CarCrew App Privacy Policy

1. Controller

The controller responsible for processing personal data in the CarCrew app is:

Email: tim@schneider-sessinghaus.de
Phone: +49 152 29450820
Email for privacy, support, the app and the website: info@carcrew.app
Instagram: official_carcrew.app

2. Scope

This Privacy Policy applies to the CarCrew iOS app. It describes which personal data we process, why we process it, the legal bases for processing, the recipients of data and your rights under the General Data Protection Regulation (GDPR).

3. Categories of data processed by the app

The data processed depends on the features you use, the permissions you grant and your subscription plan. It may include:

• Account data: name or display name, email address, authentication provider, internal user ID and account settings
• Vehicle data: vehicle name, make, model, model year, registration number if entered, Bluetooth name if entered, odometer readings, technical parameters and cost assumptions such as consumption, insurance, vehicle tax, financing and estimated value
• Trip data: start and stop times, route coordinates, addresses, distance, duration, speed and route analysis, trip category, cost per trip, and driver information in shared fleets
• Location data: location during trip recording and, if enabled, an optional precise or approximate last-stop location for authorised fleet members
• Expense and receipt data: expense details, amounts, categories, dates, receipt images and text recognised using on-device OCR
• Shared-fleet data: fleet memberships, roles, permissions, invitations, reservations, settlements, outstanding amounts, payment statuses and fleet events
• Subscription and CrewBonus data: subscription product and status, referral code, inviter and invited-user IDs, referral and reward status, offer identifiers and Apple transaction evidence as described in Section 12
• Communication data: information that you send to us by email or through support channels
• Technical data: device and app information, push token, app instance and attestation identifiers, diagnostic data, performance information and optional usage analytics

4. Local storage on your device

Vehicles, trips, expenses, settings and other app data may be stored locally on your device so that CarCrew can function and remain available offline. Local data is subject to the security and backup settings of your device and Apple account.

Purpose: providing the app and offline features.
Legal basis: Art. 6(1)(b) GDPR and, where applicable, Art. 6(1)(f) GDPR based on our legitimate interest in providing a reliable app.

5. Account, sign-in and user management

Depending on the selected sign-in method, CarCrew supports:

• Anonymous sign-in using a technical user ID
• Email address and password
• Sign in with Apple
• Sign in with Google

Firebase Authentication processes the identifiers and authentication information required for your chosen method. If you use Sign in with Apple or Google, the relevant provider processes the sign-in request and may provide CarCrew with an account identifier, email address, name and other profile information made available under your provider settings. CarCrew does not receive your Apple or Google password.

Purpose: authenticating you, managing your account, providing cloud synchronisation and associating shared data and subscriptions with the correct account.
Legal basis: Art. 6(1)(b) GDPR. The use of Apple or Google as a sign-in provider is your choice.

6. Cloud synchronisation, fleet sharing and settlements

If you use cloud or sharing features, data is processed in Firebase and Cloud Firestore. Depending on your plan and role, this may include:

• User profile and subscription-tier information
• Fleet memberships, roles, permissions, invitations and reservations
• Vehicle, trip, expense, cost and reminder data
• Driver assignments, monthly totals, member rates, settlement values and payment statuses
• Fleet events, notifications and records relating to members who leave a fleet

Owners and authorised members can see information according to their role and the permissions configured for the relevant fleet.

Purpose: synchronisation between devices, shared vehicle use, member management, settlements and displaying data to authorised fleet members.
Legal basis: Art. 6(1)(b) GDPR.

7. Location data and encryption

8. Bluetooth, CarPlay and automatic trip detection

CarCrew may use Bluetooth, car audio and CarPlay connection states to start or stop trips automatically or associate a trip with a vehicle. This may involve a stored Bluetooth name and the technical status of a connection. CarCrew does not access the content of your calls, messages or audio.

Purpose: automatic trip detection and vehicle assignment.
Legal basis: Art. 6(1)(b) GDPR.

9. Camera, photos and receipt scanning

If you scan a receipt, the app uses the camera and on-device text recognition to help create an expense. Receipt images and extracted information are stored as part of the relevant expense according to your local and cloud settings. If you add photos to Trip Stories or exports, those photos are selected and shared by you through the destination you choose.

Purpose: recording expenses and creating content selected by the user.
Legal basis: Art. 6(1)(b) GDPR.

10. WeatherKit and weather-based trip analysis

CarCrew may use Apple WeatherKit to request current weather conditions for locations along a recorded trip. For this request, the coordinates required to obtain local weather information are transmitted to Apple. According to Apple, WeatherKit location information is used only to provide weather forecasts, is not associated with personally identifiable information and is not tracked between requests.

CarCrew may derive and store a compact weather summary such as temperature, pressure, humidity and wind values and use it to estimate weather-related consumption effects. If cloud trip upload is enabled, these derived weather values may be synchronised with the associated trip. CarCrew does not store an additional raw location history solely for WeatherKit.

Purpose: weather-based consumption and trip analysis.
Legal basis: Art. 6(1)(b) GDPR.

11. Push notifications

If you enable push notifications, CarCrew processes a device token, device-language information and technical delivery metadata through Firebase Cloud Messaging and the Apple Push Notification service. Notifications may include fleet events, requests, reminders and CrewBonus reward availability. The content sent to the push services is limited to the information required to deliver and display the notification.

Purpose: delivering notifications requested or expected in connection with app features.
Legal basis: Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR based on our legitimate interest in reliable app operation and, where required, Art. 6(1)(a) GDPR through the iOS permission prompt.

12. Subscriptions, App Store transactions and CrewBonus

13. Usage analytics, diagnostics and configuration

14. Service providers and recipients

We use the following categories of recipients and processors where required by the features you use:

• Google and Firebase: authentication, cloud database, server-side functions, app integrity, push delivery, storage, configuration, diagnostics and optional analytics
• Google Sign-In: authentication with a Google account when selected by the user
• Apple: Sign in with Apple, App Store and StoreKit, App Store Server Notifications, Apple Push Notification service, Maps, geocoding, WeatherKit and other iOS system services
• Email providers: processing support and privacy enquiries sent by email

You can find further information in the Firebase privacy and security information, Google Privacy Policy and Apple Privacy Policy.

15. International data transfers

Depending on the service, personal data may be processed in the European Union, the European Economic Area, the United States or other countries in which a service provider operates. Where required, transfers to countries without an adequacy decision are based on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Google provides additional information about Firebase processing locations and safeguards in its privacy and data-processing documentation.

16. Retention, account deletion and referral records

We retain personal data only for as long as it is required for the relevant purpose or as long as a legal obligation or legitimate need to retain it applies. The following criteria generally apply:

• Local app data: until you delete it, delete the app and its data, or erase the device, subject to your device backups
• Account and cloud data: while you use the account or cloud feature and until deletion through the app or upon a valid request, subject to technical processing time and any records that must be retained separately
• Trip, vehicle, expense and fleet data: until deleted by you, removed as part of account or fleet deletion, or no longer required for the shared-fleet relationship
• Push tokens: while the relevant device is registered, until removed, invalidated or no longer required
• Optional analytics consent: stored on the device until changed or the app data is removed; analytics events already processed are retained according to the applicable Firebase settings and provider terms
• Support enquiries: until the enquiry has been fully resolved and thereafter where needed for follow-up or legal obligations
• Subscription and CrewBonus records: for as long as required to process subscriptions, referrals and rewards and thereafter where necessary to prevent fraud, handle complaints, demonstrate entitlement or defend legal claims, generally in line with applicable statutory limitation and retention periods

The in-app account-deletion function removes the authentication account and core user, fleet and cloud data covered by that function. Certain transaction mappings, referral, reward, audit and anti-abuse records may be retained separately after account deletion where they remain necessary for the purposes described above. These records primarily use internal identifiers rather than account profile fields and are access-restricted. They are deleted or anonymised when they are no longer required, unless a legal obligation or an ongoing dispute requires continued retention.

To request information or deletion beyond the controls available in the app, contact info@carcrew.app.

17. Your rights

Under the GDPR, you have the following rights in particular:

• Right of access under Art. 15 GDPR
• Right to rectification under Art. 16 GDPR
• Right to erasure under Art. 17 GDPR
• Right to restriction of processing under Art. 18 GDPR
• Right to data portability under Art. 20 GDPR
• Right to object under Art. 21 GDPR
• Right to withdraw consent under Art. 7(3) GDPR where processing is based on consent

Where processing is based on Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation. To exercise your rights, email info@carcrew.app.

18. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. In particular, the competent authority is:

19. Changes to this Privacy Policy

We may update this Privacy Policy where necessary, for example if app features, service providers or legal requirements change. The current version is available at https://carcrew.app/privacy-app/.