Last updated Tue Aug 04
PRIVACY POLICY
Last updated: 4 August 2026
This policy explains what Carma collects, why, who it is shared with, and what control you have. Carma is provided by Kareem Esam Eldin Salah, an individual developer based in Egypt ("we", "us"). Contact: support@appcarma.com
1. WHAT WE COLLECT
Account information. Your email address and password (stored only as a salted hash, never in readable form), and the display name you enter in English and Arabic. If you sign in with Apple or Google, we receive your email address and name from them instead of a password. If you use Sign in with Apple's "Hide My Email", we only ever see the relay address Apple gives us.
Profile photo. Optional. Only if you upload one.
Vehicle information. The cars you add: make, model, year, nickname, licence plate, purchase date, and odometer readings you enter over time.
Maintenance records. Service history, parts you track, warranty start and expiry dates, intervals you override, and any notes you write.
Documents you upload. Photographs or scans of vehicle paperwork: driver licences, vehicle licences, insurance policies, inspection certificates, invoices, and warranty cards. These may contain personal information beyond your own, including names, licence numbers and expiry dates. Please see section 4, which explains how document scanning works, before uploading anything you are not comfortable sharing.
Camera and photo library. With your permission, Carma uses your camera to photograph a document and your photo library to attach one you already have. We access these only at the moment you choose to add a photo, and only the image you select is sent to us. You can refuse or revoke either permission in iOS Settings, and every field can still be entered by hand.
Subscription status. Whether you are on Free or Pro, when your period renews, and which store the purchase came from. We never receive or store your card number or payment details — Apple handles payment entirely.
Notification tokens. If you enable notifications, a device token so we can send maintenance reminders.
Technical information. Basic request data such as IP address and app version, used for security, abuse prevention and diagnosing errors.
Support messages. Anything you send us through Report a Bug or Request a Feature.
What we do NOT collect: we do not use any analytics or tracking SDK, we do not use the advertising identifier (IDFA), we do not build advertising profiles, we do not track you across other apps or websites, and we do not sell your data to anyone.
2. WHY WE USE IT
To create and secure your account and sign you in.
To store and display your garage, service history, documents and warranties.
To calculate maintenance schedules and send you reminders.
To read your documents when you ask us to scan one (section 4).
To operate subscriptions and confirm what your plan gives you access to.
To answer your support messages.
To keep the service secure, prevent abuse, and fix problems.
To comply with legal obligations.
3. LEGAL BASES (for users in the EU, EEA and UK)
Performance of a contract — running your account, storing your records, providing subscription features.
Consent — notifications, document scanning, and access to your camera and photo library. You may withdraw consent at any time by turning notifications off, by revoking the camera or photo permission in iOS Settings, or by not using the scan feature.
Legitimate interests — security, abuse prevention, and improving the service.
Legal obligation — where the law requires us to retain or disclose information.
4. DOCUMENT SCANNING — PLEASE READ
Carma offers an optional feature that reads a photograph of a vehicle document and fills in the fields for you.
When, and only when, you choose to scan a document, the image is uploaded to our own server, which forwards it to Google's Gemini API for automated text extraction. Google processes the image and returns the extracted fields, which our server passes back to the app. Depending on the document type, the extracted fields may include the holder's name, the licence or policy number, and an expiry date.
This means an image of your driver's licence or vehicle licence leaves our systems and is processed by Google. Google's handling of that data is governed by their own terms and privacy policy. We use the paid Gemini API tier, under which Google does not use content submitted through the API to train its models.
You are never required to use this feature. You can add every document and every field manually, and the document will then stay within our own storage and never be sent to Google.
Please do not upload documents belonging to other people unless you have their permission.
5. WHO WE SHARE INFORMATION WITH
We do not sell your personal information. We share it only with the service providers we need to operate Carma:
Supabase — hosts our database and stores your uploaded documents and photos.
Railway — hosts our servers.
Google (Gemini API) — processes document images, only when you use the scan feature (section 4).
Google Sign-In and Apple Sign In — only if you choose to sign in that way.
RevenueCat — manages subscription and entitlement status.
Apple App Store — processes all payments. We never see your payment details.
Apple Push Notification service — delivers reminders to your iPhone or iPad. Apple receives the device token and the notification, not your records.
Expo — operates the push notification service that hands reminders to Apple, and delivers app updates.
Firebase Cloud Messaging — delivers notifications to browsers, and is used only if you access Carma on the web.
Our email provider — sends account emails such as verification and password reset.
We may also disclose information where we are legally required to, or to protect our rights, safety, or the safety of others.
Promotions shown inside Carma are served by us from our own systems. They are not supplied by an advertising network, they do not use tracking identifiers, and no personal information is shared with any advertiser. If you tap a promotion, you leave the app and the destination site's own policies apply.
6. INTERNATIONAL TRANSFERS
Our service providers operate servers outside Egypt, including in the European Union and the United States. Using Carma means your information may be transferred to and processed in those countries. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
7. HOW LONG WE KEEP IT
We keep your information for as long as your account exists. When you delete your account, we delete your account record, vehicles, service history, documents and uploaded files. Backups are overwritten on a rolling basis and any residual copies are removed within 30 days. We may retain limited records for longer where the law requires it.
8. YOUR RIGHTS
You can access and correct most of your information directly in the app.
You can delete your account and all associated data at any time: Settings, then Profile, then Delete account. This is immediate and permanent. Deleting your account does not cancel an active subscription — you must cancel that separately through your Apple Account settings.
Depending on where you live, you may also have the right to request a copy of your data, to object to or restrict processing, to withdraw consent, and to lodge a complaint with your data protection authority. Write to support@appcarma.com and we will respond within 30 days.
9. SECURITY
All traffic between the app and our servers uses encrypted HTTPS connections. Passwords are stored only as salted hashes. Uploaded documents are held in private storage and served through short-lived signed links that expire. Access to production systems is restricted.
No system is completely secure. Please use a strong, unique password and keep your device locked.
10. CHILDREN
Carma is not intended for children under 16, and we do not knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.
11. CHANGES
We may update this policy. The date at the top shows the most recent revision. Significant changes will be notified in the app.
12. CONTACT
support@appcarma.com
Kareem Esam Eldin Salah
Egypt