Last updated: August 16, 2026
CarCare ("the App") is a vehicle maintenance tracker. Its core runs entirely on your device and, when iCloud is enabled, syncs your data across your own devices through your personal iCloud account. The App is built with a privacy-first approach: by default it uses no developer-operated servers.
The App also offers one optional feature — AI Document Extraction — that, only when you turn it on and use it, sends the document you choose to our processing backend and to AI service providers so their details can be turned into a service record. This is the only feature that transmits your content off your device and off Apple's infrastructure. It is described in detail below, and it is off unless you enable it.
The data controller responsible for the processing described in this policy is:
Ivan Koshelev, an individual developer established in Germany.
Müllerring 12, 04158 Leipzig, Germany
Contact: bassets-sundial6h@icloud.com
The App is sold on the App Store through the developer's business (a Ukrainian sole proprietorship), which may appear as the seller on the store listing; the data controller responsible for the processing described in this policy is the individual named above.
As a controller established in the European Union, we are subject to the EU General Data Protection Regulation (GDPR). You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your residence or workplace.
The AI Document Extraction feature described below is not offered on the United Kingdom App Store; for those users the App runs on the device and does not use this feature. Support by email remains available.
All information you enter — including vehicle details, maintenance records, fuel logs, odometer readings, and any documents or photos you attach — is stored on your device using Apple's SwiftData framework and, when iCloud is enabled, synced privately to your other devices through Apple CloudKit's private database. This data resides in your personal iCloud account, is governed by Apple's Privacy Policy, and we do not access it. Apart from the optional AI Document Extraction feature below, the App has no developer-operated servers, no analytics, no tracking, and no advertising, and it works fully offline.
When you enable AI Document Extraction and submit a document (for example a service invoice or receipt), the App sends that document to our backend, which uses third-party AI services to read it and extract structured maintenance details. Before each scanning session, the App shows what the feature does and asks you to confirm you want to proceed; unless you confirm, no document is sent and nothing leaves your device through this feature.
Apart from whatever appears in the document itself, we never receive your email, name, or Apple ID as account information. From CloudKit we read only your pseudonymous iCloud record identifier — an opaque value that does not reveal your identity to us — and we store and use it only in pseudonymised (hashed) form.
| Recipient | What it receives | Location | Retention |
|---|---|---|---|
| Mistral AI (model provider) | The raw document (for optical character recognition) and the recognised text (for extraction). Your submissions are not used to train models. | European Union | Up to 30 days for abuse monitoring, then deleted. |
| Langfuse (a ClickHouse, Inc. service — reliability & diagnostics) | Diagnostic metadata only — the model used, usage counts, timing, and the pseudonymised user identifier. It does not receive your document, the recognised text, or the model's answers. | European Union region | 30 days, then deleted. |
| Apple (DeviceCheck & CloudKit) | Authentication tokens only. No document content. | Apple infrastructure | Transient (verification only). |
| Deno Deploy (Deno Land Inc. — hosting) | Runs our backend that processes your document during the request. It does not store the document or its content. | European Union region | Not stored. |
Mistral AI, Langfuse, and Deno Deploy act as our processors under written data-processing agreements. Apple provides DeviceCheck and CloudKit under Apple's own developer terms; it verifies authentication tokens and never receives document content. We keep the training setting for Mistral disabled.
Our backend does not store your document or any extracted content. It keeps only:
We process the submitted document to perform the service you requested — the extraction feature you actively invoke for each document (GDPR Art. 6(1)(b)). Providing a document is necessary only to use this feature; if you do not submit one, the feature simply does not run and the rest of the App is unaffected.
Where a document incidentally contains data about other people (for example a mechanic's name), and for abuse prevention and service integrity, we rely on our legitimate interests (Art. 6(1)(f)) in providing a secure, working feature. Where a document contains information about other people, this policy also serves to inform them; contacting each of them individually would involve disproportionate effort (Art. 14(5)(b)).
You are asked to confirm before each scanning session, and you can simply choose not to proceed; nothing is sent unless you do. This confirmation is a control and transparency step — it is not the legal basis for the processing.
The feature uses AI only to read your document and propose a draft service record. It does not make any decision that produces legal effects concerning you or similarly significantly affects you. You always review, edit, and confirm the extracted details before anything is saved.
We and our processors process your personal data within the European Economic Area (EEA): our backend runs on Deno Deploy in an EU region, the AI provider Mistral AI processes in the EU, and Langfuse processes in its EU region. Some of these processors are affiliated with, or use support functions located in, companies outside the EEA (for example in the United States). Where personal data is accessed from outside the EEA in that context, the transfer is governed by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework, as set out in our data-processing agreements with those providers. You can request further information about these safeguards, or a copy of the relevant clauses, via the contact address below. Apple processes authentication tokens under its own terms and safeguards.
Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to our processing of your personal data, and the right to data portability, as well as the right to lodge a complaint with your supervisory authority. To exercise any right, contact us at the address above.
Right to object: where we rely on legitimate interests (Art. 6(1)(f)), you may object at any time on grounds relating to your particular situation, and we will stop the processing unless we have compelling legitimate grounds that override your interests.
Practical notes for the AI Document Extraction feature:
The App requests access to your device's location only when you explicitly tap the "Use My Location" button in the service facility picker. Your location is used solely to centre the map and help you find nearby facilities. It is never stored persistently, never sent to our servers, and never shared with any third party; the map and nearby-facility search are provided by Apple Maps, which processes your map region under Apple's privacy policy. If you deny location permission, the map opens at a default position and all other features remain fully functional.
You can delete any or all of your on-device data at any time within the App; deleting data in the App also removes it from your synced iCloud data. Uninstalling the App removes the data stored on that device. You can manage or remove iCloud-stored app data through your device's iCloud settings. For content processed by the AI Document Extraction feature, see "Your Rights" above.
Documents are transmitted over encrypted connections (HTTPS/TLS). We do not store document content on our servers, we identify usage only through pseudonymised identifiers, and we keep the AI provider's training setting disabled.
The App is not directed to children and does not knowingly collect personal data from them. The core App stores data only on your device; the optional AI Document Extraction feature is intended for adults managing their own vehicles.
If we update this Privacy Policy, the revised version will be posted on this page with an updated date. This version reflects the introduction of the optional AI Document Extraction feature and supersedes any earlier statement that the App used no servers or third-party processing services.
If you have questions about this Privacy Policy, or wish to exercise your rights, please contact us at:
bassets-sundial6h@icloud.com
If you contact support, we receive the email and any details you choose to include. We use this only to handle your enquiry (Art. 6(1)(f) legitimate interest, or Art. 6(1)(c) where we are responding to a data-subject request) and keep the correspondence only as long as needed for the enquiry and any follow-up.