Privacy Policy

Introduction

Car Lease Tracker ("the app") is published by CurlyByte Solutions ("we", "us", "our"). This Privacy Policy explains how we handle information when you use the iOS app, including optional premium vehicle connection features.

Data controller: CurlyByte Solutions — contact details are listed at the end of this policy.

Use of the app is also subject to the Car Lease Tracker App Terms of Use, including the conditions and availability limitations for optional third-party vehicle connections.

Local data (default use)

Without enabling a vehicle connection, the app stores your lease data locally on your device using Apple’s SwiftData framework:

• Lease details (vehicle model, contract dates, mileage limits)
• Odometer logs and special trips
• Usage statistics derived from your entries

This core data is not uploaded to our servers unless you explicitly use an optional connection feature described below. You can delete local data in the app settings or by removing the app from your device.

Auto-sync connections (optional)

You may optionally connect a vehicle to import odometer readings automatically. You can disconnect at any time in the app. Each provider works differently:

Smartcar

Smartcar does not require a premium subscription.

• You supply your own Smartcar API credentials.
• Credentials and tokens are stored in the iOS Keychain on your device.
• The app communicates directly with Smartcar; we do not operate a backend for Smartcar.
• Data typically accessed: vehicle identifiers, make/model/year, odometer.
• Smartcar’s terms and privacy policy apply to their service.

Toyota (Europe, premium)

Requires an active premium subscription.

• Available for supported Toyota accounts in Europe only.
• Your Toyota email/password and session tokens are stored in the iOS Keychain on your device.
• The app communicates directly with Toyota services; we do not receive your Toyota password.
• Data typically accessed: vehicle VIN, display name, odometer, fuel or battery level, range, charging state, and supported read-only vehicle status fields.

Audi (Europe, premium beta)

• Sign-in uses browser approval with Audi. The app does not receive or store your Audi account password.
• OAuth access, refresh, and identity tokens are stored in the iOS Keychain on your device after a vehicle connection is completed.
• The app communicates directly with Audi and Volkswagen Group identity and vehicle services; we do not proxy or retain this traffic.
• Data typically accessed: vehicle identifiers, VIN, display name, odometer, and supported read-only status fields.

Škoda (Europe, premium beta)

• Your Škoda account email/password and resulting tokens are stored in the iOS Keychain on your device only after the selected vehicle connection is validated.
• Credentials are submitted only to approved Volkswagen Group identity hosts over HTTPS. We do not receive them on our servers.
• The app communicates directly with Volkswagen Group identity and native MyŠkoda vehicle services.
• Data typically accessed: vehicle identifiers, VIN, nickname or display name, model, odometer, and supported read-only status fields.

Volkswagen Europe (premium beta)

• Sign-in uses browser approval for the Volkswagen EU Data Act portal. The app does not receive or store your Volkswagen account password.
• OAuth tokens are stored in the iOS Keychain on your device. Portal cookies are not persisted.
• With your authorization, the app may identify or create the portal's free recurring data request and download Data Act delivery archives directly from Volkswagen services.
• Data typically accessed: VIN, portal request identifiers, odometer, battery level, range, charging state, lock state, and timestamps contained in supported read-only deliveries.

Volkswagen Canada (premium beta)

• Your Canadian myVW email/password, S-PIN, OAuth tokens, user identifier, and VIN-to-vehicle identifier mapping are stored in the iOS Keychain on your device after connection validation.
• Credentials and S-PIN proofs are submitted directly to approved Volkswagen Group identity and Canadian vehicle-service hosts over HTTPS; we do not receive them on our servers.
• Short-lived vehicle-session tokens are kept in memory and are not persisted.
• Data typically accessed: vehicle identifiers, VIN, nickname, model, odometer, and supported read-only status fields. Volkswagen United States connection is currently unavailable.

For direct manufacturer connections, processing is initiated at your request to provide the optional connection feature. You can stop future access by disconnecting in the app and, where supported, revoking authorization in the manufacturer account. Imported readings already saved in your local lease history remain until you delete them. The relevant manufacturer and Volkswagen Group identity services process information under their own terms and privacy notices.

Install Attribution (AppsFlyer)

On iOS, Car Lease Tracker uses AppsFlyer, a third-party mobile attribution service, only to determine whether an installation resulted from one of our advertising campaigns on services such as X Ads, Meta Ads, Google Ads, TikTok, or Snapchat.

The app sends one install/first-launch request to AppsFlyer. After AppsFlyer confirms that request, Car Lease Tracker stops the AppsFlyer SDK. We do not send later app sessions, purchases, subscriptions, lease details, odometer logs, trips, expenses, vehicle connection data, or custom in-app activity to AppsFlyer.

For install attribution, AppsFlyer may collect and process:

• Device identifiers (for example, IDFV and an AppsFlyer install identifier called AF ID)
• The advertising identifier (IDFA) only if you authorize tracking through Apple’s App Tracking Transparency prompt
• The install and first-launch request
• Technical device information (for example, operating system, device type, language, screen size)
• Network information (for example, IP address)
• Limited performance signals used for request delivery and fraud prevention

This data is transmitted to AppsFlyer and may be linked to your device for advertising measurement. AppsFlyer may send an install postback to the advertising partner that delivered or participated in the campaign. AppsFlyer’s processing is described in its Privacy Policy.

App Tracking Transparency: After the app’s main interface appears, Car Lease Tracker may display Apple’s tracking-permission prompt. If you authorize tracking, AppsFlyer may use the IDFA for deterministic install attribution. If you deny permission or Apple restricts tracking, AppsFlyer is configured to anonymize the install request and no IDFA is available; Apple, AppsFlyer, and participating ad networks may still provide aggregate or modeled installation attribution using privacy-preserving systems such as SKAdNetwork or AdAttributionKit.

Your choice: You can use every Car Lease Tracker feature regardless of your Apple tracking-permission decision. Car Lease Tracker does not present a separate consent gate or store an additional app-specific tracking choice. You can manage Apple tracking permissions in iOS Settings after the system prompt has been shown.

Legal basis: Where applicable, device-level advertising measurement is based on your consent. Aggregate measurement and the limited processing needed to deliver, secure, and prevent fraud in the install request are handled as permitted by applicable law. Contact us if you wish to exercise privacy rights relating to this processing.

Subscriptions

Premium features, including direct Toyota, Tesla, Audi, Škoda, and Volkswagen connections, require an active App Store subscription processed by Apple. We do not receive your payment card details. Apple’s privacy policy applies to purchase data.

Your rights

If you are in the European Economic Area or another jurisdiction with similar laws, you may have the right to access, rectify, erase, restrict, or object to processing of your personal data, and to data portability, where applicable. You may also lodge a complaint with your local supervisory authority.

To exercise these rights, contact us using the details below. Because most data is stored on your device, you can also delete it directly in the app.

Children

The app is not directed at children under 16. We do not knowingly collect personal data from children.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

Contact Us

If you have any questions about this Privacy Policy, please contact us at: