Bagacar Privacy Policy

Last updated: 1 May 2026

Bagacar (“we”, “us”, the “app”) is a car-spotting app that helps you photograph cars, identify them automatically, and optionally share your sightings with other users on a map. This page explains what data the app collects, why, and what we do with it.

What data we collect

• Photos you take in the app. When you scan a car, the photo is sent to our server and to Google’s Gemini AI service to identify the make, model, and year. Photos saved as “sightings” are stored on our server so they can be shown on your map.
• Location (latitude and longitude). When you spot a car, the device’s approximate location is attached to the sighting so it can appear on the map. Location is only collected at the moment of spotting; we do not track your location in the background.
• Anonymous session ID. The app generates a random ID (a UUID) the first time it runs and stores it on your device. It is sent with each request so the server knows which sightings belong to your device. We do not collect your name, email, phone number, or any account credentials.
• Public sightings (only if you opt in). If you choose to mark a sighting as “Public”, the photo, identified car details, location, and timestamp become visible to other Bagacar users on the shared map. Sightings are private by default.

What we do NOT collect

• No personal account information (no name, email, phone, address).
• No advertising identifiers.
• No analytics or behavioural tracking.
• No background location.
• No contacts, calendar, microphone, or SMS data.

Third-party services

• Google Gemini API — processes scanned car photos to identify the vehicle. Photos are transmitted over HTTPS. See Google’s privacy policy.
• OpenStreetMap / CARTO map tiles — map imagery is loaded from public tile servers. Your IP address is visible to those servers when tiles load, as with any web map.
• Fly.io — hosts our backend server. Standard server logs (IP address, request time) are retained for security and debugging, typically for up to 30 days.
• Google AdMob — serves the rewarded video ads shown in the free tier. AdMob may collect your device’s advertising identifier (AAID), IP address, and basic device information to deliver and measure ads. See AdMob’s data disclosure. You can reset or limit your advertising ID in your device settings at any time.

Where data is stored

Sighting data and uploaded photos are stored on servers operated by Fly.io in the European Union. Your anonymous session ID lives only on your device.

How long we keep data

• Sightings (private and public): kept until you delete them in the app.
• Server logs: up to 30 days.
• If you uninstall the app, your local session ID is removed from your device, but any sightings you previously published remain on the server unless you delete them first.

Your choices

• You can delete any individual sighting from the app at any time.
• You can switch a sighting between Public and Private at any time.
• You can revoke camera or location permission in your device settings; the app will continue to work with reduced functionality.
• To request deletion of all data associated with your device, email us using the contact below and include your session ID (visible in the app’s settings).

Children

Bagacar is intended for users aged 13 and over. We do not knowingly collect data from children under 13. If you believe a child under 13 has used the app, contact us and we will remove the associated data.

Security

All traffic between the app and our server uses HTTPS. We do not store passwords or financial information. Photos are stored with restricted access on our server.

Changes to this policy

If we change this policy, we will update the “Last updated” date at the top. Significant changes will be announced in the app.

Contact

Questions, deletion requests, or concerns: bagacar.dev@gmail.com