Paddock: privacy policy

Who is responsible

The controller of Paddock’s personal data is Lucas Carvalho, the app’s developer, who also acts as data protection officer.

For any privacy matter, contact: empresarial.lucascarvalho@gmail.com.

Data you provide

Account: email and password, or the Google or Apple account you choose to sign in with. Profile: name, username (@), bio, profile photo, city and state, and the interests you select.

Garage: make, model, year, color, specifications and project name of your vehicles, photos, and diary entries. We do not ask for license plate, chassis number, RENAVAM or vehicle documents.

Content and interactions: posts, comments, likes, saved items, who you follow, communities, discussions, replies, poll votes, meetups you create or RSVP to, and messages you send to support.

Services: if you list a service, its title, description, category, WhatsApp number, the location you mark on the map, an optional reference address and photos are visible to other people, as are the reviews you receive or write.

Safety and moderation: reports you file and people you block.

Location

With your permission, and only while the app is open, we use the device location to find your city, center the map, and suggest nearby communities, meetups and services. You can deny or revoke the permission in your device settings and use the app by entering your city manually.

Appearing on the map is optional and starts off. If you turn it on, we share an approximate position (rounded to about 100 meters) only with the audience you choose: everyone, followers, or members of your communities. We keep no location history; the position disappears from the map after 2 minutes without being renewed, or as soon as you turn the option off. You need a registered vehicle to appear.

When you create a meetup or list a service, you mark its place on the map. That place is shown according to the visibility you chose for the meetup or listing.

Camera and photos

The camera and photo library are used only when you decide to take or pick a photo or video for your profile, vehicles, posts, meetups or services. The app accesses only the files you choose. Images are resized and compressed before upload.

The app can save to your library the card and milestone images you generate, when you ask it to.

What we do not do

Paddock has no advertising, no tracking across apps or websites, and no third-party analytics or crash-reporting libraries. We do not sell personal data and do not share it for advertising.

Technical data and session

To keep you signed in, the app stores a session code in the device’s secure storage (Keychain on iOS, Keystore on Android). The session expires after 30 days or when you sign out.

Our servers log technical request data (such as IP address, date and time, and the address requested) for security, abuse prevention and rate limiting. We do not use it to identify you for other purposes.

Who processes the data

Supabase: hosts Paddock’s database, authentication, file storage and API. It is our data processor.

Google and Apple: if you sign in with Google or Apple, the provider confirms your identity and gives us an access token and basic account data, under each provider’s own policy.

Maps: on iOS the map uses Apple Maps. On Android the map uses OpenStreetMap: map tiles are downloaded from OpenStreetMap servers, which receive your IP address and the region shown.

IBGE: when you search for a city, the text you type is sent to IBGE’s public localities API.

WhatsApp (Meta): when you tap “Request a quote”, the app opens WhatsApp with the number provided by the seller. The conversation happens outside Paddock and is handled by WhatsApp.

Other people: what you publish is shown according to the visibility you choose (for example public, followers, or community only). Your profile name, @, photo, city and bio are visible to other people in the app.

We may also share data when required to comply with a legal obligation or authority order, or to protect people’s rights and safety.

Your privacy controls

In Settings → Privacy and map you choose the default visibility of new vehicles (public, restricted or private), who can comment on your posts (everyone, followers or nobody), and manage blocked people. You can report content and profiles, turn off your map position at any time, and delete what you published.

Legal bases

We process data to perform the service you requested when creating the account (account, profile, garage, posts, communities, meetups and services); with your consent, when you enable location, map position sharing, or grant camera and photo access; for our legitimate interest in security, moderation and preventing fraud and abuse; and to comply with legal obligations.

How long we keep data

We keep data while your account exists. You can delete it in Settings → Delete account: your profile and associated content (vehicles, photos, posts, comments, diary, services and reviews) are deleted, and media files are removed from storage.

Before deleting, you can request a copy of your data under Delete account → “Download my data”: the file is sent to your email.

We may keep the minimum necessary to comply with legal obligations, prevent fraud and abuse, and exercise rights in legal proceedings.

Security

Communication between the app and the server uses HTTPS. Passwords are handled by the authentication service and stored protected (hashed), never in plain text. Database access is restricted to the API, which checks permissions on every request and limits requests per user. No system is completely immune to failure; if an incident may cause relevant risk, we will notify you and Brazil’s data protection authority (ANPD), as the LGPD requires.

International transfers

The providers above may process data on servers outside Brazil. In that case, the transfer relies on the safeguards provided in article 33 of the LGPD.

Children and teenagers

Paddock is not intended for children under 13 and we do not knowingly collect children’s data. If you believe a child created an account, write to the contact email and the account will be removed.

Your rights (LGPD)

At any time you may request: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data or data processed unlawfully; portability; deletion of data processed with consent; information about who we share data with; information about the option to refuse consent and its consequences; and withdrawal of consent. You can do part of this yourself in the app (edit profile, privacy, download and delete data); for the rest, write to empresarial.lucascarvalho@gmail.com.

If you believe your rights were not met, you may also file a complaint with Brazil’s National Data Protection Authority (ANPD).

Changes to this policy

We may update this policy to reflect changes in the app or the law. The date at the top shows the latest update. Relevant changes will be announced in the app.