Terms of Service Privacy

Zovano — Privacy Policy

Effective date: 2 November 2026 Version: 1.12

Archived version. This edition of the Privacy Policy was in force from 2 November 2026 to 2 November 2026. Current version.

1. Data controller

Anton Trafimuk, conducting business activity under the name Anton Trafimuk (sole proprietorship registered in CEIDG, Poland)
NIP: 5213959663 · REGON: 521472000
Address: al. Polski Walczącej 26, 00-712 Warsaw, Poland
Email: privacy@carm8.app

You may also send data requests to support@carm8.app, legal@carm8.app or hello@carm8.app — they reach the same mailbox and we handle them in the same way.

This policy explains how we process personal data in the Zovano mobile application ("App") and on the carm8.app website, in accordance with the EU General Data Protection Regulation ("GDPR").

The Polish version of this policy is binding; the English, Russian and Ukrainian versions are translations.

2. What data we collect and why

Data Purpose Legal basis
Account data: account identifier and, depending on the method, data received from Google or Apple (e.g. name, email address, provider identifier; for Apple, a Hide My Email address if used), or an email address and password hash for email sign-in. Profile details, if you add them: name, phone number and profile photo. Guest mode uses a pseudonymous guest account identifier and a secret for restoring the session on the device. Account creation, sign-in, guest mode and data syncing. Performance of a contract (Art. 6(1)(b) GDPR).
Vehicle data (make, model, registration number, VIN, mileage) Maintaining your digital service book Contract performance (Art. 6(1)(b))
Service-history records (dates, costs, mileage, place, notes) Keeping your vehicle's service history Contract performance (Art. 6(1)(b))
Reminder dates and details (e.g. type and mileage). Notifications are scheduled locally on your device; we do not register a push notification token. Storing reminders and scheduling local insurance, inspection and service notifications. Performance of a contract (Art. 6(1)(b) GDPR).
Your reviews, ratings, suggested edits and suggested new car services Operating the community features of the App Contract performance (Art. 6(1)(b))
Device location (only while using the App, if you grant permission) Showing nearby car services on the map and narrowing address search results Consent (Art. 6(1)(a))
Device location in the background — only if you turn on Smart Actions and allow precise location “Always”. Location is processed on your device; only map squares of about 1.5 km — the one you are in and the neighbouring ones — for which the App downloads the place catalogue reach our server (details below). Noticing likely visits to fuel stations and car services, and suggesting that you add the expense Consent (Art. 6(1)(a) GDPR); you can withdraw it at any time by turning the feature or the location permission off
Car services you save to favourites, whether you pin them, and any private note you add to them Keeping your list of favourite car services Contract performance (Art. 6(1)(b))
Address text you type when suggesting a new car service and — if you have shared your location — coordinates used to narrow the results. Our server forwards them to Photon (see section 3) and does not save them to your account. Suggesting matching addresses Contract performance (Art. 6(1)(b)); coordinates — consent (Art. 6(1)(a)), see the “Device location” row
Email address for transactional messages (email verification and password recovery) — through Resend Delivering messages necessary to run the service Contract performance (Art. 6(1)(b))
Crash and error data: device model, OS and App version, stack traces and the most recent technical events before the error (e.g. App diagnostic messages with email addresses and tokens masked, network request addresses without their parameters and without request or response bodies, App state changes), as well as App launches and whether a session ended in a crash (Sentry). The data is linked to a random App installation identifier stored on the device. When you report a problem in the App, we attach the diagnostic log from recent days stored on the device. Fixing bugs and keeping the App stable Legitimate interest (Art. 6(1)(f))
Basic technical data (IP address, request logs), including the IP address and installation identifier when the App checks for updates (EAS Update) Security, abuse prevention, service operation, and recognising automated test traffic (see section 9) Legitimate interest (Art. 6(1)(f))
Sign-in protection data: the email address entered by anyone when a password check fails (including where that person is not the holder of the address or no account exists for it), the number of failed attempts and the times at which lockouts end. Device token: each time you successfully sign in to an account with a verified email address, we issue a signed token containing a random device identifier and the account identifier; it is stored only on that device, and our server records the device identifier only if there have been failed sign-in attempts from that device. Protecting accounts against password guessing and against the owner being locked out by others Legitimate interest (Art. 6(1)(f))
App usage events (including guest account creation or linking, adding a car, reminder, expense or service entry, active days, the platform you were active from, the channel you tell us you found the App through, and use of Smart Actions), linked to a pseudonymous account identifier — without VIN, registration number, email address or note contents. See section 9 for details and your right to object. Measuring feature usage and improving the App (product analytics) Legitimate interest (Art. 6(1)(f)); you may object at any time, e.g. with the “Analytics” switch — see section 9
Pre-account onboarding measurements, linked to a temporary identifier in App memory and not to an account, name or email address. The onboarding analytics event itself does not contain an IP address. Independently, standard infrastructure technical logs may contain an IP address as described in the technical data row above. Seeing where new users get stuck during onboarding Legitimate interest (Art. 6(1)(f)) — see section 9
Expenses (amount, currency, category, title, date, place, notes), insurance details and attachments (e.g. photos, invoices, receipts and PDF documents) Maintaining car costs, insurance and documentation. Performance of a contract (Art. 6(1)(b) GDPR).
Purchase data, if you open the purchase screen or the “Support Zovano” screen, press “Restore purchases”, or buy the Pro subscription or a support tip in the App: a random billing identifier of your account (we create it with the account; RevenueCat receives it only at one of those steps), the product bought, the store (App Store or Google Play), whether the Pro subscription is active, when it expires and whether it renews automatically, and a record of purchase events (type, product, price in US dollars, time). Through RevenueCat we also receive the App Store receipt or Google Play purchase token and the data listed in section 3. The payment itself is handled by Apple or Google; we do not receive your card or other payment details. If the same App Store or Google Play account is used to buy for more than one Zovano account, we mark those accounts and may give one of them a new billing identifier, so that Pro stays with the account that bought it. In guest mode purchases are not available and the App does not connect to RevenueCat. Showing the products on sale and their prices, selling the Pro subscription and accepting support tips, unlocking Pro on your devices and restoring purchases, handling complaints about purchases, keeping each account’s purchases separate, and keeping revenue and refund statistics Performance of a contract or steps taken at your request before entering into one (Art. 6(1)(b) GDPR); for the purchase event record and the detection of a store account used for several accounts, also our legitimate interests in handling complaints, preventing misuse of Pro and keeping revenue and refund statistics (Art. 6(1)(f) GDPR).
Illegal-content notices and correspondence: identified content, explanation, good-faith statement and supplied contact details. Assessing notices, contacting reporters and protecting rights. Legal obligation (Art. 6(1)(c) GDPR) where required by law; otherwise legitimate interests (Art. 6(1)(f) GDPR).

We do not sell your data, use it for advertising, or track you across other apps or websites.

Location data is used in real time to query nearby services and narrow address search results, and is not stored as a movement history. The exception is Smart Actions, if you turn it on: the App then keeps on your device, for a limited time, which public fuel stations and car services you have probably stopped at — without routes or GPS points (see “Smart Actions” below).

Data on your device. The App stores sign-in tokens on your device (in the system’s secure storage), a cache of some of your data and a diagnostic log covering the last 3 days. The Sentry and Expo SDKs store random installation identifiers used in error reports, session information and update checks. Uninstalling the App removes this data, except that on iPhone and iPad, entries in the system’s secure storage (sign-in tokens and the device token) may remain after the App is uninstalled; they are deleted when you delete your account in the App on that device or when you reset the device to factory settings. The device token (see above) stays on the device after you sign out, so that we recognise your device the next time you sign in. It is deleted when you delete your account in the App on that device; if the account is deleted in another way, the token stays on the device but is no longer linked to any account. If you turn on Smart Actions, the App also stores the data described below on your device. Once you open the purchase screen or the “Support Zovano” screen or press “Restore purchases”, or once the store reports a purchase for your account, the RevenueCat SDK also stores on your device your billing identifier and a cache of your purchase status and of the products on sale; this data is included in your phone’s backups. When you sign out or delete your account, the App signs out of RevenueCat on that device, which removes your billing identifier and purchase status from it and replaces them with a new random identifier that is not linked to you or to any account. If the App has not yet connected to our server when you sign out (for example, offline right after it starts), this data may stay on the device until an account that uses purchases next signs in on it, or until you uninstall the App.

Vehicle and service-history data is entered by you and is for your use only — we do not share it with other users.

Smart Actions (background location)

Smart Actions is an optional feature and is off by default. When you turn it on, the App notices on your phone that you have probably stopped at a fuel station or car service by car and driven away, and suggests adding the expense with the place and date filled in — in the App and, if you allow notifications, with a notification on your device. We make at most one fuel suggestion and one service suggestion a day. You always decide whether to save the expense. The notification names the place; depending on your phone’s settings, it can be visible on the lock screen without unlocking the phone — you can hide notification previews in the system settings. The feature is available to anyone who may use the App (aged 16 or over, see section 7), including with a guest account.

3. Third-party services

Transfers outside the EEA. We keep the database, uploaded documents, backups and Sentry error reports in the European Economic Area. Some recipients, however, are based in the United States and may process or access data outside the EEA. Transfers rely on:

You can obtain a copy of the standard contractual clauses by writing to privacy@carm8.app.

Data about people associated with business listings

Business listings may contain information from publicly accessible sources such as OpenStreetMap, Google and other lawfully available public sources, as well as information submitted by users.

For sole traders or other businesses operated by natural persons, some business information — such as a personal name in the business name, professional contact details or a business address — may be personal data.

We process this data to operate and update the automotive service directory and enable business searches. The basis is our legitimate interest (Art. 6(1)(f) GDPR) in maintaining a useful directory of publicly available automotive services.

Categories may include business name, proprietor or representative name, business address, professional phone number and email address, website, opening hours and other public business information.

Sources may include public websites and databases, map and place-information providers and user submissions.

We keep the data for as long as needed to maintain an up-to-date listing. Data subjects may request access, correction, deletion or restriction and object to processing as described in the rights section.

4. How long we keep data

Backups. We back up the database and the documents you upload solely to restore the service after a failure. The legal basis is our legitimate interest in being able to restore the availability of data promptly after an incident (Art. 6(1)(f) in conjunction with Art. 32(1)(c) GDPR). Backups are stored encrypted in the European Union (Cloudflare R2) and are deleted automatically: rolling database backups after 30 days, weekly copies after 180 days, and copies of documents about 30 days after the original is deleted. Until then, deleted data — including after account deletion or an objection to analytics — may remain in backups. If we restore data from a backup, we will re-apply the deletions and objections received after the backup was made that we have recorded. For this we keep, in the European Union and for 210 days — longer than the oldest backup — a record of each objection to analytics, each withdrawal of one and each account deletion request: the account identifier, the type of request and its time, nothing else.

5. Your rights

Under the GDPR you have the right to access, rectify and delete your data, to restrict processing, to data portability, to object, and to withdraw consent at any time (e.g. by disabling location or notification permissions, or Smart Actions). We respond without undue delay and within one month at the latest.

You can download a copy of your account, vehicle, service-history, reminder, expense, insurance, saved-place, purchase and analytics data yourself in the App: Profile → Privacy & security → Download my data (a JSON file). The right to data portability covers data you have provided to us that we process on the basis of a contract or consent: you will receive it in a structured, commonly used and machine-readable format and, where technically feasible, you may ask us to transmit it to another controller. We provide other data, such as uploaded documents, on request to privacy@carm8.app.

Right to object (Art. 21 GDPR). On grounds relating to your particular situation, you may at any time object to the processing of your data based on our legitimate interest (Art. 6(1)(f) GDPR), e.g. technical data, crash data, sign-in protection data or data in business listings. We will then stop processing that data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. We will consider an objection to the processing of sign-in protection data, but protecting accounts against password guessing is, as a rule, a compelling legitimate ground that overrides your interests, rights and freedoms; in any case, this data is deleted automatically within the periods set out in section 4. An objection to product analytics needs no reasons and will always be honoured: the easiest way is the “Analytics” switch on the Privacy & security screen, or you can write to privacy@carm8.app — see section 9.

You can delete your account directly in the App settings; this removes your personal data within 30 days, except where law requires longer retention; for backups, see section 4.

You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (PUODO, uodo.gov.pl). If you live in another country, you may also be able to complain to the data protection authority there; in Ukraine that is the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).

Providing your data is voluntary but necessary to hold an account — without an email address and password, or a Google or Apple sign-in, we cannot create an account or sync data across devices. You can also use the App in guest mode without giving contact details. Purchase data is necessary to buy Pro or a tip; without it we cannot sell or unlock Pro. We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you. Withdrawing consent does not affect the lawfulness of processing carried out on its basis before the withdrawal.

6. Security

Data is transmitted over HTTPS/TLS. Access to account data in the App is protected by authentication and authorisation controls. After 5 failed attempts in a row, email and password sign-in is temporarily locked for 15 minutes; after the next 5, for 1 hour; and after every further 5, for 24 hours. If there have been no failed attempts or lockouts for 24 hours, the count starts again. Password recovery removes the lockout; the lockout does not affect signing in with Google or Apple. You may request a copy of your data or delete your account as described above.

We apply appropriate technical and organisational measures to protect data. However, no information system can guarantee the complete elimination of risk.

7. Children

The App is intended for users aged 16 and over. We do not knowingly collect data from children below this age.

8. Website and cookies

The carm8.app website does not use tracking or analytics cookies. We only store your language choice in your browser's local storage (localStorage), which is necessary for the site to work properly.

The reporting form prepares text in your browser. It does not send it automatically or save its fields in the website’s local storage. We receive the data only when you email the prepared notice; your email provider processes the message under its own terms.

9. App analytics

We collect usage events to understand and improve the App. Product analytics is first-party: events go to our own database hosted by Railway. We do not use an external product analytics provider; error reporting (Sentry) is described in sections 2 and 3.

For accounts, including guest accounts, we record:

Purchases are not recorded as analytics events. To see how often the purchase screen is shown, we count its views per day, by the place in the App it was opened from and by platform, without an account identifier; views by accounts that have objected to analytics are not counted.

So that our statistics count people rather than automated tests, our server compares the IP address of each request — in memory, without storing it — with the address ranges Google publishes for its Firebase Test Lab devices, on which Google Play automatically tests new versions of the App. Requests from those ranges are handled normally, but no analytics events, onboarding measurements or active days are recorded for them.

Events are pseudonymous: linked to an account identifier without VIN, registration number, email address or note contents. We do not use interaction autocapture or session recording. We do not sell analytics data or use it for advertising or cross-app or cross-site tracking.

Legal basis. We process product analytics under our legitimate interest (Art. 6(1)(f) GDPR) in understanding App usage, identifying usability problems and making development and improvement decisions based on actual product use. The set of events and properties is limited.

Your right to object. You may object to product analytics at any time, without giving a reason. The easiest way is in the App: Profile → Privacy & security → turn off the “Analytics” switch; this also works in guest mode. From then on we do not record analytics events for your account, and we delete the events and active days recorded earlier without undue delay. You can also write to privacy@carm8.app from the email address linked to your account. If you use guest mode or have not given us an email address, include your account identifier — the id field in the user section of the file downloaded with “Download my data” on the same screen. Once we have matched such an objection to your account, we will act in the same way. You do not need to close your account to object. Backups are described in section 4.

Pre-account onboarding measurements. We measure the start of onboarding, the start and progress of adding a car (including opening the make picker) and the first service (added or skipped), the reminder offer (shown, set or skipped), the registration prompt being shown, the start of registration, and time to the first entry. Depending on the step, an event may include the model source (catalogue or custom entry), the reminder type (oil, inspection, tyres or OC) together with whether we proposed its date from the first service, sign-in method or duration. We do not record make, model or year. We do not record the type of the first service. But if we proposed the reminder from it, the reminder type (oil, inspection or tyres) matches the kind of that service. We include platform and App version. Event times are recorded to the full hour.

These measurements are not linked to an account, name or email address. They use a temporary identifier held only in App memory, never saved on the device and lost when the App process ends. The onboarding analytics event itself does not contain an IP address. Independently, standard infrastructure technical logs may contain an IP address as described in the technical data section above.

The basis is our legitimate interest (Art. 6(1)(f) GDPR) in identifying where new users encounter difficulties. These measurements are not linked to an account or to any other data that would allow us to tell whom they concern. We are therefore unable to identify your measurements and — in line with Art. 11 GDPR — cannot locate or delete them on the basis of an objection. They are deleted automatically after 90 days (section 4).

10. Changes to this policy

We may update this policy, for example when adding features or changing providers. We will inform you of material changes — in particular new purposes of processing, new recipients of data or transfers to new countries — at least 14 days before they take effect, by email or, if we do not have your email address, by a notice in the App. Previous versions of the policy are available in the archive linked in the header.

11. Contact

Anton Trafimuk · al. Polski Walczącej 26, 00-712 Warsaw, Poland · privacy@carm8.app