Privacy Policy

CarSnapper is operated by Yorkshire Web Solutions Limited (“we”, “us”), a company registered in England and Wales, company number 14893029, of 25 Norwood Drive, Sheffield, S5 7BH, United Kingdom.

We are the data controller for the personal data described below, and are registered with the Information Commissioner’s Office under reference ZC211046.

If you have any question about this policy or want to exercise your rights, contact icookedsupport@yorkshire-web-solutions.co.uk.

This policy explains what CarSnapper collects, why, who else sees it, and what you can do about it.

Sections 1 to 11 are about the CarSnapper app. Section 12 is about this website, carsnapper.app.

1. What we collect

1.1 Your photographs

When you photograph a car, or import a photograph from your library, the image is uploaded to our servers so it can be identified, and then stored as part of your collection.

Photographs are held in private storage. They are not public, not indexed, and not shared with other users.

1.2 Location (only if you allow it)

Location is optional and CarSnapper works fully without it.

• Photographs you take in the app: if you grant location permission, we record the device’s position at the moment of capture, so the sighting can appear on your private map.
• Photographs you import from your library: we use only the location already embedded in that photograph’s own EXIF metadata, if it has any. We never substitute your current position for an imported photo, because an old photograph taken elsewhere would otherwise be placed wherever you happen to be standing today.

Your map is private to you.

1.3 An anonymous account identifier

On first launch the app creates an anonymous account, a random identifier with no email, password, phone number or name attached. It exists so your collection belongs to you rather than to the device’s storage generally.

1.4 A display name, if you set one

Optional, free text, and not shown to anyone else. CarSnapper has no social features, no public profiles and no way for other users to see you.

1.5 Progress and gameplay data

Your collected vehicles, experience points, level, challenge progress, badges and unlocked cosmetic items.

1.6 Recognition records

When a photograph is identified we keep a record of the request and the response, so that a mistaken identification can be investigated and corrected later.

1.7 Subscription status

If you subscribe, we store whether your subscription is active, which plan, which store, and when it expires. We never see or store your payment details. Those are handled entirely by Apple or Google.

1.8 Technical limits

We count requests per account to prevent abuse and runaway costs. These counters are not shown to you and are not used to profile you.

2. What we deliberately do NOT collect

This section is a commitment, not a description of the current version.

• No vehicle registration marks / number plates. We do not read, extract, transcribe or store them. Our database schema contains no field capable of holding one, and that absence is enforced by an automated test.
• No owner or keeper information. We do not look up who owns a vehicle and have no access to any such database.
• No faces or biometric data. No facial recognition is performed at any point.
• No advertising identifiers, no ad networks, no third-party analytics or tracking SDKs.
• No contacts, calendar, microphone, health or fitness data.
• No email address, password or phone number.

A photograph you take may incidentally contain a number plate or a passer-by, as any photograph might. We do not process or extract that information, but please be considerate about what you photograph, and see section 8.

3. Why we process it, and our lawful basis

What	Why	Lawful basis (UK GDPR)
Photographs	To identify the vehicle and build your collection	Performance of a contract (Art. 6(1)(b))
Location	To place a sighting on your private map	Consent (Art. 6(1)(a)), you may refuse or withdraw it
Anonymous identifier	To keep your collection yours	Performance of a contract
Progress data	To provide levels, challenges and rewards	Performance of a contract
Recognition records	To investigate and correct wrong identifications	Legitimate interests (Art. 6(1)(f)), accuracy of the service
Subscription status	To provide the subscription you paid for	Performance of a contract
Rate-limit counters	To prevent abuse and protect service costs	Legitimate interests

You can withdraw location consent at any time in your device settings. Doing so does not affect anything already collected, and does not stop the app working.

4. Who else processes your data

We use a small number of processors. We do not sell your data, and we do not share it for advertising.

Supabase Inc.: hosting, database, file storage and server functions. Your photographs, collection and account identifier are stored here. Region: EU (Ireland). Your data stays in the EU.

Google (Gemini API): vehicle identification. Your photograph is sent to Google for analysis. Google processes it to return a description of the vehicle. We also send the resulting vehicle name as text so that specifications and rarity can be researched. Google does not receive your account identifier, your location, or any other information about you. Google’s API terms state that data submitted through the paid API is not used to train their models.

RevenueCat, Inc.: subscription management. Receives your anonymous account identifier and your subscription status. Receives no photographs and no location.

Apple and Google Play: payment processing, if you subscribe. They are independent controllers for the payment itself; we receive only the resulting subscription status.

Some of these providers are based outside the UK. Where personal data is transferred internationally, that transfer is covered by the providers’ Standard Contractual Clauses or equivalent safeguards.

5. How long we keep it

• Photographs and sightings: until you delete them, or until you delete your account.
• When you delete a sighting: the photograph and the exact coordinates are permanently deleted. A minimal record that a sighting existed is retained so your history and rewards remain consistent.
• When you delete your account: everything associated with it is permanently deleted, including all photographs.
• Inactive anonymous accounts: an account that has never recorded a sighting, has no subscription and has been inactive for more than 30 days may be removed automatically.

6. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to our processing of your personal data, and the right to data portability.

The quickest route is in the app: Settings → Delete my data. This is immediate and permanent.

For anything else, contact icookedsupport@yorkshire-web-solutions.co.uk. We will respond within one month.

Please note an important limitation. Because CarSnapper accounts are anonymous and tied to your device, we have no way to verify that a request relates to a particular account unless it is made from inside the app on that device. This protects you (it means nobody else can request your data either), but it does mean an emailed request may be impossible for us to action, and you should use the in-app option wherever possible.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. Our registration reference is ZC211046.

7. Security

Photographs and collections are stored in private storage, accessible only to your own account, enforced at the database level rather than by application code alone. All traffic between the app and our servers is encrypted in transit using TLS.

No system is perfectly secure, but we do not store payment details, passwords, or contact details, which materially limits what could be exposed.

8. Photographing vehicles responsibly

CarSnapper is for photographing vehicles in public. Please:

• respect people’s privacy and property, and do not photograph inside private land without permission;
• avoid deliberately photographing people;
• follow local law, which varies by country.

You are responsible for the photographs you take.

9. Children

CarSnapper is not directed at children under 13 and we do not knowingly collect data from them. If you believe a child has provided us with personal data, contact icookedsupport@yorkshire-web-solutions.co.uk and we will delete it.

10. Changes to this policy

If we change how we handle your data we will update this page and change the date at the top. Material changes will also be notified in the app.

11. Contact

Yorkshire Web Solutions Limited
25 Norwood Drive, Sheffield, S5 7BH, United Kingdom
icookedsupport@yorkshire-web-solutions.co.uk

12. This website (carsnapper.app)

The website is separate from the app. Sections 1 to 11 do not describe the website, and nothing the website records is connected to your CarSnapper collection.

12.1 Visits and store taps

When a page on this website is viewed, and when you tap a button to go to the App Store or Google Play, we record:

• the page, and which button you tapped;
• where the visit came from: the website or search engine that sent you, and any campaign tags in the link (such as utm_source);
• whether the link came from a Facebook or Google advert (yes or no only, never the advert’s click identifier);
• a random identifier for your visit, which lasts until you close the tab;
• your country, worked out by our host from your connection;
• the type of device, operating system and browser, and whether you are using an in-app browser such as Facebook’s.

We do not store your IP address, your browser’s full identification string or any advertising identifier. We do not try to identify you and we do not combine these records with anything else.

Why: to understand which pages and adverts bring people to the app, so we can improve the website and spend less on adverts that do not work. Lawful basis: legitimate interests (Art. 6(1)(f)). Storing the small amount of information this needs in your browser is permitted without consent under the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025, because it is used only for statistics to improve our service, and you can object at any time using the button on this page.

How long: 25 months, then deleted automatically.

When you tap a store button, our server sends you on to the App Store or Google Play. That link may include the name of the campaign that brought you, so Apple and Google can tell us, as a total, how many installs a campaign produced. It does not include your visit identifier.

12.2 Meta Pixel and Conversions API

We only use Meta’s tools if you choose Allow. If you arrive from a Facebook or Instagram advert, the website asks whether we can tell Meta about your visit. If you choose No thanks, or you are never asked, no Meta code is loaded.

If you allow it, Meta’s pixel loads in your browser. It records that you viewed a page and whether you tapped a store button, and Meta may set cookies (_fbp, _fbc) that connect your visit to the advert you saw. When you tap a store button, our server may also send that same event directly to Meta, with your IP address and browser details, so it is still counted if the page closes before your browser sends it. We pass those details on without keeping them.

This helps us see which adverts work and helps Meta show them to people likely to be interested. Meta Platforms Ireland Limited receives this data. For collecting and sending it we are joint controllers with Meta; what Meta then does with it is governed by Meta’s privacy policy. Lawful basis: consent (Art. 6(1)(a)). You can withdraw it at any time with Cookie settings at the bottom of any page, and we then remove Meta’s cookies from your browser.

12.3 Who processes website data

Cloudflare, Inc. hosts this website and stores the visit records described in 12.1, as our processor. Cloudflare sees your IP address in order to deliver the website to you, as any host must. Where data is processed outside the UK, the transfer is covered by Standard Contractual Clauses or equivalent safeguards.

12.4 What the website stores in your browser

Name	Type	Purpose	How long
cs_attr	Session storage	Where your visit came from, so a tap on a later page is credited correctly	Until you close the tab
cs_sid	Session storage	A random identifier for this visit	Until you close the tab
cs_optout	Local storage	Remembers that you asked not to be counted	Until you opt back in or clear it
cs_meta	Cookie	Remembers your answer about Meta	6 months
_fbp, _fbc	Cookies set by Meta	Only if you choose Allow: connect your visit to the advert you saw	Up to 90 days