Privacy Policy
Last updated: July 13, 2026
Controller: NXT MVMT LLC, 8735 Dunwoody Pl, Ste N, Atlanta, GA 30350 (“RedlineAi,” “we”).
1. What we collect
- Account data: email address and authentication identifiers (Google sign-in or email/password), managed by Supabase Auth. Passwords are hashed; we never see or store them in plain text.
- Vehicle & diagnostic data: vehicle year/make/model/engine, VIN when you provide or scan one, mileage, symptom descriptions, OBD trouble codes, live OBD sensor readings and freeze-frame data from the OBD reader, guided-question answers, and the diagnoses generated for you.
- Photos you attach (e.g. a VIN plate, a part, a dash light) — processed by the AI to help diagnose; stored with the diagnosis record.
- Purchase data: plan/tier, credits, and subscription status. Card numbers are handled by Stripe (web) or by Apple/Google (apps) — we store only customer references and entitlement status, never card numbers.
- Usage analytics: product events (e.g. “diagnosis created”), device/browser type, and a pseudonymous or account identifier, via PostHog.
- Approximate location: your U.S. state only if you select it for the repair-cost feature. The “find shops near you” button uses your device’s location transiently in your browser to open a Google Maps search — we do not receive or store those coordinates.
- Operational logs: an audit log of key actions; IP addresses are stored only as a salted hash, never raw.
- Push tokens (if you enable notifications in the app).
- Consent records: the Terms version you accepted and when.
2. How we use it
To generate diagnoses and repair guidance; enforce plan limits and prevent abuse; process purchases and entitlements; send notifications you enable; improve diagnostic quality using anonymized, aggregated outcomes; measure and improve the product (analytics); and provide support.
3. AI processing
Your vehicle details, symptom text, OBD data, and attached photos are sent to Anthropic (the AI model provider) to produce diagnoses. Under Anthropic’s commercial API terms, API inputs and outputs are not used to train their models. Avoid putting personal identifiers (names, addresses, plate numbers) in free-text fields or photos — they are not needed for a diagnosis.
4. Who processes your data
Service providers acting on our instructions: Supabase (database + authentication), Vercel (hosting), Anthropic (AI diagnosis), Stripe (web payments), RevenueCat and Apple/Google (app subscriptions), PostHog (analytics), and Google (OAuth sign-in; YouTube search for repair videos). Vehicle lookups (VIN decode, recalls, complaints) query the U.S. NHTSA’s public APIs — the vehicle identity you enter is sent to NHTSA to perform the lookup. We do not sell your personal data, and we do not share it for cross-context behavioral advertising.
5. Cookies and similar tech
We use cookies for authentication/session (including your “Remember me” choice, which controls whether the session persists after the browser closes) and analytics. We do not run third-party advertising cookies.
6. Retention & deletion
Diagnostic and account data is retained while your account is active. Vehicles you delete are soft-deleted, then purged. You can delete individual diagnoses in the app. To delete your account and associated personal data, contact redlineaiteam@gmail.com — we will complete deletion within 30 days except where retention is legally required (e.g. purchase records).
7. Your rights
Depending on where you live (GDPR/UK GDPR, CCPA/CPRA and similar laws), you may have the right to access, correct, delete, or export your personal data, to object to or restrict processing, and to not be discriminated against for exercising these rights. California residents: we do not “sell” or “share” personal information as defined by the CCPA/CPRA. To exercise any right, contact redlineaiteam@gmail.com; we will verify the request via your account email. EU/UK users: our legal bases are contract (providing the Service), legitimate interests (security, product improvement), and consent where required; you may lodge a complaint with your supervisory authority.
8. Children
The Service is not directed to children under 13 (16 in the EEA/UK), and we do not knowingly collect their data. Accounts require users to be 18+ per the Terms of Service.
9. International transfers
We operate from the United States; data is processed in the U.S. by the providers listed above. Where required, transfers rely on appropriate safeguards (e.g. Standard Contractual Clauses via our processors).
10. Security
Data is encrypted in transit; access is restricted by row-level security and role-based access. No system is perfectly secure — if a breach affecting your personal data occurs, we will notify you as required by law.
11. Changes & contact
Material changes will be announced in-app or by email, and the “Last updated” date always reflects the current version. Contact: NXT MVMT LLC, 8735 Dunwoody Pl, Ste N, Atlanta, GA 30350 · redlineaiteam@gmail.com · or the in-app support channel.