REVKIT Privacy Policy

1. Introduction

REVKIT, LTD ("REVKIT," "we," "us," or "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your information.

This Policy applies to both the REVKIT website (revkit.com) and the REVKIT iOS app. Where a section applies only to one platform, it is labeled accordingly.

2. Scope

This Policy covers:

• The REVKIT website at revkit.com
• The REVKIT iOS app available on the Apple App Store
• Any future REVKIT mobile apps or services that link to this Policy

Both the website and the iOS app share the same backend and the same user accounts. Information collected from one platform is associated with your single REVKIT account.

3. Information We Collect

We collect the following categories of information:

3.1 Account Information

• Email address
• Display name
• Username / handle
• Password (stored hashed, never in plaintext)
• Profile photo (avatar) if you upload one

3.2 Vehicle and Build Content

• Vehicle data you create: name, year, make, model, trim, mileage, description, social media links, for-sale status, asking price
• Parts you add to your build: name, category, brand, description, price, photos
• Notes and wishlist items you create
• Photos you upload of your vehicle and parts. Photos may include EXIF metadata (camera details, date/time, and potentially GPS location). We do not strip EXIF metadata from uploaded photos before storing them.

3.3 Voice Data (iOS App Only)

During onboarding, the iOS app offers an optional voice intake feature that lets you describe your vehicle by speaking. When you use this feature:

• Your spoken audio is captured by your device's microphone
• Apple's on-device Speech Recognition framework converts the audio to text
• The transcribed text is sent to Anthropic for parsing into structured vehicle and parts data
• Audio recordings are not retained. Only the transcribed text is sent to our servers, and no audio is stored.

3.4 Subscription and Purchase Data (iOS App)

Subscription purchases on the iOS app are processed by Apple through the StoreKit framework. We receive from Apple:

• Subscription status (active, trialing, expired, canceled)
• Product identifier (monthly or yearly plan)
• Transaction identifier
• Renewal and expiration dates

We do NOT receive or store your credit card number, billing address, or other payment method details. All payment information is handled directly by Apple.

3.5 Device and Technical Information

• Device model and operating system version
• App version
• Device vendor identifier (a non-trackable identifier provided by iOS)
• IP address (logged at the network/server level for security)
• We do NOT use the iOS Advertising Identifier (IDFA)
• We do NOT engage in cross-app or cross-site tracking

3.6 Community and Social Activity

• Builds you make public on the Community feed
• Users and vehicles you follow
• Reports you submit through the in-app reporting tool
• Users you have blocked (used only to filter content; the blocked user is not notified)

4. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Provide the features of the website and iOS app
• Process subscriptions and manage trial eligibility
• Display your public builds in the Community feed
• Enable follow, report, and block features
• Respond to support requests sent to [email protected]
• Detect and prevent abuse, fraud, and security threats
• Comply with legal obligations
• Send transactional emails (account confirmation, password reset, receipts) — these cannot be opted out of while the account is active
• Send marketing emails and newsletters. You may opt out at any time using the unsubscribe link in our emails, updating your communication preferences in your account settings, or contacting us at [email protected]

5. How We Share Your Information

We do NOT sell your personal information to third parties. We do NOT share your information with advertisers.

We share information only with the following service providers, and only as needed to operate REVKIT:

5.1 Supabase

Our backend infrastructure provider. Supabase hosts our database, handles user authentication, and stores uploaded files (photos). All account data, vehicle data, parts, photos, notes, and wishlist items live in our Supabase project.

5.2 Apple Inc.

Subscription purchases on the iOS app are processed by Apple via StoreKit. Apple handles payment processing, billing, and refunds. Apple's privacy policy applies to the payment data they collect: https://www.apple.com/legal/privacy/

5.3 Anthropic

Voice transcripts captured during the iOS app's onboarding voice intake are sent to Anthropic for parsing into structured vehicle and parts data. Anthropic's privacy policy: https://www.anthropic.com/privacy

5.4 Cloudflare

Our website and API are hosted on Cloudflare Pages. Cloudflare may log request metadata (IP address, user agent) for security and rate-limiting.

5.5 Resend

Resend is our transactional email provider, used to send account confirmation, password reset, and receipt emails.

5.6 MailerLite

MailerLite is our marketing email provider, used to send newsletters and promotional communications.

We may also disclose information when required by law, in response to a valid legal request, or to protect the rights, property, or safety of REVKIT, our users, or the public.

6. iOS App Permissions and Justifications

The REVKIT iOS app requests the following permissions. iOS requires you to grant each one explicitly the first time the app uses it; you can change your choices at any time in Settings > REVKIT.

6.1 Microphone

Used only during onboarding to capture your voice when you choose the voice intake option. The microphone is not active at any other time.

6.2 Speech Recognition

Used in conjunction with the microphone to convert your spoken description of your vehicle into text. Speech recognition runs on-device using Apple's Speech framework and does not stream raw audio to Apple.

6.3 Photo Library

Required when you choose to add photos to your vehicle gallery, parts, or profile avatar. We only access the photos you specifically select; we do not scan your library.

7. Cookies and Tracking (Website Only)

The REVKIT iOS app does NOT use cookies, web beacons, or any cross-app tracking technology.

The REVKIT website uses cookies to:

• Keep you signed in across sessions
• Remember your display preferences
• Measure website usage through Google Analytics (anonymized, aggregate data)

You can control cookies through your browser settings. Disabling cookies may affect website functionality (you may be signed out).

8. Data Retention

We retain your information as follows:

• Account data (profile, vehicles, parts, photos, notes, wishlist): retained for as long as your account is active.
• Subscription records: retained for as long as your account is active, then archived for 7 years for tax and accounting purposes.
• Server logs (IP, request metadata): 30 days.
• Voice recordings: not retained. Audio is processed on-device and only the resulting text transcript is sent to our servers.
• Backup snapshots: rolling 30-day window, then deleted.

When you delete your account (see Section 9), we delete the data described above according to the timelines stated.

9. Account Deletion

You can delete your REVKIT account at any time. Deleting your account permanently removes:

• Your profile (name, handle, avatar, email)
• All your vehicles and their associated data
• All parts you have added
• All photos you have uploaded
• All notes and wishlist items
• Your follow relationships (followers and following)
• Your subscription record (if you have an active iOS subscription, you must also cancel it via Apple ID Settings to stop further charges)
• Any reports you have submitted (anonymized and retained for moderation records)

There are two ways to delete your account:

9.1 In the iOS App

1. Open the REVKIT iOS app.
2. Open Settings.
3. Scroll to the bottom and tap "Delete Account."
4. Type "DELETE" to confirm.
5. Tap the Delete button. Your account and all associated data are permanently removed within 24 hours.

9.2 On the Website

To delete your account from the website, contact [email protected] with the email address associated with your account and request deletion. We will process your request within 48 hours.

Deletion is immediate and cannot be undone. Subscription cancellation, where applicable, must also be handled through Apple ID Settings for iOS subscribers.

10. Your Privacy Rights

Depending on where you live, you may have the following rights regarding your personal information:

• Right to access — request a copy of the data we hold about you
• Right to delete — request deletion of your data (see Section 9)
• Right to correct — request correction of inaccurate data
• Right to portability / export — receive a machine-readable copy of your data
• Right to object or restrict processing
• Right to withdraw consent (where processing is based on consent)
• Right to lodge a complaint with a supervisory authority (EU/UK users)
• Right to opt out of "sale" of personal information (we do not sell data, so this does not change anything for you)

These rights are afforded under the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and similar laws.

To exercise any of these rights, email [email protected] or our Data Protection Officer at [email protected]. Please include:

• Your account email
• The right you wish to exercise
• Any specific data or timeframe involved

We will respond within 30 days (45 days for CCPA requests, with possible extension as permitted by law).

11. Children's Privacy

REVKIT is not intended for children under 13 years old. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.

If you are between 13 and 18, you may use REVKIT only with the permission of a parent or legal guardian.

12. Data Security

We implement reasonable technical and organizational measures to protect your information, including:

• HTTPS/TLS encryption for all data in transit
• Encryption at rest for stored data (provided by Supabase)
• Hashed password storage
• Token-based authentication with automatic refresh
• Token storage in iOS Keychain on the iOS app
• Row-level security policies on database tables
• Restricted access to production systems

No system is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify you within 72 hours of confirmed discovery, in compliance with applicable laws.

13. International Data Transfers

REVKIT is operated from the United States. Our primary servers are located in the United States. If you access REVKIT from outside the United States, your information will be transferred to and processed in the United States.

For users in the European Economic Area, the United Kingdom, or Switzerland, we rely on applicable safeguards as required by law for international transfers.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this Policy
• Notify you by email if the change is significant
• Post a notice in the iOS app and on the website

Your continued use of REVKIT after the effective date of an updated Policy constitutes acceptance of the updated terms.

15. Contact Information

For privacy-related questions, requests, or concerns, contact: