Privacy policy

Who we are

The controller of your data is Robert Trifan.

For any question about your data, write to us at:

[email protected]

What we collect and why

We do not collect your phone location, show ads or track you for advertising.

We only use the data the app needs to work, grouped as follows:

• Account: email address, display name, language, time zone and the hour you want notifications. We use them to create your account and send reminders (performance of the service).
• Cars and documents: make, model, year, plate number, VIN, mileage, document fields (for example the expiry date) and the PDF scans you add. Some driver documents may contain your name, personal ID number (CNP) or address; we only receive them if you add them. Reading text from a photo (OCR) runs on your phone, and the image is not sent anywhere to be read (performance of the service).
• Costs and service: amounts, dates, mileage, notes, receipts, station and county. The county on fuel entries also feeds an anonymous community average price (performance of the service).
• Family: the display names of the members you share cars with (performance of the service).
• Trips abroad: destination, transit countries and travel dates (performance of the service).
• Notifications: your phone's Expo push token, the platform (iOS or Android) and a log of notifications sent (performance of the service). Notifications are optional; you can turn them off in your phone settings.
• Premium: your user identifier, which RevenueCat also uses, purchase events and the environment (production or test), so we know what you bought (performance of the service and legal obligations).
• Usage statistics: pseudonymous events linked to your user identifier (the event name and coarse details), never to names, plates or codes (legitimate interest: improving the app).
• Diagnostics: if the app crashes, Sentry receives the phone model, the OS version, the error context scrubbed of personal data and a pseudonymous identifier (legitimate interest: fixing errors).

Legal basis

We rely on performing the service you ask for (contract), on legal obligations (for example purchase records) and on our legitimate interest in fixing errors and understanding how the app is used. We do not process data on consent alone, except for optional notifications, which you can turn off at any time.

Who receives your data

We do not sell your data. We share it only with providers the app cannot work without (processors), under data processing agreements:

• Supabase: database, sign-in and files, hosted in Ireland (EU).
• Resend: sending reminder emails, in the US.
• RevenueCat: Premium subscription status, in the US.
• Sentry: error reports, in the EU (Germany).
• Expo: push notification delivery, in the US.
• Apple and Google: signing in with Apple or Google, and payments through the App Store or Google Play. Each is an independent controller for the data it receives from you, under its own policies.

Transfers outside the EU

Some providers are in the US. Transfers rely on the EU-US data protection framework where the provider is certified, or on standard contractual clauses or an equivalent mechanism. We prefer EU regions wherever one exists.

Partner links

Some links in the app open a partner's website (for example for insurance). We do not send the partner your data; from there, your data is governed by the partner's policy.

How long we keep data

• For as long as you have an account. You can delete it at any time in the app: Settings → Data & privacy → Delete account (in the Romanian app: Setări → Date & confidențialitate → Șterge contul). This removes the account, cars, documents and files; a car you hand over to a co-owner during deletion stays with them, with its documents and history.
• Usage statistics are kept, but anonymised (no longer linked to you).
• Purchase records stay with RevenueCat, Apple and Google, under their own rules; we keep the log of purchase events linked only to a pseudonymous identifier.
• Platform backups at Supabase expire on its own schedule.

Your rights

You have the right to:

• access your data;
• rectify anything that is wrong;
• erasure, directly in the app or on request;
• restrict processing;
• portability: Premium users export their history as PDF or CSV from the app; anyone can request a copy of their data by writing to [email protected];
• object to processing based on legitimate interest;
• lodge a complaint with the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal):
• https://www.dataprotection.ro

Children

Garamio is not addressed to people under 16 and we do not knowingly collect data from them.

Changes to this policy

If we change this policy we update the date above and, for important changes, tell you in the app.