'll tell you in the app or by email before it takes effect. The date at the top always reflects the current version.

14. Contact us

Privacy questions, requests and complaints: info@pitdexapp.com
Everything else: the contact page.

GoCloud — London, United Kingdom