Privacy Policy

1. Account information

You sign in with a Google account, with Sign in with Apple in the mobile app, or with an email address and password on the website. Where you use Google or Apple we receive and store the name, email address and profile photo they release to us, and we never see your Google or Apple password. Where you use an email address and password, that password goes directly to Firebase Authentication — it is never sent to us and we do not store it. We also record when your account was created and last signed in.

2. Vehicle and usage data you add

Everything you enter to use the product is stored against your account: vehicle details (make, model, year, VIN, registration plate), maintenance records, fuel logs, odometer readings, service reminders, parts-shelf items, tool loans and wishlist items. This data exists solely to provide the service back to you — statistics, reminders and history. Pluto Drive is single-vehicle at present: one vehicle per account, on both the app and the website.

3. Documents (Glovebox)

• Where documents are kept depends on the platform, and there is currently no choice within either. In the mobile app they are stored on your device only — the file never leaves your phone, and we store only its name and category. On the website they are uploaded to our cloud storage, readable only by your signed-in account.
• Documents stored on your device are not backed up by us. They are not copied to your account, they do not appear on the website, and they are lost if you delete the app or lose the device.
• Encrypted cloud storage for the mobile app arrives in a future update, and this policy will be updated before it does.
• Face ID / Touch ID protection is processed entirely by your device's operating system. We never receive or store biometric data.
• Receipt scanning (text recognition) runs on your device. Receipt images are not sent to us unless you choose to save them.

4. Location

• Live location: Pluto Drive does not collect or share your location. Live-location features arrive with Convoy in a future update, and this policy will be updated before they do.
• Country: when you sign in on the website we record which country you are in (a two-letter code derived from your network region). The mobile app does not record this. We do not store your IP address, city or precise location with it. It is used for aggregate statistics, such as how many users are in each country.

5. Deal search (Deal Hunter)

Deal Hunter and Pluto Parts are not available yet; they arrive in a future update, and this policy will be updated before they do. When they do: when you search for deals on a wishlist item, the item's title and your vehicle's make, model and year are sent to Anthropic's Claude API to find prices at Australian retailers. No personal identifiers (name, email, account ID) are included in those requests. Pluto Parts links may be affiliate links to third-party retailers; what you do on a retailer's site is governed by their privacy policy.

6. Diagnostics and notifications

• Crash reporting (Firebase Crashlytics) collects crash traces, device model and OS version, tagged with your account ID, so we can fix failures. No content of your records is included.
• If you enable notifications, we store a push-notification token for your device to deliver reminders.
• Two markers record how far you got when setting up: the last setup step you reached, and whether you have seen the app with no vehicle added yet. They are stored against your account and exist so we can find where setup is losing people and fix it. They record nothing about what you entered, and they are removed with everything else when you delete your account.

7. Who processes your data

Your data is hosted on Google Firebase (authentication, database, file storage, notifications, crash reporting). The website is served by Vercel. These providers operate globally, so your data is stored and processed on infrastructure that may be located outside Australia. When Convoy arrives, map tiles on its screens will be loaded from map providers (such as OpenStreetMap-based services), which receive standard web-request information when tiles load. Deal searches will go to Anthropic as described above. We do not sell or rent your personal information to anyone.

8. Security

Data is encrypted in transit and at rest. Access rules are enforced server-side so that your records and documents are readable only by your authenticated account (and, once Convoy arrives, the members of your convoy). Administrative access is role-restricted and role changes are audit-logged.

9. Deleting your data

You can delete your account from Settings in the app. Deletion is processed server-side and removes your profile, vehicles, records, documents, files and sign-in identity. Content you contribute to shared spaces (such as convoy chat or public drive stories) is anonymised; those features are not available yet. Documents stored on your device are not reached by account deletion — they remain on your phone until you delete the app.

10. Your rights and contact

We handle personal information in accordance with the Australian Privacy Principles. You may request access to or correction of your personal information at any time. For questions, requests or complaints, contact plutodrive.app@gmail.com.

If we change this policy, we will update the date at the top of this page. Material changes will be highlighted in the app.