Effective August 6, 2026
MotorDex is a game where you photograph real cars you spot and collect them as trading cards. This policy explains what we collect, why, who we share it with, and the choices and rights you have. We keep only what the game needs, we never sell your data, and you can delete everything yourself, in the app, at any time.
MotorDex is operated by Matteo Farinacci, the data controller for the personal data described in this policy. You can reach us about privacy at support@motordexgame.com.
When you first open MotorDex we create an anonymous account with a random internal ID so you can play without signing up. Your catches and gameplay are stored under that ID. You can add an email or Sign in with Apple later to keep your data across devices, and you can delete everything at any time in Settings → Account → Delete Account. • Account — your email and chosen handle, or, as a guest, just an internal account ID. Sign in with Apple may give us a private-relay email. • Your catches — the photos you scan, each catch's date and time, and (if you allow location) the GPS spot, plus the AI's best-guess car details. • Gameplay — XP, level, card count, dex progress, friends, and reactions. • Scan activity — we log each scan to enforce the daily limit and keep costs sane. • Purchases — we store only whether your account is Pro, never your card or payment details. • Advertising identifier — we do not currently collect it. Ads are off at launch and our privacy manifest declares no tracking. If we ever turn ads on, they will be non-personalized only (no advertising identifier is used). We would only introduce any cross-app tracking after asking your permission through Apple's App Tracking Transparency, and you could decline and still use every feature.
If you join the waitlist on motordexgame.com for MotorDex on Google Play, Android, iPad or the web, we store the email address you give us, which platform you asked for, and where you heard about us. We do not ask for or store a phone number. We collect this on the basis of your consent, we use it for one purpose — to tell you when MotorDex launches on that platform — and we never sell or share it or add you to any other mailing. The waitlist is write-only from the website: our public web key can add an entry but cannot read the list back. Ask us to remove you at any time at support@motordexgame.com and we will delete your entry; we also delete the whole list once the platform you asked about has launched and been announced. Joining the waitlist does not create a MotorDex account and is not linked to any in-app account or gameplay data.
We use it only to run the game: to identify your scans, build your dex and Catch Cards, place catches on your map, sync across your devices, power the friends feed, enforce limits, and provide support. We do not sell your personal data.
For California residents, the categories of personal information we collect are (this includes the email address you give us if you join our website waitlist): • Identifiers — your internal account ID, chosen handle, and email or Apple private-relay email. • Commercial information — your MotorDex Pro subscription status. • Internet or other electronic network activity — scan logs we use to enforce daily limits. • Geolocation data, including precise geolocation, which we treat as Sensitive Personal Information (see below). • Visual information — the car photos you scan and the date and location embedded in them. • Inferences and content — the AI's best-guess car details. Sources: directly from you and your device. Business purposes: operating and securing the game as described in How we use your data. We disclose these categories only to the service providers listed under Third parties. We have not sold or shared any category of personal information in the past 12 months.
When you allow location, we collect your precise geolocation. California (CPRA) treats this as Sensitive Personal Information, and Virginia, Colorado, Connecticut and other states treat it as sensitive data. We collect it only with your consent (the iOS location permission you grant) and use it for one purpose: to place your own catches on your own map. We do not use precise geolocation to infer characteristics about you, we do not disclose it to your friends or any third party, and we do not sell or share it. Because we limit our use to providing the map you asked for, the CPRA Right to Limit Use of Sensitive Personal Information does not change how we handle it — but you can withdraw consent at any time in iOS Settings, and for users under 16 precise-location capture is off.
We share data only with the service providers we need to run MotorDex, who act as our processors under data processing agreements and may only use your data on our instructions: • Supabase — backend, database, and photo storage — United States — EU Standard Contractual Clauses. • Google (Gemini API) — identifying the car in your photo — United States — Standard Contractual Clauses. • RevenueCat — subscription status — United States — Standard Contractual Clauses. • Apple — Sign in with Apple and App Store billing — Apple acts as an independent controller for App Store purchases. • Apple MapKit — map tiles — operated by Apple. • Google AdMob — ads, which are off at launch — United States — Standard Contractual Clauses. If we add or change a provider we will update this policy; you may object by contacting us or by deleting your account. We do not use any push-notification service or third-party analytics SDK.
When you scan a car, the photo is sent through our server to Google Gemini to identify the car AND to run an automated safety check that refuses objectionable images (nudity, sexual content, graphic violence, or hate imagery) before the catch is created; the same automated check runs on any profile photo you set. Cars that pass are stored in our backend so they can appear on your Catch Card and map. We read any date and location embedded in photos you upload. Each photo is served from an unlisted link with a random, unguessable address so it can load on your cards and for the friends you add — anyone you share a card or link with can open that image. Photos taken in public may incidentally include other people, vehicles (and their plates), or property in the background. Please frame the car and keep identifiable people out of shot; we rely on our legitimate interest in running the game and in keeping it safe to process and screen these images, we do not list them publicly, and anyone depicted may ask us to remove a photo using the in-app Report tool or the contact email below.
We do not perform facial recognition, face matching, or any other biometric identification on your photos, and we do not create, collect, or store face templates, faceprints, voiceprints, or any other biometric identifier. The AI that reads your photo identifies VEHICLES, not people, and the automated safety check looks only for objectionable imagery — neither attempts to recognise or distinguish any individual.
Your Spotter License can show a photo you choose instead of a car. This one is OPTIONAL and it is the only picture you give us that isn't a car: if you set one, we upload it and show it to the friends you have accepted — nobody else. Like your catch photos it is served from an unlisted link with a random, unguessable address, so anyone you share that link with can open it; please don't use a photo you wouldn't want a friend to save. Choose a car sprite instead and no photo is uploaded at all. You can swap it or switch back to a car at any time, which deletes the previous one from our servers, and deleting your account deletes it too.
Location is optional. With "While Using" permission we attach where you made a catch so it shows on your map; we also read location embedded in photos you upload. Deny or revoke it anytime in iOS Settings — the app still works, those catches just won't have a pin.
When you scan a car, Google Gemini automatically suggests the make and model from your photo. This is an automated process, but it only produces an entertainment label for your Catch Card — it has no legal or similarly significant effect on you, so the special rules on solely-automated decisions in Article 22 GDPR do not apply. Identifications are best-effort and can be wrong; you can re-scan or delete any catch.
We rely on: • Performance of our contract with you (Art. 6(1)(b)) — creating and running your account, identifying your scans, building your dex and Catch Cards, syncing your data, operating the friends feed for friends you add, and processing Pro purchases. • Our legitimate interests (Art. 6(1)(f)) — enforcing scan limits, preventing abuse and fraud, keeping the service secure, and processing the incidental contents of photos you choose to upload; we have weighed this against your interests and you may object at any time. • Your consent (Art. 6(1)(a)) — precise location, which you grant through the iOS permission prompt and can withdraw in iOS Settings, and any future ad tracking through App Tracking Transparency. • Legal obligation (Art. 6(1)(c)) — retaining limited records where the law requires.
Your handle, your level, and your dex progress are visible to friends you add. Friends you accept can also open your collection — every car you've caught and the catch photos on those cards — and can react to your catches; a friend removed or blocked loses this access. Your handle, level, and totals (cars, different models, XP) also appear on the public MotorDex World leaderboard unless you opt out in Settings; the leaderboard never shows your photos. Use the in-app Report and Block tools for anything inappropriate — reports are reviewed within 24 hours and violating content or accounts can be removed. Your catch LOCATIONS are never shared with anyone. Friends and the leaderboard never see the GPS of your catches — the exact coordinates are visible only to you, on your own map. When a friend views your collection, the location data is stripped before it ever leaves our server.
We don't use cross-app tracking or third-party analytics SDKs, and our privacy manifest declares no tracking. If we enable ads they are non-personalized by default, and we will ask permission through Apple's App Tracking Transparency before any tracking — you can decline and still use every feature.
We keep your account, catch, and gameplay data until you delete the individual catch or your account, after which it is removed from our live systems immediately and purged from encrypted backups within 30 days. Scan-activity logs used to enforce daily limits are kept for up to 30 days. Purchase records held by Apple and RevenueCat are kept under their own policies and as tax and accounting law requires. Settings → Account → Delete Account permanently deletes your account, catches, photos, friends, reactions, and the reports and blocks tied to your account. This is immediate and can't be undone.
You can ask us to access, correct, delete, or restrict the use of your data, to object to certain processing, and to receive the personal data you gave us in a portable, machine-readable format (data portability). Where we rely on your consent — precise location, and any future ad tracking — you can withdraw it at any time without affecting earlier processing; turn location off in iOS Settings → Privacy → Location Services → MotorDex. You also have the right not to be treated differently for exercising these rights; we do not carry out profiling that has legal or similarly significant effects. To make a request you, or an authorized agent acting for you, can email us, and we will verify the request through your account. We honor a Global Privacy Control signal as an opt-out of sale or sharing. We respond free of charge: under the GDPR/UK GDPR within one month, extendable by up to two further months for complex requests (we'll tell you why); under the CCPA we confirm receipt within 10 business days and respond within 45 days, extendable once by 45 days. If we deny a request, residents of Virginia, Colorado, Connecticut and similar states may appeal by replying to our decision; we will respond within 45 days (60 for Colorado and Connecticut) and, if we still deny it, tell you how to contact your state Attorney General. You also have the right to lodge a complaint with a data protection authority — in the UK the Information Commissioner's Office (ico.org.uk), in the EEA your local Data Protection Authority — though we'd appreciate the chance to resolve your concern first at support@motordexgame.com.
For transfers of EEA, UK, or Swiss personal data to the United States we rely on the European Commission's Standard Contractual Clauses, completed for the UK by the ICO's UK Addendum to those Clauses (or the UK IDTA), together with supplementary measures such as encryption in transit and access controls. Where a provider is certified under the EU-US Data Privacy Framework we rely on that certification. Copies of the relevant safeguards are available on request. We protect your data with HTTPS encryption in transit, database row-level security so each user can reach only their own data, encryption at rest provided by our backend, and least-privilege access controls. Catch photos are stored at unlisted web addresses with long, random identifiers: they are not individually encrypted or access-controlled, so anyone who has a photo's link (for example a friend you share a card with) can open it — please keep this in mind before sharing. No system is perfectly secure.
If a personal data breach occurs that is likely to affect your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware where the law requires, and we will tell affected users without undue delay where the breach is likely to result in a high risk to you.
MotorDex is a general-audience app intended for users 13 and older. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. You must be at least 13 to use MotorDex (see our Terms). We ask for your birth year once, and store it only on your device. People under 13 cannot create an account, and for users who tell us they are under 16 we turn precise-location capture off. If you are in the EEA or UK, the age at which you can consent to data processing without a parent varies by country (13 to 16); because we keep consent-based features such as precise location off for everyone under 16, we do not rely on a teenager's own consent for them. We do not sell or share personal information and we do not show personalized ads; if we ever enable advertising that could involve sharing personal information, we will not sell or share the data of any user we know to be under 16 without opt-in consent (from the user if 13-15, or a parent or guardian if under 13), as California law requires. If we learn we have collected data from a child under 13, we will delete it.
If this policy changes we'll update the date above and ask you to review it. Questions or requests: support@motordexgame.com.