Privacy
Policy

00 — Overview

SpekForge ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data.

By using the SpekForge app or this website, you agree to the practices described in this policy.

01 — Information We Collect

Information You Provide

When you create an account or use the app, we may collect:

• Email address — for account creation and login.
• Username — displayed on your profile and community builds.
• Profile photo — if you choose to upload one.
• Vehicle information — year, make, model, trim, and transmission you enter for build planning.
• Saved builds — parts lists and build configurations you create in the app.
• Photos — if you add a photo to a build or garage vehicle.
• Community content — comments, "regrets," and feature requests and votes you post.
• Feedback and vehicle suggestions — anything you send us through the app.

Information Collected Automatically

When you use the app, we may automatically collect:

• Device type and operating system version.
• Diagnostics. When you use the app, we receive crash reports, performance traces, and error logs from our crash-reporting service (Sentry). When you are signed in, these are tied to your account ID so we can find and fix problems you hit. For a sample of sessions (about 10%), and for every session in which a crash or error occurs, Sentry also records a replay of what the app screen showed. Text and images in the replay are masked. If you use the in-app feedback form, what you submit goes to the same service.
• Product analytics. We use PostHog to see which features are used. Events are tied to your account ID. They do not include your email address. Events can include the vehicle you picked (make, model, trim, transmission), parts you add or remove (name, brand, category, price), saved-build totals, your experience-level answer, and which community actions you took (like, comment, clone).
• Push notification token. If you allow notifications, we store a token from Expo's push service together with your account and platform (iOS or Android), so we can send the notifications you have turned on.
• CAPTCHA signals. When you sign in, sign up, or reset a password, hCaptcha checks that you are a person. hCaptcha receives device and interaction signals for that check and returns a token to us.

Our Website

On spekforge.app we use PostHog to measure visits to the site (pages viewed, plus basic device and browser information), and it may set a cookie or similar identifier to recognize repeat visits. If you join the waitlist, we store your email address and send you a welcome email through Resend.

What We Do NOT Collect

• Payment or credit card information — all purchases occur on third-party retailer sites.
• Social Security numbers or government ID information.
• Precise GPS location data.
• Data from children under 13.

02 — How We Use Your Information

We use the information we collect to:

• Create and manage your user account.
• Save and sync your builds across devices.
• Display your username and profile in the community section.
• Improve app performance and fix bugs, including diagnosing crashes and understanding which features are used.
• Send important account-related notifications (e.g., security alerts) and the notifications you have turned on (e.g., price-drop alerts).
• Comply with legal obligations.

What Other Users Can See

Your username, your avatar, and the builds you choose to make public are visible to other SpekForge users, as are your comments, "regrets," and feature requests. Your avatar and the photos you attach to a build or garage vehicle are stored in publicly readable storage: anyone who has a photo's web address can open it, whether or not they have an account. Don't upload photos that show information you don't want others to see, such as a license plate.

Your email address, push token, saved cart, and private builds are not shown to other users.

03 — Affiliate Links & Third-Party Retailers

SpekForge includes links to third-party retailers (such as Amazon, eBay, AutoZone, and others) through affiliate marketing programs. When you click these links and visit a retailer's website:

• You leave the SpekForge app and are subject to that retailer's own privacy policy and terms.
• The retailer may collect their own data about your browsing and purchase behavior.
• SpekForge may receive a commission if you make a purchase, but we do not receive your payment details.

We encourage you to review the privacy policies of any third-party sites you visit.

04 — Third-Party Services We Use

SpekForge uses the following trusted third-party services to operate the app:

• Supabase — database, file storage, and authentication provider. Stores your account, garage, builds, comments, photos, and push tokens. See supabase.com/privacy.
• Sentry — receives crash reports, performance traces, logs, and session replays, identified by your account ID (see Section 01).
• PostHog — receives product-analytics events, identified by your account ID (see Section 01). Also used for visit measurement on this website.
• hCaptcha — checks that sign-in, sign-up, and password-reset attempts come from a person.
• Expo Push (Expo) — delivers push notifications using the token we store for you.
• Apple, Google, X, and Facebook — if you choose to sign in with one of them, that provider authenticates you and gives us your account email and identifier. We don't add any tracking code from these providers to the app.
• eBay — when you search for parts, our servers send your search text and your vehicle's year, make, and model to eBay's Browse service. The app itself doesn't contact eBay. If you tap a listing, you leave the app and eBay's own privacy practices apply. Our affiliate link identifies SpekForge, not you.
• NHTSA vPIC (US government) — when you decode a VIN or look up vehicle details, the VIN or vehicle fields are sent from your device to NHTSA's public vehicle database. No account information is attached.
• Resend — sends the welcome email for the SpekForge website waitlist. It isn't used by the app for account holders.
• Apple App Store / Google Play — app distribution. Subject to their respective privacy policies.

We don't sell your information and we don't share it with advertisers or data brokers. We don't use advertising identifiers, and the app doesn't ask to track you across other companies' apps or websites.

05 — Data Security

We take the security of your data seriously. SpekForge uses:

• HTTPS encryption for all data in transit.
• Row Level Security (RLS) in our database to ensure users can only access their own data.
• Secure JWT-based authentication with automatic token refresh.

While we implement strong security measures, no system is 100% secure. We cannot guarantee absolute security of your data.

06 — Your Rights

Access & Correction

You may view and update your account information at any time through the Profile section of the app. You can also download a copy of your profile, garage, builds, and comments in the app under Settings → Privacy & data → Export my data.

Data Deletion

You can delete your account in the app under Settings → Privacy & data → Delete account. Deletion is permanent. When you confirm, we remove:

• Your account and sign-in, including any Sign in with Apple connection (we revoke it with Apple).
• Your profile, garage vehicles, builds, comments, "regrets," feature requests and votes, price alerts, saved builds, and push tokens.
• The feedback and vehicle suggestions you sent us.
• Every photo and avatar you uploaded.

We also ask PostHog to delete your analytics profile, event history, and any recordings tied to your account ID. PostHog processes these deletions on its own schedule, so it can take some time to finish. Analytics events recorded before you signed in are tied to a random device identifier rather than your account, and are not included.

If you can't use the app, you can request deletion by emailing support@spekforge.app. We will complete it within 30 days of a verified request.

CCPA Rights (California Residents)

If you are a California resident, you have the right to know what personal information we collect, request deletion of your data, and opt out of the sale of your personal information. SpekForge does not sell personal information.

GDPR Rights (EEA/UK Residents)

If you are located in the European Economic Area or United Kingdom, you have the right to access, correct, delete, and export your personal data, as well as the right to restrict or object to processing. To exercise these rights, contact us at support@spekforge.app.

07 — Children's Privacy

SpekForge is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with their information, please contact us immediately at support@spekforge.app and we will delete it promptly.

08 — Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this document and notify users through the app where required by law. Continued use of the app after changes constitutes acceptance of the updated policy.

09 — Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at: