Privacy Policy

1. Information We Process

This policy covers the CarGain mobile app (the "App") and the CarGain website at cargain.xyz (the "Website"). This section describes the App; section 2 describes the Website. We process only information needed to operate the App:

• Account information: email address, authentication identifiers, and basic profile information provided by your chosen sign-in method.
• Profile and preferences: display name, country, language, currency, timezone, units, and App settings.
• Your records: work sessions, income, expenses, tips, mileage, vehicles, passenger counts, notes, receipts you attach, and selected or custom platforms and categories.
• Generated information: dates, totals, history, reports, and analysis based on your records.
• Subscription information: purchase, product, entitlement, and expiry information linked to your CarGain account. We do not receive full payment card details.
• Location: current precise location only when you request nearby weather. When optional analytics is enabled, AppsFlyer may derive an approximate city or region from network information for attribution and fraud prevention. We do not request background location or save coordinates in your records.
• Technical information: crash, error, performance, device, App, and limited navigation information. Technical diagnostics run automatically when configured and cannot currently be disabled in the App.
• Optional analytics and attribution: interaction, navigation, masked session-replay, device identifier, and install-attribution information only when you turn on Usage analytics and ad measurement in Privacy settings.
• Deletion information: request date, scheduled deletion date, selected feedback reason, and any note you provide.
• Telegram support chat: if you contact support through Telegram, we store your Telegram chat and account identifiers, the CarGain account it is linked to, and your messages. Message text and attachments are encrypted. The one-time code used to link your Telegram chat to your account is stored only as a cryptographic hash and expires within minutes.

The App also stores an encrypted record cache, offline changes, and pending receipt uploads on your device, together with preferences and temporary App state. Expense receipts you choose are stored in private account storage.

We do not sell personal data or display or personalize ads. If you enable optional analytics, AppsFlyer measures which advertising campaigns lead to an install or later App activity. On iOS, AppsFlyer may access Apple's advertising identifier only if you separately allow tracking in the system prompt; otherwise the identifier remains unavailable. Receipt attachment uses the operating system's document picker. The App does not request camera, microphone, contacts, full photo-library, or background-location access.

2. The CarGain Website

You can read the Website without an account. It does not receive your CarGain account ID, email address, or App records.

Analytics and cookies

We measure how visitors use the Website with these tools:

• Google Analytics, loaded through Google Tag Manager — page views, basic device and browser details, approximate location derived from your IP address, and how you reached the Website. We use Google Consent Mode: without your consent, Google receives only cookieless signals and sets no analytics cookies. Advertising signals are always denied, because the Website shows no ads.
• PostHog — page views, interactions, and technical errors. Masked session replay may be enabled. Until you accept analytics cookies, PostHog measures visits without cookies or browser storage.
• Ahrefs Web Analytics — page views and referrers. Ahrefs does not use cookies.

The Website uses these cookies and browser storage:

Internal administration pages use sign-in cookies only for authorised staff, and are excluded from all Website analytics.

Your cookie choice

A card on the Website asks whether you accept analytics cookies. The Website stays usable whatever you choose, and you can change your choice at any time through Cookie settings at the bottom of every page.

• In the EEA, the United Kingdom, Switzerland, and Türkiye, analytics cookies stay off until you select Accept.
• In other regions, Google Analytics may set its cookies until you select Decline. PostHog stays cookieless until you select Accept.

Contact form

When you use the contact form, we receive the email address, subject, and message you enter. The form is processed by Kageform and delivered to us by email. We use this information only to answer you.

Bot protection

Sign-in pages use Cloudflare Turnstile to tell people from automated traffic. Cloudflare processes browser and device signals for this check.

Hosting and security logs

The Website is hosted on Vercel, which processes IP addresses and request details to deliver pages and protect the service.

When someone tries to sign in to the internal administration area, we record the time, the result, the email address entered, the IP address, the browser user agent, and an approximate location derived from the IP address. We keep these security logs to detect and stop unauthorised access. Passwords and verification codes are never logged.

3. How We Use Information

We use information to:

• create and protect your account;
• store, sync, and report your records;
• provide weather, subscriptions, notifications, and other App features;
• verify purchases and restore paid access;
• prevent abuse and fix technical problems;
• improve the App and measure campaign effectiveness when you enable optional analytics;
• improve the Website and understand how visitors use it;
• protect the Website and its administration area from unauthorised access;
• comply with legal, billing, and security obligations.

We rely on our contract with you for core App functions; legitimate interests for security, security logs, technical reliability, and cookieless Website measurement; your consent for optional App analytics, including session replay and attribution, for location, and for Website analytics cookies; and legal obligations where applicable.

4. Storage and Security

Account data and records are stored using secure cloud infrastructure. Local records and offline changes are encrypted on your device. We use encrypted connections and account-level access controls, but no storage or transmission method is completely secure.

5. Sharing

We share information only when needed with the following service providers:

• Supabase — cloud storage, database, authentication, and server operations;
• Apple and Google — the sign-in methods you choose, app distribution, payments, and subscription billing;
• RevenueCat — subscription management and entitlement verification;
• Sentry — crash, error, and performance diagnostics;
• PostHog — Website analytics, security logs for the administration area, and optional App product analytics and masked session replay when you enable it. Website analytics does not send PostHog your CarGain account ID or email address;
• Google — Website analytics through Google Analytics and Google Tag Manager, under Consent Mode;
• Ahrefs — cookieless Website analytics;
• Vercel — Website hosting;
• Cloudflare — bot protection on sign-in pages;
• Kageform — processing of Website contact-form messages;
• AppsFlyer — optional install attribution and advertising-campaign measurement, only when you enable analytics. CarGain does not send AppsFlyer your account ID, email, financial records, trips, or location. See "AppsFlyer attribution" below;
• Telegram — the customer-support channel you choose to use, operated by Telegram FZ-LLC;
• weather, security, and App-update providers; and
• authorities, where required by legal obligations or valid requests.

We may change providers over time and will update this policy when a change is material. Providers may process information outside Türkiye and must protect it under applicable law. We do not sell or rent your data.

AppsFlyer attribution

AppsFlyer measures which ad or link brought you to CarGain. We use it only when you turn on Usage analytics and ad measurement, in every country. Until then, the App does not start the AppsFlyer SDK and sends AppsFlyer nothing. Consent you gave before AppsFlyer was named in the App does not carry over; the App asks again.

• What AppsFlyer receives: an install record with the AppsFlyer device identifier, network information such as your IP address, and basic device and App details. After that, only three events: account setup complete, a work session ended, and a Pro subscription started, which includes only the store product identifier. CarGain sends no account ID, email, phone number, earnings, trips, precise location, or other account fields.
• Sharing with ad networks: AppsFlyer shares install attribution with the ad network that delivered the ad you tapped.
• Legal basis: your consent. We treat every user as covered by GDPR consent rules, wherever they are.
• Ad personalization: off. We tell AppsFlyer that you have not consented to ad personalization, even when you enable analytics.
• Withdrawing consent: turn off Usage analytics and ad measurement in the App under Settings → Privacy and data. The App sends AppsFlyer one final signal that you withdrew consent, then stops all AppsFlyer communication. Data already collected is kept as described in section 7.
• Apple postbacks: on iOS, Apple's SKAdNetwork and AdAttributionKit send copies of their attribution reports to https://appsflyer-skadnetwork.com/. Apple generates, aggregates, and anonymizes these reports, and they do not depend on your App analytics setting.

6. Your Choices and Rights

You can edit your records and preferences in the App, disable optional analytics and attribution, and control tracking, location, and notification permissions through App or device settings. On the Website, you can change your cookie choice at any time through Cookie settings.

You may request access, correction, export, or deletion of your personal data and exercise other rights available under applicable law. Contact info@cargain.xyz if you need help.

7. Retention and Account Deletion

We keep your account and records while your account is active. You can request account deletion in the App from Settings → Privacy and data → Delete my account. An accepted deletion request starts a 30-day grace period. Signing in during that period cancels the request. After it ends, the account and associated cloud records are deleted. We retain subscription purchase and entitlement information for three more months to handle billing, refunds, fraud, and related legal obligations, then delete it.

Technical diagnostic and optional analytics information is kept for limited periods on our providers' systems. Crash and error data is kept for up to 90 days. PostHog Website event data, App event and person data, session-replay data, Google Analytics data, and AppsFlyer attribution data are kept according to our configured provider retention settings and are then deleted or aggregated. Administration security logs are kept for a limited period and then deleted. Contact-form messages are kept as long as needed to handle your request.

A deletion request can be submitted at any time, even while an app-store subscription is still active. Deleting your account does not cancel the subscription — you manage or cancel the subscription in the store where you purchased it.

When you submit the request, the App also clears the local data tied to your account from this device. Already-collected optional analytics and attribution data may remain in PostHog or AppsFlyer until the configured retention period ends, after which it is deleted or aggregated.

Account deletion also closes any linked Telegram support chat and redacts the message content and Telegram identity tied to your account, unless the same chat is currently linked to another CarGain account, in which case the chat itself is kept for that account and only your association with it is removed. Independent of account deletion, Telegram support message content is redacted 90 days after receipt.

8. Children's Privacy

CarGain is intended for professional drivers and not for anyone under 18. We do not knowingly collect personal data from minors.

9. Changes

We may update this policy when the App, the Website, or legal requirements change. The date above shows the latest revision. Material changes will be made visible where required.

10. Contact

Email: info@cargain.xyz