Privacy Policy

Effective date: 2026-09-26

Epic Foundry LLC ("we", "us") operates APEX Car Finder ("APEX"). This policy covers the iOS app and related services. The website waitlist has a separate notice.

1. The short version

2. What we collect and why

• Sign-in: Apple or Google supplies your email (possibly Apple's relay), name if available, and user ID for your account.
• Your choices: you enter a display name, notification preferences, alert threshold, and tracked-model criteria (specifications, budget, mileage, service history) to find and score listings.
• App activity: saved/dismissed matches record your choices. Background processing creates analyses, scores, summaries, seller questions, notification history, and share records for results, alerts, and sharing.
• Notifications: with permission, we store a push token for vehicle/match alerts.
• Scan: camera/library photos identify vehicles. APEX servers don't store them; a tracked model created from a scan keeps its photo locally.
• Analytics: only after opt-in, PostHog receives screen views, feature events, device/OS information, IP addresses, and approximate location estimated from IP. Its random ID connects events; we don't link them to your APEX account.
• Support: we collect your reply email, message, optional name, and—in-app—app/iOS versions and signed-in account link to answer you and fix problems. A one-way IP hash limits abuse and is deleted after 2 days. Replies come from [email protected].

Location: APEX never reads GPS or iOS location services. PostHog's city/region/country estimate remains even when the IP address is discarded.

3. AI analysis

With your permission, we send Anthropic (Claude) scan photos, tracked-model criteria, and public listing details—not your name, email, or account identifiers. Claude supplies vehicle identification, analyses, summaries, seller questions, and signals; APEX's own rules calculate scores. Anthropic's commercial policy normally deletes API inputs/outputs within 30 days, with exceptions for safety, usage-policy enforcement, legal requirements, and certain services or agreements. Its commercial data is not used for model training by default; feedback or explicit permission can change this. Withdraw permission in PILOT › Privacy; this pauses active tracked models. AI results support research and may be wrong; they aren't inspections, appraisals, guarantees, or professional advice (see our Terms).

4. Services we use

We require these providers to protect your information with the same or equal protection described in this policy, and to use it only to provide their services to us. We may also disclose information to comply with law, investigate fraud, protect rights or safety, or respond to lawful government requests.

5. Your choices

AI Analysis and Share Usage Analytics default off. Enable them separately during onboarding or in PILOT › Privacy; withdraw consent there anytime. Scan and starting/resuming tracking require AI permission; other features remain usable. Withdrawal stops future processing under that consent, not past processing.

Control camera access through iOS Settings. Turn notifications off there or in PILOT › Push Alerts. Uninstalling stops device collection but doesn't delete your account or previously transmitted data.

6. Keeping and deleting your data

Delete your account immediately and permanently in PILOT › Delete Account. This removes account details, preferences, tracked models, saved/dismissed matches, notification history, tokens, and share links, and revokes Sign in with Apple access. Email us for help. Analyses of listings for your tracked models are deleted with them. Public listing records remain; operational logs lose their user reference.

Delete tracked models/saved vehicles separately anytime. Local scan photos disappear with their tracked model or the app.

When you delete your account, or 12 months after submission (whichever comes first), we erase your support-message email, name, account link, and IP hash. Questions and answer notes remain without those fields to improve support. Email us to delete a message entirely.

Deleted data may remain in our encrypted backups for up to 90 days. Supabase may retain short-term backups under its own retention. PostHog retains analytics according to its plan period; opting out stops collection. Because analytics aren't linked to your account, account deletion doesn't automatically erase those events. Legally required records may be retained as required.

7. Sharing a match

Anyone with your share link can see the listing and APEX analysis highlights, but not your identity. Account deletion disables your links.

8. What we don't do

• No advertising, advertising identifiers, cookies in the app, or cross-app tracking.
• No GPS access; opt-in IP-derived location is explained above.
• No marketing emails from the app, payments, or public user posts.

9. California privacy rights

Under CCPA/CPRA, these categories cover collection during the preceding 12 months. Sources are you, your device, and Apple/Google at sign-in; consent choices, provider disclosures, and purposes appear above.

Backup exceptions are in §6. We don't collect sensitive personal information, such as precise location, government IDs, or account passwords.

You may request access to or a copy of your information, deletion, and correction, subject to legal exceptions, without discrimination. We don't sell your personal information or share it for cross-context behavioral advertising, so no sale/sharing opt-out link is needed. Limits on sensitive-information use aren't applicable to our collection.

Use in-app deletion or the contact email below. We verify requests through your signed-in account or account email; authorized agents may act with proof of authorization and appropriate identity verification. We respond within 45 days, with one further 45-day extension if needed and explained. We review this policy at least every 12 months.

10. Children, security, storage, and contact

Children: APEX isn't directed to children under 13. We don't knowingly collect their personal information; contact us if this occurs.

Security: we use safeguards including encrypted connections and restricted database access. We notify you of breaches as legally required.

Storage: Supabase stores data in Oregon, United States; providers may process elsewhere, with legally required international-transfer safeguards.

Changes: material updates carry a new effective date and any legally required notice or consent; previous versions are available on request.

Contact: Epic Foundry LLC — [email protected].