This Privacy Policy explains what personal data the caracheck mobile application and the caracheck.com website collect, why it is processed, how long it is kept, with whom it is shared, and what rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and other applicable European Union and Czech privacy laws.
Please read this policy carefully. If anything is unclear, contact us using the details below before installing or using the app.
1. Data controller
The data controller responsible for processing your personal data is:
Petr Nejedlý, sole trader (OSVČ), registered in the Czech Trade Licensing Register
IČO: 88085562
Registered address: Sokolská 234, 251 69 Velké Popovice, Czech Republic
Controller contact: petr@petrnejedly.cz
Support contact: support@caracheck.com
We have not appointed a Data Protection Officer because we are not required to do so under Article 37 GDPR.
2. Scope
This policy covers the caracheck Android mobile application (the "App") distributed via Google Play and the caracheck.com website (the "Website"). It does not cover third-party services that you may reach via outbound links; those are governed by their own privacy policies.
The App is also distributed for iOS via the Apple App Store; this policy applies equally to that distribution.
3. Data that stays on your device
The following information is stored locally on your device only and is never transmitted to a server controlled by us:
- Vehicles, models, variants and equipment you save
- Checklists, packing and restocking lists, and the items you check off
- Weight calculations and the inputs you provide
- App preferences such as theme, language, units and notification settings
4. Personal data we and our processors collect
We minimise the personal data we process. The categories below are limited to what is strictly necessary to deliver, secure and improve the service.
On iOS, the equivalent App Store purchase token is processed by RevenueCat instead of the Google Play token; the categories, legal basis and retention are otherwise identical.
- Subscription data (RevenueCat, Inc., USA) — when you start, change or cancel a Pro subscription, RevenueCat receives a randomly generated pseudonymous App User ID, your subscription status, the Google Play purchase token, country and approximate price. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Retention: for the duration of the subscription plus the period required by Czech accounting and tax law (up to 10 years for invoicing records).
- Advertising data (Google Ireland Ltd / Google LLC — "AdMob") — if you grant consent through the in-app consent dialog, AdMob processes your device's advertising ID (AAID), coarse IP address, ad interaction events and limited device information to deliver and measure ads. If you refuse consent or live in the EEA/UK without granting consent, only non-personalised ads are shown and the AAID is not used for personalisation; limited information is still processed for frequency capping, fraud prevention and aggregated reporting. Legal basis: your consent (Art. 6(1)(a) GDPR and §89 of the Czech Act No. 127/2005 Coll. on Electronic Communications, transposing the ePrivacy Directive). Retention: as defined in Google's policies. You can withdraw or change your choice at any time in Settings → Privacy → Manage ad consent.
- App distribution and crash diagnostics (Google Play / Google Ireland Ltd) — Google Play processes installation, update and aggregate crash data to operate the distribution platform. We receive only aggregated, non-identifying statistics through the Play Console. Legal basis: legitimate interest in maintaining a stable service (Art. 6(1)(f) GDPR). Retention: as defined by Google.
- Support correspondence — if you email us, we process your email address and the contents of your message in order to reply. Legal basis: legitimate interest in providing user support (Art. 6(1)(f) GDPR). Retention: up to 24 months after the last message, unless a longer period is required to defend legal claims.
- Server access logs (Website / CDN) — our content delivery network (Amazon CloudFront) creates short-lived edge access logs containing truncated IP address, user agent, request path and timestamp. Legal basis: legitimate interest in security, abuse prevention and service operation (Art. 6(1)(f) GDPR). Retention: up to 30 days, then automatically deleted.
- App distribution and crash diagnostics (Apple App Store / Apple Distribution International Ltd, Ireland) — App Store Connect processes installation, update and aggregate crash data to operate the distribution platform. We receive only aggregated, non-identifying statistics. Legal basis: legitimate interest in maintaining a stable service (Art. 6(1)(f) GDPR). Retention: as defined by Apple.
5. Cookies and similar technologies on the Website
The caracheck.com Website does not use analytics cookies, third-party trackers, advertising tags, social-media pixels or any other non-essential storage. Only strictly necessary technical storage required to render the page (for example, your selected language) is used. Because no consent-requiring storage is set, no cookie banner is displayed.
6. Advertising and consent in the App
Within the EEA, United Kingdom and Switzerland, the App uses a Google-certified Consent Management Platform (CMP) to obtain your consent before any personalised advertising or non-essential tracking takes place, in line with Google's EU User Consent Policy and Article 5(3) of the ePrivacy Directive.
You can review or change your choice at any time from Settings → Privacy → Manage ad consent. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
You can also reset or delete your advertising identifier in your Android system settings under Settings → Privacy → Ads.
On iOS, before any cross-app advertising identifier (IDFA) is used for personalised ads, the App requests App Tracking Transparency permission as required by Apple. If you decline, the IDFA is not used and only non-personalised ads are shown. You can review or change your decision at any time under Settings → Privacy & Security → Tracking, and reset or limit your Apple advertising identifier under Settings → Privacy & Security → Apple Advertising.
7. Recipients and international transfers
We do not sell your personal data. We share it only with the processors listed above, who act on our documented instructions under Article 28 GDPR data-processing agreements:
- RevenueCat, Inc. (USA) — subscription management
- Google Ireland Ltd / Google LLC (Ireland / USA) — Google Play distribution and AdMob ad serving
- Amazon Web Services EMEA SARL (Luxembourg) — Website and CDN hosting
- Apple Distribution International Ltd (Ireland) — Apple App Store distribution and App Store Connect analytics
Where personal data is transferred to recipients outside the European Economic Area (notably to the United States), the transfer is protected by the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) and, where applicable, the EU–U.S. Data Privacy Framework adequacy decision of 10 July 2023. A copy of the safeguards in place can be obtained from the controller using the contact details above.
8. Automated decision-making and profiling
We do not carry out automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR. AdMob may perform limited profiling for ad selection only when you have granted consent (see Section 6).
9. Children
The App and Website are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it without undue delay.
10. Security
We use industry-standard technical and organisational measures including TLS encryption in transit, principle of least privilege for processor access, isolated production environments and on-device storage for content you generate. No method of electronic transmission or storage is fully secure; we cannot guarantee absolute security.
11. Your rights under the GDPR
Subject to the conditions in the GDPR, you have the right to:
- Access your personal data and obtain a copy (Art. 15)
- Rectify inaccurate or incomplete data (Art. 16)
- Erase your personal data (Art. 17, "right to be forgotten")
- Restrict processing in defined circumstances (Art. 18)
- Receive the data you provided in a portable format (Art. 20)
- Object to processing based on legitimate interests, including direct marketing (Art. 21)
- Withdraw consent at any time, without affecting prior lawful processing (Art. 7(3))
- Not be subject to a decision based solely on automated processing (Art. 22)
To exercise any of these rights, email petr@petrnejedly.cz or support@caracheck.com. We will respond within one month under Article 12(3) GDPR. Most local data can be deleted directly by you by clearing the App's storage or uninstalling the App.
You also have the right to lodge a complaint with a supervisory authority. The competent authority for the controller is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz. You may also contact the supervisory authority of your habitual residence.
12. Changes to this policy
We may update this Privacy Policy to reflect changes to the service or to legal requirements. Material changes will be announced in the App and on the Website. The "Last updated" date at the top of this page always reflects the current version.
13. Contact
Controller: Petr Nejedlý, IČO 88085562, Sokolská 234, 251 69 Velké Popovice, Czech Republic
Email: petr@petrnejedly.cz or support@caracheck.com