Your data,
your rules.

The data controller is Stallion, contactable at privacy@thestallionapp.com. Cloud sync is hosted by Supabase on AWS.

If you have any question about this policy or your data, email privacy@thestallionapp.com.

We only collect data you put into the app or that your vehicle/device produces while you use it. We do not buy data about you, and we do not use third-party advertising or tracking SDKs.

• Account information — email, auth credentials (via our auth provider), optional name/photo/role.
• Vehicle information — make, model, year, nickname, plate, mileage, fuel type, tank size; VIN only if you enter it.
• Usage & cost records — fuel logs, maintenance, reminders, and related costs/notes.
• Engine / diagnostic data — only if you connect an OBD-II adapter (live readings and DTCs).
• Trip & location data — only while a trip is actively recorded. Recording continues in the background with your screen locked, so we ask for "Always" location; it starts and stops with the trip, your device shows an indicator the whole time, and you can decline background access and record only while the app is open.
• Sharing & fleet data — members you invite and which vehicles are shared.
• Technical data — minimal diagnostics needed to operate the app. No advertising identifiers.

We use your data only to provide and improve the app: store/display vehicles and logs, sync across your devices and authorized fleet members, power the AI vehicle assistant when you ask, look up fuel prices/stations and repair shops, send reminders you create, and keep the service secure.

We do not sell your personal data and do not use it for third-party advertising.

Where GDPR applies, we rely on: performance of a contract; consent for optional features like trip location and AI (you can withdraw anytime); and legitimate interests to secure and improve the app, balanced against your rights.

When you use AI features, we send a limited, relevant subset of vehicle/usage data to Anthropic (Claude API) via our backend proxy when configured. We send only what is needed and not for advertising.

• Cloud backend & authentication — account sign-in and optional sync.
• AI — Anthropic, for the vehicle assistant / maintenance / budget / DTC features.
• Reference APIs — fuel prices and nearby-station lookups, and US safety-recall data from NHTSA.
• Subscriptions — RevenueCat, together with Apple, Google or our web payment provider, processes purchases and tells us which plan is active. Card details go to them, never to us.
• Maps — Google Maps draws route and station maps, which sends the map area being viewed to Google.

On your device (local-first): app session data uses AES encryption with keys in iOS Keychain / Android Keystore where available.

In the cloud (only if you sign in / enable sync): data travels over TLS and is stored with encryption at rest and row-level security.

Honest limitation: cloud sync is not end-to-end encrypted. Prefer fully on-device? Skip signing in.

The Stallion website stores what it needs to work: browser storage that keeps you signed in and remembers where you were in the app for the current session. We set no advertising, analytics or tracking cookies and load no third-party trackers. Two services set their own cookies when you use them: hCaptcha, which protects sign-in and sign-up from abuse, and Stripe, which handles checkout.

When you first visit, a notice asks you to accept or decline optional storage. That covers only what the site could run without: at present, remembering display preferences such as list or grid view between visits. If you decline, those preferences are not stored and everything else works the same. Your answer is itself stored in your browser so it can be honoured; clearing your browser storage clears it, and you will be asked again.

You can clear this storage at any time in your browser settings; you will simply be signed out.

We share data only with people you authorize, processors needed to run the service, for legal reasons when required, or in a business transfer subject to this policy. We never sell your data.

We keep your data while your account is active. You can delete individual records anytime, and delete your account to remove personal data from our systems (subject to limited rolling backups and legal retention). Local-only data is removed when you delete it or uninstall.

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to processing, and to withdraw consent. We do not sell or “share” personal information for cross-context behavioral advertising (CCPA).

Most of these can be exercised in the app. For anything else, email privacy@thestallionapp.com.

Stallion is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data.

If we transfer data across borders, we use appropriate safeguards (such as Standard Contractual Clauses) where required.

We may update this policy. If we make material changes, we will notify you in the app or by email and update the “Last updated” date.

Stallion — privacy@thestallionapp.com