Privacy Policy

Application: Carplate (Карномер) Effective Date: March 1, 2026 Last Updated: March 1, 2026

1. General Provisions

This Privacy Policy describes how Andriy Tierzov ("we", "us", "our") collects, uses, stores, and protects the personal data of users of the Carplate mobile application (hereinafter — the App).

By using the App, you agree to the terms of this Privacy Policy. If you do not agree with these terms, please refrain from using the App.

Developer contact information: Andriy Tierzov Email: avtierzov@gmail.com

2. Data We Collect

2.1 Account Data

The App supports three methods of registration and sign-in:

Email and password: - Email address — used as a unique account identifier. - Password — stored exclusively in a secure (hashed) form; we have no access to your original password. - First and last name — optional data for profile personalization.

Sign in with Apple: - Apple ID — the unique identifier of your Apple account (sub). - Email address — provided by Apple, or a private relay address (@privaterelay.appleid.com) if you chose to hide your email. - First and last name — if you provided them during Apple authorization.

Sign in with Google: - Google ID — the unique identifier of your Google account (sub). - Email address — from your Google account. - First and last name — from your Google profile (given_name, family_name).

In all cases, we also store: - Avatar URL — generated automatically via the public Gravatar service based on a hash of your email address. - Registration date — the date your account was created.

2.2 Device Technical Data

APNs device token — a unique identifier obtained from Apple for delivering push notifications. Stored on our servers.
Device name and device identifier (UUID) — for session management and push notification delivery.
Device language — sent in request headers for response localization.

2.3 Usage Data

Search queries — license plate numbers you entered or scanned.
Favorites list — vehicles you added to your "favorites".
Update log — changes in the status of vehicles in your favorites (new registration, added to wanted list, removed from wanted list) with read/seen timestamps.

2.4 Authentication Data

JWT tokens (access and refresh) — stored on your device in UserDefaults. The access token is valid for 10 minutes; the refresh token is valid for 30 days. Used solely to verify your identity when communicating with our servers.

2.5 Device Permissions

The App may request the following permissions:

Camera — for real-time license plate scanning. Images are processed exclusively on your device and are never transmitted to the server.
Photo Library (read) — for selecting a photo from your gallery for license plate recognition. Photos are processed exclusively on your device and are never transmitted to the server.
Push Notifications — for sending notifications about status changes of favorited vehicles.

2.6 What We Do NOT Collect

Geolocation data.
Photos and images — all processing happens locally on the device.
Cookies or cross-session tracking identifiers.
Data from other apps or browsers.
Analytics or telemetry data.

3. How We Use Your Data

We use collected data exclusively for the following purposes:

| Purpose | Data | Legal Basis | |---------|------|-------------| | Service provision — authentication and access to App features | Email, password / OAuth identifier, JWT tokens | Performance of contract | | Personalization — displaying favorites list and notifications | Favorites, status changes | Performance of contract | | Push notifications — alerting you to status changes of favorited vehicles | APNs token, device data | Performance of contract / Consent | | Account management — support | Email | Performance of contract | | Security — detecting unauthorized access | Token metadata, timestamps | Legitimate interest |

4. Sharing Data with Third Parties

We do not sell, rent, or share your personal data with third parties for commercial purposes.

Your data may be transferred only in the following cases:

Apple Inc. — the APNs token is transmitted to Apple Push Notification Service for notification delivery. When signing in with Apple ID, your credentials are verified through Apple's servers. Governed by Apple's Privacy Policy.
Google LLC — when signing in with Google, your token is verified through Google's servers (accounts.google.com). Governed by Google's Privacy Policy.
Gravatar (Automattic Inc.) — a hash of your email address is used to generate an avatar via the public Gravatar service. If you are not registered on Gravatar, a default image will be displayed.
When required by law — if required by applicable Ukrainian law or by a court order.

All other infrastructure (databases, servers) is deployed on the developer's own servers without involvement of third-party cloud providers.

5. Vehicle Data

Information about vehicles that you view through the App comes exclusively from Ukrainian government open registries (data.gov.ua — the open data portal of the Ministry of Internal Affairs of Ukraine). This information is publicly available and does not constitute personal data within the meaning of Ukrainian personal data protection laws with respect to vehicle owners.

6. Data Retention

Account data is stored on our servers until your account is deleted by you or by us.
APNs tokens are automatically removed upon deactivation or when the App is uninstalled.
Search logs — search queries may be stored in server logs for a technically necessary period (no longer than 90 days) for debugging purposes.
JWT access tokens are valid for 10 minutes. Refresh tokens are valid for 30 days, stored on your device and on the server, and can be revoked by you at any time (via the "Sign Out" or "Sign Out on All Devices" feature).

Data is processed and stored on the developer's own servers.

7. Your Rights

Under the Law of Ukraine "On Personal Data Protection" and (where applicable) the General Data Protection Regulation (GDPR), you have the right to:

Right of access — obtain confirmation of whether we process your data and receive a copy of it.
Right to rectification — request correction of inaccurate or incomplete data.
Right to erasure ("right to be forgotten") — request deletion of your personal data.
Right to restriction of processing — request temporary suspension of the processing of your data.
Right to object — object to the processing of your data on the basis of legitimate interest.
Right to data portability — receive your data in a machine-readable format.
Right to withdraw consent — withdraw previously given consent (e.g., for push notifications) at any time.

To exercise any of these rights, send a request to: avtierzov@gmail.com

We will respond to your request within 30 calendar days.

8. Data Security

We implement the following technical and organizational measures to protect your data:

All connections between the App and the server are encrypted using HTTPS/TLS (Let's Encrypt certificate). SECURE_SSL_REDIRECT is enabled on the server.
Passwords are stored exclusively as a cryptographic hash (PBKDF2).
OAuth tokens are verified through the official provider APIs (Apple JWKS, Google tokeninfo); only the identifier and email are stored on our servers.
JWT access tokens have a short validity period (10 minutes); refresh tokens are stored in the database and can be revoked.
No third-party analytics or advertising SDKs are included in the App.
Image processing happens exclusively on your device — photos never leave your device.

Despite these measures, no system can guarantee absolute security. In the event of a data breach that may affect your rights, we will notify you as soon as possible.

9. Children's Privacy

The App is not intended for persons under the age of 18. We do not knowingly collect data from minors. If you become aware that a child has provided us with personal data without appropriate authorization, please contact us at avtierzov@gmail.com — we will delete such data as soon as possible.

10. Push Notifications

Push notifications are delivered via Apple Push Notification Service (APNs) and are used exclusively to inform you about:

New registration records for vehicles in your favorites list.
Changes in wanted status for vehicles in your favorites list.
Important system announcements from the developer.

You may disable push notifications at any time via Settings → Carplate → Notifications on your device or through the settings within the App.

11. Changes to This Policy

We reserve the right to make changes to this Privacy Policy. In the event of material changes, we will notify you via push notification or through the App interface. Continued use of the App after changes take effect constitutes your acceptance of the updated Policy.

We recommend periodically reviewing this page.

12. Applicable Law

This Privacy Policy is governed by the laws of Ukraine, in particular the Law of Ukraine "On Personal Data Protection" dated June 1, 2010, No. 2297-VI, and other applicable regulations.

13. Contact

For any questions regarding this Privacy Policy or the processing of your personal data, please contact:

Andriy Tierzov Email: avtierzov@gmail.com

This Privacy Policy is an integral part of the Terms of Use of the Carplate application.