Honest Mechanic Privacy Policy

Contacts

Support: support@honestmechanic.ai

Privacy and data deletion assistance: privacy@honestmechanic.ai

General contact: hello@honestmechanic.ai

Scope And Roles

This Policy applies to drivers and other app users. A separate Shop Privacy Notice covers repair-shop accounts and administration. When you choose to submit a case, HM discloses the selected case information to the chosen shop as described below. HM controls its own app, consent, AI, security, and service records. A shop separately controls how it uses information it receives for inspection, diagnosis, estimates, repairs, billing, warranties, recordkeeping, and its own legal obligations.

App Identity And Accounts

HM does not require an account with an email address and password. The app assigns an anonymous owner and uses a device-linked identity to connect scans, results, history, chats, reports, consent records, shop associations and cases, feature disclosures, and usage counters.

On compatible devices, reinstalling the app on the same physical device may recover the same anonymous owner when the protected device identity remains available. Recovery is not guaranteed between phones or after a device reset, loss of protected storage, or changes to platform-provided identifiers.

Information We Collect

• Anonymous owner id and settings: device-linked identity information, app language, local settings, legal-consent versions and hashes, feature-disclosure versions, timestamps, device/app metadata, and basic diagnostic logs.
• Vehicle and diagnostic data: VIN when needed; VIN masked or hashed where possible; make, model, year, and vehicle label when available; DTCs; readiness monitors; PID, freeze-frame, PrePurchase, and Guardian samples; diagnostic evidence; and scan/result history.
• Workflow and report data: Quick Scan, DTC-only, PrePurchase, Guardian, mechanic-report and result summaries, limitations, shareable report context, and identifiers used to retrieve a result.
• Chat and AI data: Help Chat and Result Chat messages and responses, conversation context, deterministic FAQ interactions, result or shop-case context supplied to chat, AI request type, timestamps, usage counters, token or cost metadata, and entitlement periods.
• Optional voice data: spoken input, transcription text, app response text, and processing metadata when you start a voice feature. HM does not activate the microphone merely because the app is open.
• Plan and purchase data: plan id, access periods, quota and usage status, and store purchase, product, transaction, and entitlement identifiers. The Free plan is permanently available at no charge and is not a trial. Optional purchases are processed by app store services. HM does not receive or store your payment card details.
• Support, security, and correction data: communications with HM, reported errors, correction requests, ratings, feedback, security events, and records needed to investigate abuse, disputes, or service reliability.
• Shop or partner request data: business and contact information submitted through shop registration or early-access forms, including shop name, contact name, email, phone, city, state, country, website, and message.

Shop Connections And Case Data

When you scan or open a shop referral, HM may record the referral code, shop, platform, first and last interaction times, and association status. Repeating the same association may update the existing record rather than create a duplicate.

When you affirmatively submit a result to a selected shop, HM may process and disclose the selected result; case reference; finding summary; report link or identifier; vehicle label, year, make, model, and masked VIN where available; name, phone, email, preferred contact method, or appointment preferences you provide; consent timestamp; and case-status information intended for you or the shop.

The shop may add events, notes, estimates, work orders, invoices, photographs, other documents, completion information, and correction records. HM may create a public case status, notification, evidence summary, owner evaluation, and follow-up-verification record. Internal shop notes, administrative priority, credentials, security information, and storage secrets are not intended for display to the driver. Your private app chats are not shared with a shop unless the product clearly identifies them as part of information you choose to submit.

When the shop marks the work complete, HM may associate eligible case events, documents, owner feedback, and a sufficiently grounded evidence summary with the authorized history for that vehicle. HM retains provenance labels that distinguish information documented by the shop, reported by the owner, observed or explained by HM, and inferred by HM. Case closure or the shop later leaving the program does not automatically remove that history entry, but the entry remains subject to this Policy, HM deletion controls, applicable rights, and lawful retention exceptions.

HM does not automatically disclose that history to another shop. In a future case, HM discloses prior history to a different shop only after you select that shop and affirmatively authorize the information identified in the new handoff flow.

Permissions And Feature Data

OBD-II, Bluetooth, and nearby devices: we use Bluetooth or nearby-device permissions to find and connect your OBD-II adapter. Nearby adapter discovery may require location permission on some devices. HM uses location permission only for adapter discovery, not for GPS tracking.

Microphone/voice: we use the microphone only when you start voice chat or another voice feature, to transcribe your question and answer in the app. Spoken input may be processed by HM services or AI generation, transcription, or speech providers depending on the selected mode.

Notifications: if you allow notifications, HM may register a device push token and deliver important service, security, purchase, or shop-case updates. Disabling notifications does not prevent you from viewing available information inside the app.

Guardian: Guardian monitors vehicle signals while active and the adapter remains connected. It may save session context, critical events, samples, and diagnostic evidence. Guardian does not replace attentive driving.

How We Use Information

• Create scans, results, vehicle history, reports, explanations, and shop cases requested by you.
• Connect you with a selected shop, preserve consent, deliver the selected case, support contact or appointment coordination, show simplified public case stages, and maintain an authorized durable case and vehicle history.
• Receive shop documents, extract structured information, prepare and publish a repair-evidence summary, answer case questions, support corrections, and record your evaluation or follow-up verification.
• Support Quick Scan, DTC-only, PrePurchase, Guardian, Help Chat, Result Chat, deterministic FAQ, optional voice, notifications, and AI-assisted explanations.
• Operate app access, plans, purchases, entitlements, quotas, support, security, abuse prevention, diagnostics, accounting, and reliability improvements.
• Meet legal obligations, enforce terms, protect users and shops, investigate incidents, and establish or defend legal claims.

How We Disclose Information

Selected shops: we disclose only the case and related information described in the sharing flow and this Policy after your affirmative action. A shop may retain information already received as needed for service, warranty, accounting, safety, dispute, or legal obligations even if you later disconnect it in HM.

A different shop does not receive your prior case or vehicle history merely because it is connected to you. It receives only the information identified in a new handoff flow after your new affirmative action.

Service providers: we disclose information as needed to providers that operate hosting, API and database infrastructure, private document storage, AI generation and document analysis, transcription or speech processing when used, error monitoring and logging, email, push notifications, purchase and entitlement management, customer support, security, and app store services. Current providers may include OpenAI for applicable AI processing, Sentry for privacy-filtered error monitoring, Resend for operational email, Expo and platform services for notifications, RevenueCat and app store services for purchase and entitlement operations, and hosting or database providers.

Legal and business purposes: we may disclose information when reasonably necessary to comply with law, lawful process, safety obligations, prevent fraud or abuse, protect rights, investigate incidents, or complete a financing, merger, reorganization, or sale subject to appropriate safeguards.

We require providers to process information for the contracted service and apply protections appropriate to their role. Provider availability, locations, and subprocessors can change. We do not promise that information sent to a provider is subject only to HM's policies; the provider's applicable contractual and privacy terms also govern its processing.

AI And Automated Processing

HM may send the minimum reasonably necessary result, chat, transcription, or eligible shop-document content to an AI service to generate an explanation, extraction, translation, or repair-evidence summary. Outputs may be reviewed automatically against product rules, attributed to their source, corrected, regenerated, or withheld when the system cannot publish a sufficiently grounded summary.

HM does not use a shop invoice or AI inference as automatic proof that a repair succeeded. HM does not authorize the use of case information for unrelated advertising. We do not state that a provider never retains or uses submitted data beyond processing unless the applicable contract and configuration support that statement.

Website Analytics And Cookies

On the public HM website, we use Google Analytics only after you choose to allow analytics. Before that choice, the Google Analytics tag is not loaded and analytics cookies are not set.

When allowed, website analytics may collect page path and title, campaign parameters, approximate location, browser and device information, and activity such as page views and clicks on app-store, social, or contact links. We do not send OBD-II data, VINs, app chat content, form contents, shop-case documents, or precise GPS location to Google Analytics. Advertising storage, advertising user data, and ad personalization remain disabled. You can change your choice using Analytics choices in the website footer.

No Sale And No Shop Marketing By Default

We do not sell personal or sensitive user data. We do not share it for cross-context behavioral advertising. Connecting to or submitting a case to a shop does not by itself authorize that shop or HM to use your information for unrelated marketing. A separate opt-in is required where marketing consent is required by law.

We may use aggregated or de-identified information that is not reasonably intended to identify you to understand reliability and product use. We will not attempt to re-identify information treated as de-identified except to test whether de-identification protections work.

Retention

We retain information only for as long as reasonably necessary for the purposes described here, considering the duration of your use, an active shop case, warranties or disputes, security and fraud risk, purchase restoration, accounting, legal obligations, and the need to establish or defend claims. Different categories therefore have different retention periods.

Active scans, results, reports, chats, shop associations, cases, documents, consent records, evaluations, and AI summaries may remain while needed to provide history and the requested service. Security, fraud, transaction, accounting, acceptance, correction, and deletion records may remain longer where reasonably necessary or legally required. When information is no longer needed, we delete or de-identify it according to operational processes. Backups may retain protected copies for a limited recovery cycle before deletion is propagated.

Eligible completed-case history may remain after case closure or after the shop leaves the program so the owner can understand prior work, subject to deletion rights and lawful exceptions. Provenance or summary corrections may preserve the prior record and add a version, annotation, or later event when needed for integrity or audit.

Account Deletion And Shop-Case Records

You can delete your account and associated data directly in the app. In Account, select Delete account and data, then confirm. This is the primary deletion method and does not require email. If you cannot access the app or need assistance, email privacy@honestmechanic.ai and include your anonymous user id from Account when available. The durable identity system does not prevent you from deleting your account in the app.

Deletion covers stored scan, result, chat, report, AI-usage, shop-association, user-owned case, and app metadata linked to that anonymous owner where technically possible, including deletion of private case-document storage controlled solely by HM. Certain purchase, transaction, entitlement, accounting, consent, security, fraud-prevention, correction, dispute, and legal-compliance records may be retained when reasonably necessary or legally required. A shop may independently retain documents or service records it received or created under its own legal obligations; HM cannot use app deletion to erase copies controlled by that shop. Where appropriate, HM may restrict, de-identify, or minimize retained records instead of deleting evidence another party is legally entitled or required to keep.

Privacy Choices And Requests

Depending on your location, you may have rights to request access, correction, deletion, or a portable copy; to know categories of information and recipients; to withdraw consent for future optional processing; to opt out of sale, sharing, targeted advertising, or certain profiling; to limit certain sensitive-data uses; and to appeal a denied request without discrimination.

Use the controls available in the app or contact privacy@honestmechanic.ai. We may verify the request using the anonymous owner id, device-linked proof, transaction or case information, or other proportionate information. An authorized agent may submit a request where law permits, subject to verification. We will respond within the period required by applicable law. HM does not currently sell data or use it for cross-context behavioral advertising, so an opt-out request will be recorded but may not change current processing.

Security And Incidents

We use reasonable technical and organizational measures designed for the nature of the information, including HTTPS for production traffic, server-side secret handling, access controls, hashed credentials or tokens where applicable, private document access, and logging practices intended to avoid raw VINs where possible, raw secrets, payment fields, and unnecessary raw user text. HM does not receive or store payment card details entered through app store services.

No system is completely secure. If we identify a qualifying security incident, we will investigate, contain it, work with affected providers or shops, and provide notices required by applicable law. Contact support@honestmechanic.ai immediately if you suspect unauthorized access or disclosure.

Processing Location

HM is based in the United States. Information may be processed in the United States or other locations where service providers operate. Those locations may have different data-protection laws. Where required, HM uses legally recognized transfer safeguards.

Children And Minors

HM is not intended for children. Do not use the app if you are not old enough to operate a vehicle or legally consent to these terms in your location. We do not knowingly collect information from children. Contact privacy@honestmechanic.ai if you believe a child submitted information.

Changes To This Policy

We may update this Policy to reflect product, legal, or operational changes. When a material required version changes, the app may explain that the policy was updated and require acceptance before continued use. HM may record the policy version, cryptographic hash, language, owner identifier, and acceptance time. Material changes made after publication require a new version.