Zovano — Privacy Policy

Effective date: 30 October 2026 Version: 1.11

Archived version. This edition of the Privacy Policy was in force from 30 October 2026 to 2 November 2026. Current version.

1. Data controller

Anton Trafimuk, conducting business activity under the name Anton Trafimuk (sole proprietorship registered in CEIDG, Poland)
NIP: 5213959663 · REGON: 521472000
Address: al. Polski Walczącej 26, 00-712 Warsaw, Poland
Email: privacy@carm8.app

You may also send data requests to support@carm8.app, legal@carm8.app or hello@carm8.app — they reach the same mailbox and we handle them in the same way.

This policy explains how we process personal data in the Zovano mobile application ("App") and on the carm8.app website, in accordance with the EU General Data Protection Regulation ("GDPR").

The Polish version of this policy is binding; the English, Russian and Ukrainian versions are translations.

2. What data we collect and why

Data	Purpose	Legal basis
Account data: account identifier and, depending on the method, data received from Google or Apple (e.g. name, email address, provider identifier; for Apple, a Hide My Email address if used), or an email address and password hash for email sign-in. Profile details, if you add them: name, phone number and profile photo. Guest mode uses a pseudonymous guest account identifier and a secret for restoring the session on the device.	Account creation, sign-in, guest mode and data syncing.	Performance of a contract (Art. 6(1)(b) GDPR).
Vehicle data (make, model, registration number, VIN, mileage)	Maintaining your digital service book	Contract performance (Art. 6(1)(b))
Service-history records (dates, costs, mileage, place, notes)	Keeping your vehicle's service history	Contract performance (Art. 6(1)(b))
Reminder dates and details (e.g. type and mileage). Notifications are scheduled locally on your device; we do not register a push notification token.	Storing reminders and scheduling local insurance, inspection and service notifications.	Performance of a contract (Art. 6(1)(b) GDPR).
Your reviews, ratings, suggested edits and suggested new car services	Operating the community features of the App	Contract performance (Art. 6(1)(b))
Device location (only while using the App, if you grant permission)	Showing nearby car services on the map and narrowing address search results	Consent (Art. 6(1)(a))
Device location in the background — only if you turn on Smart Actions and allow precise location “Always”. Location is processed on your device; only map squares of about 1.5 km — the one you are in and the neighbouring ones — for which the App downloads the place catalogue reach our server (details below).	Noticing likely visits to fuel stations and car services, and suggesting that you add the expense	Consent (Art. 6(1)(a) GDPR); you can withdraw it at any time by turning the feature or the location permission off
Car services you save to favourites, whether you pin them, and any private note you add to them	Keeping your list of favourite car services	Contract performance (Art. 6(1)(b))
Address text you type when suggesting a new car service and — if you have shared your location — coordinates used to narrow the results. Our server forwards them to Photon (see section 3) and does not save them to your account.	Suggesting matching addresses	Contract performance (Art. 6(1)(b)); coordinates — consent (Art. 6(1)(a)), see the “Device location” row
Email address for transactional messages (email verification and password recovery) — through Resend	Delivering messages necessary to run the service	Contract performance (Art. 6(1)(b))
Crash and error data: device model, OS and App version, stack traces and the most recent technical events before the error (e.g. App diagnostic messages with email addresses and tokens masked, network request addresses without their parameters and without request or response bodies, App state changes), as well as App launches and whether a session ended in a crash (Sentry). The data is linked to a random App installation identifier stored on the device. When you report a problem in the App, we attach the diagnostic log from recent days stored on the device.	Fixing bugs and keeping the App stable	Legitimate interest (Art. 6(1)(f))
Basic technical data (IP address, request logs), including the IP address and installation identifier when the App checks for updates (EAS Update)	Security, abuse prevention, service operation, and recognising automated test traffic (see section 9)	Legitimate interest (Art. 6(1)(f))
Sign-in protection data: the email address entered by anyone when a password check fails (including where that person is not the holder of the address or no account exists for it), the number of failed attempts and the times at which lockouts end. Device token: each time you successfully sign in to an account with a verified email address, we issue a signed token containing a random device identifier and the account identifier; it is stored only on that device, and our server records the device identifier only if there have been failed sign-in attempts from that device.	Protecting accounts against password guessing and against the owner being locked out by others	Legitimate interest (Art. 6(1)(f))
App usage events (including guest account creation or linking, adding a car, reminder, expense or service entry, active days, the platform you were active from, the channel you tell us you found the App through, and use of Smart Actions), linked to a pseudonymous account identifier — without VIN, registration number, email address or note contents. See section 9 for details and your right to object.	Measuring feature usage and improving the App (product analytics)	Legitimate interest (Art. 6(1)(f)); you may object at any time, e.g. with the “Analytics” switch — see section 9
Pre-account onboarding measurements, linked to a temporary identifier in App memory and not to an account, name or email address. The onboarding analytics event itself does not contain an IP address. Independently, standard infrastructure technical logs may contain an IP address as described in the technical data row above.	Seeing where new users get stuck during onboarding	Legitimate interest (Art. 6(1)(f)) — see section 9
Expenses (amount, currency, category, title, date, place, notes), insurance details and attachments (e.g. photos, invoices, receipts and PDF documents)	Maintaining car costs, insurance and documentation.	Performance of a contract (Art. 6(1)(b) GDPR).
Illegal-content notices and correspondence: identified content, explanation, good-faith statement and supplied contact details.	Assessing notices, contacting reporters and protecting rights.	Legal obligation (Art. 6(1)(c) GDPR) where required by law; otherwise legitimate interests (Art. 6(1)(f) GDPR).

We do not sell your data, use it for advertising, or track you across other apps or websites.

Location data is used in real time to query nearby services and narrow address search results, and is not stored as a movement history. The exception is Smart Actions, if you turn it on: the App then keeps on your device, for a limited time, which public fuel stations and car services you have probably stopped at — without routes or GPS points (see “Smart Actions” below).

Data on your device. The App stores sign-in tokens on your device (in the system’s secure storage), a cache of some of your data and a diagnostic log covering the last 3 days. The Sentry and Expo SDKs store random installation identifiers used in error reports, session information and update checks. Uninstalling the App removes this data, except that on iPhone and iPad, entries in the system’s secure storage (sign-in tokens and the device token) may remain after the App is uninstalled; they are deleted when you delete your account in the App on that device or when you reset the device to factory settings. The device token (see above) stays on the device after you sign out, so that we recognise your device the next time you sign in. It is deleted when you delete your account in the App on that device; if the account is deleted in another way, the token stays on the device but is no longer linked to any account. If you turn on Smart Actions, the App also stores the data described below on your device.

Vehicle and service-history data is entered by you and is for your use only — we do not share it with other users.

Smart Actions (background location)

Smart Actions is an optional feature and is off by default. When you turn it on, the App notices on your phone that you have probably stopped at a fuel station or car service by car and driven away, and suggests adding the expense with the place and date filled in — in the App and, if you allow notifications, with a notification on your device. We make at most one fuel suggestion and one service suggestion a day. You always decide whether to save the expense. The notification names the place; depending on your phone’s settings, it can be visible on the lock screen without unlocking the phone — you can hide notification previews in the system settings. The feature is available to anyone who may use the App (aged 16 or over, see section 7), including with a guest account.

Permissions. The feature needs precise location access “Always” (on Android: “Allow all the time”), including when the App is closed or not in use. Without background access or precise location, the feature is paused and the App does not notice visits, even while it is open. Notifications are optional.
What happens on your phone. The App registers zones (geofences) with the operating system around nearby fuel stations and car services from a public catalogue. When the phone enters or leaves such a zone, the system wakes the App, which may read your precise location for a short time to check whether the car stopped on the premises and drove away. Recognising the visit, matching the stop to a place and deciding on a suggestion happen only on the device. Location points stay in the device’s memory only until they are processed; we do not store routes, GPS points or the position of the stop.
What reaches our server. To know where nearby stations and services are, the App downloads the public place catalogue (from OpenStreetMap data) from our server for map squares of about 1.5 km — the one you are in and the neighbouring ones. These requests carry no sign-in token and no account identifier; like every request, they reach us with an IP address and a time (see “Basic technical data” above). Coordinates, routes, stops and visits are not sent. A visited place reaches our server only if you save an expense with that place yourself.
What is stored on your phone. While you use the feature, the App stores on your device: suggestions with the names and identifiers of nearby catalogue places (an open one for up to 24 hours after you left, and for about 48 hours after it is closed, so the same visit does not come back); the places for which you chose “Don’t suggest for this place”, and your “I wasn’t there” answers; the detection state — open visits (place identifiers and times, without coordinates) until they are decided, at most 10 hours, and the times of visits to each place over the last 14 days, so that no service suggestion is made where you park every day; a copy of the place catalogue for the downloaded squares, for up to 48 hours; the registered zones — circles around catalogue places and one zone around your area that is used to refresh the zones. The centre of that zone is the grid cell of about 500 m that you are in. This data is included in your phone’s backups (for example iCloud, a computer or Android backup) and is kept there according to that backup’s settings. We do not send this data to our server. When you turn the feature off, the App deletes the suggestions, hidden places and detection data, and keeps only your choice to keep the feature off until you sign out. When you sign out, it deletes the rest.
Turning it off. You can turn the feature off at any time in Profile → Smart Actions, or withdraw the location or notification permission in the system settings. When the feature is turned off, the App deletes the suggestions, hidden places and detection data described above and cancels scheduled notifications; it keeps only your choice to keep the feature off until you sign out.
Analytics. Section 9 describes the usage events of this feature.

3. Third-party services

Apple / Sign in with Apple (Apple Distribution International Ltd., Ireland) — user authentication. At first sign-in, Apple may let you share your name and email address; you may use Hide My Email. Apple Privacy Policy
Google Sign-In (Google Ireland Ltd., Ireland) — authentication. Google Privacy Policy
Google Maps (Google Ireland Ltd., Ireland) — map display in the App. When the map loads, Google receives, among other things, the device’s IP address and the map area being displayed. Google Maps/Google Earth Additional Terms
Photon (komoot GmbH, Germany) — address search based on OpenStreetMap data. Our server forwards the queries: komoot receives the address text you type and — if you have shared your location — coordinates used to narrow the results, but not your IP address or account data. komoot Privacy Policy
Resend (Resend, Inc., USA) — email delivery for email verification and password recovery. Resend Privacy Policy
Sentry (Functional Software, Inc., USA; data stored in the EU region — Germany) — crash and error reporting; reports include an installation identifier stored on the device by the Sentry SDK. Sentry Privacy Policy
Expo (650 Industries, Inc., USA) — delivery of App updates (EAS Update); each time the App checks for an update, Expo receives the IP address and an installation identifier. App versions earlier than 1.3.0 also send error reports to Expo (Expo Observe) until they are updated. Expo Privacy Policy
Railway (Railway Corp., USA; servers in the Netherlands) — server and database hosting.
Cloudflare (Cloudflare, Inc., USA) — network security and traffic routing, and storage of the documents you upload to the App and of backups (the R2 service; data held in the European Union).

Transfers outside the EEA. We keep the database, uploaded documents, backups and Sentry error reports in the European Economic Area. Some recipients, however, are based in the United States and may process or access data outside the EEA. Transfers rely on:

Expo — standard contractual clauses adopted by the European Commission (Module 2: controller to processor);
Resend and Sentry — the European Commission adequacy decision under the EU-US Data Privacy Framework, in which these providers participate, supplemented by standard contractual clauses;
Railway and Cloudflare — standard contractual clauses or the EU-US Data Privacy Framework, as set out in these providers’ data processing agreements;
Google and Apple — the mechanisms described in their privacy policies.

You can obtain a copy of the standard contractual clauses by writing to privacy@carm8.app.

Data about people associated with business listings

Business listings may contain information from publicly accessible sources such as OpenStreetMap, Google and other lawfully available public sources, as well as information submitted by users.

For sole traders or other businesses operated by natural persons, some business information — such as a personal name in the business name, professional contact details or a business address — may be personal data.

We process this data to operate and update the automotive service directory and enable business searches. The basis is our legitimate interest (Art. 6(1)(f) GDPR) in maintaining a useful directory of publicly available automotive services.

Categories may include business name, proprietor or representative name, business address, professional phone number and email address, website, opening hours and other public business information.

Sources may include public websites and databases, map and place-information providers and user submissions.

We keep the data for as long as needed to maintain an up-to-date listing. Data subjects may request access, correction, deletion or restriction and object to processing as described in the rights section.

4. How long we keep data

Account, vehicle, and service-history data and favourite car services: until you delete them or delete your account.
Expenses, insurance details and attachments: at the latest until you delete your account.
Smart Actions data stored on your device: for the periods given in section 2, at the latest until you turn the feature off (your choice to keep it off: until you sign out), sign out or uninstall the App. We do not store it on our server.
Reviews and edits: until deleted by you or removed during moderation; we may keep anonymized statistics.
Crash and technical log data: up to 90 days in our systems; at the error-reporting and update providers (Sentry, Expo) — in line with those providers’ retention periods, as described in their policies.
Sign-in protection data (including the device identifier recorded on our server): deleted after a successful sign-in or password recovery; otherwise no later than 25 hours after the last failed attempt or the end of the last lockout, whichever is later. The device token is kept on the device until you delete your account in the App on that device (see section 2) and expires one year after it is issued.
Account-linked analytics: up to 12 months. Pre-account onboarding measurements: up to 90 days. The data is then deleted.
Email delivery logs: short-term, in line with Resend's settings.
Notices and correspondence: for as long as needed to handle the matter, fulfil legal obligations and establish, exercise or defend legal claims, within applicable legal limits.

Backups. We back up the database and the documents you upload solely to restore the service after a failure. The legal basis is our legitimate interest in being able to restore the availability of data promptly after an incident (Art. 6(1)(f) in conjunction with Art. 32(1)(c) GDPR). Backups are stored encrypted in the European Union (Cloudflare R2) and are deleted automatically: rolling database backups after 30 days, weekly copies after 180 days, and copies of documents about 30 days after the original is deleted. Until then, deleted data — including after account deletion or an objection to analytics — may remain in backups. If we restore data from a backup, we will re-apply the deletions and objections received after the backup was made that we have recorded. For this we keep, in the European Union and for 210 days — longer than the oldest backup — a record of each objection to analytics, each withdrawal of one and each account deletion request: the account identifier, the type of request and its time, nothing else.

5. Your rights

Under the GDPR you have the right to access, rectify and delete your data, to restrict processing, to data portability, to object, and to withdraw consent at any time (e.g. by disabling location or notification permissions, or Smart Actions). We respond without undue delay and within one month at the latest.

You can download a copy of your account, vehicle, service-history, reminder, expense, insurance, saved-place and analytics data yourself in the App: Profile → Privacy & security → Download my data (a JSON file). The right to data portability covers data you have provided to us that we process on the basis of a contract or consent: you will receive it in a structured, commonly used and machine-readable format and, where technically feasible, you may ask us to transmit it to another controller. We provide other data, such as uploaded documents, on request to privacy@carm8.app.

Right to object (Art. 21 GDPR). On grounds relating to your particular situation, you may at any time object to the processing of your data based on our legitimate interest (Art. 6(1)(f) GDPR), e.g. technical data, crash data, sign-in protection data or data in business listings. We will then stop processing that data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. We will consider an objection to the processing of sign-in protection data, but protecting accounts against password guessing is, as a rule, a compelling legitimate ground that overrides your interests, rights and freedoms; in any case, this data is deleted automatically within the periods set out in section 4. An objection to product analytics needs no reasons and will always be honoured: the easiest way is the “Analytics” switch on the Privacy & security screen, or you can write to privacy@carm8.app — see section 9.

You can delete your account directly in the App settings; this removes your personal data within 30 days, except where law requires longer retention; for backups, see section 4.

You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (PUODO, uodo.gov.pl). If you live in another country, you may also be able to complain to the data protection authority there; in Ukraine that is the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).

Providing your data is voluntary but necessary to hold an account — without an email address and password, or a Google or Apple sign-in, we cannot create an account or sync data across devices. You can also use the App in guest mode without giving contact details. We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you. Withdrawing consent does not affect the lawfulness of processing carried out on its basis before the withdrawal.

6. Security

Data is transmitted over HTTPS/TLS. Access to account data in the App is protected by authentication and authorisation controls. After 5 failed attempts in a row, email and password sign-in is temporarily locked for 15 minutes; after the next 5, for 1 hour; and after every further 5, for 24 hours. If there have been no failed attempts or lockouts for 24 hours, the count starts again. Password recovery removes the lockout; the lockout does not affect signing in with Google or Apple. You may request a copy of your data or delete your account as described above.

We apply appropriate technical and organisational measures to protect data. However, no information system can guarantee the complete elimination of risk.

7. Children

The App is intended for users aged 16 and over. We do not knowingly collect data from children below this age.

8. Website and cookies

The carm8.app website does not use tracking or analytics cookies. We only store your language choice in your browser's local storage (localStorage), which is necessary for the site to work properly.

The reporting form prepares text in your browser. It does not send it automatically or save its fields in the website’s local storage. We receive the data only when you email the prepared notice; your email provider processes the message under its own terms.

9. App analytics

We collect usage events to understand and improve the App. Product analytics is first-party: events go to our own database hosted by Railway. We do not use an external product analytics provider; error reporting (Sentry) is described in sections 2 and 3.

For accounts, including guest accounts, we record:

account creation and sign-in method (Google, Apple or email and password);
guest account creation, linking and linking failures due to an existing account (method only, without the other account’s details);
adding a car (make and, for a car from the catalogue, model — without year, registration number or VIN);
setting a reminder (type, e.g. insurance or inspection);
adding a service entry or expense (for expenses: category, whether you added it from a Smart Actions suggestion, and how you chose its place: from favourites, by search, typed in, suggested, or no place);
Smart Actions: starting, completing or skipping the feature’s setup (on which screen, and whether visit detection and notifications ended up fully on), a suggestion being made, opened (from a notification or the list), dismissed or expired, a place being excluded, and the feature being turned off. These events carry only the kind of place (fuel station or car service) — never the place itself, your location, a route or an amount. The App sends them only while it is open, and we record their time to the full hour; the hour at which you open a suggestion from a notification may therefore indicate when you were probably at a fuel station or car service;
active usage days, and the platform you were active from (iOS or Android);
where you say you found the App, if you choose to answer — one of a fixed set of options, never free text.

So that our statistics count people rather than automated tests, our server compares the IP address of each request — in memory, without storing it — with the address ranges Google publishes for its Firebase Test Lab devices, on which Google Play automatically tests new versions of the App. Requests from those ranges are handled normally, but no analytics events, onboarding measurements or active days are recorded for them.

Events are pseudonymous: linked to an account identifier without VIN, registration number, email address or note contents. We do not use interaction autocapture or session recording. We do not sell analytics data or use it for advertising or cross-app or cross-site tracking.

Legal basis. We process product analytics under our legitimate interest (Art. 6(1)(f) GDPR) in understanding App usage, identifying usability problems and making development and improvement decisions based on actual product use. The set of events and properties is limited.

Your right to object. You may object to product analytics at any time, without giving a reason. The easiest way is in the App: Profile → Privacy & security → turn off the “Analytics” switch; this also works in guest mode. From then on we do not record analytics events for your account, and we delete the events and active days recorded earlier without undue delay. You can also write to privacy@carm8.app from the email address linked to your account. If you use guest mode or have not given us an email address, include your account identifier — the id field in the user section of the file downloaded with “Download my data” on the same screen. Once we have matched such an objection to your account, we will act in the same way. You do not need to close your account to object. Backups are described in section 4.

Pre-account onboarding measurements. We measure the start of onboarding, the start and progress of adding a car (including opening the make picker) and the first service (added or skipped), the reminder offer (shown, set or skipped), the registration prompt being shown, the start of registration, and time to the first entry. Depending on the step, an event may include the model source (catalogue or custom entry), the reminder type (oil, inspection, tyres or OC) together with whether we proposed its date from the first service, sign-in method or duration. We do not record make, model or year. We do not record the type of the first service. But if we proposed the reminder from it, the reminder type (oil, inspection or tyres) matches the kind of that service. We include platform and App version. Event times are recorded to the full hour.

These measurements are not linked to an account, name or email address. They use a temporary identifier held only in App memory, never saved on the device and lost when the App process ends. The onboarding analytics event itself does not contain an IP address. Independently, standard infrastructure technical logs may contain an IP address as described in the technical data section above.

The basis is our legitimate interest (Art. 6(1)(f) GDPR) in identifying where new users encounter difficulties. These measurements are not linked to an account or to any other data that would allow us to tell whom they concern. We are therefore unable to identify your measurements and — in line with Art. 11 GDPR — cannot locate or delete them on the basis of an objection. They are deleted automatically after 90 days (section 4).

10. Changes to this policy

We may update this policy, for example when adding features or changing providers. We will inform you of material changes — in particular new purposes of processing, new recipients of data or transfers to new countries — at least 14 days before they take effect, by email or, if we do not have your email address, by a notice in the App. Previous versions of the policy are available in the archive linked in the header.

11. Contact

Anton Trafimuk · al. Polski Walczącej 26, 00-712 Warsaw, Poland · privacy@carm8.app