Last updated: 4 September 2026
CarSnapper is operated by Yorkshire Web Solutions Limited (“we”, “us”), a company registered in England and Wales, company number 14893029, of 25 Norwood Drive, Sheffield, S5 7BH, United Kingdom.
We are the data controller for the personal data described below, and are registered with the Information Commissioner’s Office under reference ZC211046.
If you have any question about this policy or want to exercise your rights, contact icookedsupport@yorkshire-web-solutions.co.uk.
This policy explains what CarSnapper collects, why, who else sees it, and what you can do about it.
1. What we collect
1.1 Your photographs
When you photograph a car, or import a photograph from your library, the image is uploaded to our servers so it can be identified, and then stored as part of your collection.
Photographs are held in private storage. They are not public, not indexed, and not shared with other users.
1.2 Location — only if you allow it
Location is optional and CarSnapper works fully without it.
- Photographs you take in the app: if you grant location permission, we record the device’s position at the moment of capture, so the sighting can appear on your private map.
- Photographs you import from your library: we use only the location already embedded in that photograph’s own EXIF metadata, if it has any. We never substitute your current position for an imported photo, because an old photograph taken elsewhere would otherwise be placed wherever you happen to be standing today.
Your map is private to you.
1.3 An anonymous account identifier
On first launch the app creates an anonymous account — a random identifier with no email, password, phone number or name attached. It exists so your collection belongs to you rather than to the device’s storage generally.
1.4 A display name, if you set one
Optional, free text, and not shown to anyone else. CarSnapper has no social features, no public profiles and no way for other users to see you.
1.5 Progress and gameplay data
Your collected vehicles, experience points, level, challenge progress, badges and unlocked cosmetic items.
1.6 Recognition records
When a photograph is identified we keep a record of the request and the response, so that a mistaken identification can be investigated and corrected later.
1.7 Subscription status
If you subscribe, we store whether your subscription is active, which plan, which store, and when it expires. We never see or store your payment details. Those are handled entirely by Apple or Google.
1.8 Technical limits
We count requests per account to prevent abuse and runaway costs. These counters are not shown to you and are not used to profile you.
2. What we deliberately do NOT collect
This section is a commitment, not a description of the current version.
- No vehicle registration marks / number plates. We do not read, extract, transcribe or store them. Our database schema contains no field capable of holding one, and that absence is enforced by an automated test.
- No owner or keeper information. We do not look up who owns a vehicle and have no access to any such database.
- No faces or biometric data. No facial recognition is performed at any point.
- No advertising identifiers, no ad networks, no third-party analytics or tracking SDKs.
- No contacts, calendar, microphone, health or fitness data.
- No email address, password or phone number.
A photograph you take may incidentally contain a number plate or a passer-by, as any photograph might. We do not process or extract that information — but please be considerate about what you photograph, and see section 8.
3. Why we process it, and our lawful basis
| What | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Photographs | To identify the vehicle and build your collection | Performance of a contract (Art. 6(1)(b)) |
| Location | To place a sighting on your private map | Consent (Art. 6(1)(a)) — you may refuse or withdraw it |
| Anonymous identifier | To keep your collection yours | Performance of a contract |
| Progress data | To provide levels, challenges and rewards | Performance of a contract |
| Recognition records | To investigate and correct wrong identifications | Legitimate interests (Art. 6(1)(f)) — accuracy of the service |
| Subscription status | To provide the subscription you paid for | Performance of a contract |
| Rate-limit counters | To prevent abuse and protect service costs | Legitimate interests |
You can withdraw location consent at any time in your device settings. Doing so does not affect anything already collected, and does not stop the app working.
4. Who else processes your data
We use a small number of processors. We do not sell your data, and we do not share it for advertising.
Supabase Inc. — hosting, database, file storage and server functions. Your photographs, collection and account identifier are stored here. Region: EU (Ireland) — your data stays in the EU.
Google (Gemini API) — vehicle identification. Your photograph is sent to Google for analysis. Google processes it to return a description of the vehicle. We also send the resulting vehicle name as text so that specifications and rarity can be researched. Google does not receive your account identifier, your location, or any other information about you. Google’s API terms state that data submitted through the paid API is not used to train their models.
RevenueCat, Inc. — subscription management. Receives your anonymous account identifier and your subscription status. Receives no photographs and no location.
Apple and Google Play — payment processing, if you subscribe. They are independent controllers for the payment itself; we receive only the resulting subscription status.
Some of these providers are based outside the UK. Where personal data is transferred internationally, that transfer is covered by the providers’ Standard Contractual Clauses or equivalent safeguards.
5. How long we keep it
- Photographs and sightings: until you delete them, or until you delete your account.
- When you delete a sighting: the photograph and the exact coordinates are permanently deleted. A minimal record that a sighting existed is retained so your history and rewards remain consistent.
- When you delete your account: everything associated with it is permanently deleted, including all photographs.
- Inactive anonymous accounts: an account that has never recorded a sighting, has no subscription and has been inactive for more than 30 days may be removed automatically.
6. Your rights
Under UK GDPR you have the right to access, correct, delete, restrict or object to our processing of your personal data, and the right to data portability.
The quickest route is in the app: Settings → Delete my data. This is immediate and permanent.
For anything else, contact icookedsupport@yorkshire-web-solutions.co.uk. We will respond within one month.
Please note an important limitation. Because CarSnapper accounts are anonymous and tied to your device, we have no way to verify that a request relates to a particular account unless it is made from inside the app on that device. This protects you — it means nobody else can request your data either — but it does mean an emailed request may be impossible for us to action, and you should use the in-app option wherever possible.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. Our registration reference is ZC211046.
7. Security
Photographs and collections are stored in private storage, accessible only to your own account, enforced at the database level rather than by application code alone. All traffic between the app and our servers is encrypted in transit using TLS.
No system is perfectly secure, but we do not store payment details, passwords, or contact details, which materially limits what could be exposed.
8. Photographing vehicles responsibly
CarSnapper is for photographing vehicles in public. Please:
- respect people’s privacy and property, and do not photograph inside private land without permission;
- avoid deliberately photographing people;
- follow local law, which varies by country.
You are responsible for the photographs you take.
9. Children
CarSnapper is not directed at children under 13 and we do not knowingly collect data from them. If you believe a child has provided us with personal data, contact icookedsupport@yorkshire-web-solutions.co.uk and we will delete it.
10. Changes to this policy
If we change how we handle your data we will update this page and change the date at the top. Material changes will also be notified in the app.
11. Contact
Yorkshire Web Solutions Limited
25 Norwood Drive, Sheffield, S5 7BH, United Kingdom
icookedsupport@yorkshire-web-solutions.co.uk