Privacy Policy

Who we are

SiftCar ("we", "us") provides a mobile app that analyzes used-car listings and photos to help buyers assess scam risk, condition, price, and negotiation options, and a free browser check on this website that runs a preview of the same listing analysis. This policy covers both. It explains what data we collect, who we send it to, how long we keep it, and what you can ask us to do with it. We are the data controller for that data.

Data we collect

• Account identifiers.In the app, an anonymous device account is created so you can run checks without signing up. If you sign in with Google or with Apple — in the app, or on this website to use the browser check — we store the provider-linked user id, your email address (a private relay address if you hide yours from Apple), and your name if the provider shares it. It is one account either way: signing in on the website and in the app with the same provider reaches the same SiftCar account. We also store your device's language and region setting so prices and formats are right.
• Photos and listing input.Photos you upload, listing URLs you paste, VINs, license plates, prices, mileage, and other details you enter. When you paste a link we also store a snapshot of what the listing page said, including the seller's description.
• Reports and garage history. Generated reports, bookmarks, price watches, and related preferences.
• Purchases. Subscription, pass, credit, and title-check status via Apple and RevenueCat. We never receive your card number.
• Push notification token. If you allow notifications — which we only ask for after you set up a price watch — we store the push token for that device and whether it is iOS or Android, so we can tell you when a watched price drops or a listing disappears.
• Website browser check.The free check at siftcar.com/check requires signing in with Google or Apple, and runs against that account. We store the listing URL you paste, and we record that the account's one free browser check has been used — that record is permanent for the life of the account, because the free check does not renew. It is kept while the account exists and deleted when you delete the account. The pasted URL is sent to the same listing-reading services the app uses (Bright Data, Jina, and Google's Gemini models) so the page can be read.
• Waitlist email. If you join the waitlist on this website, we store the email address you gave us so we can tell you when the app launches. It is used for nothing else, and it is not linked to an app account.
• Diagnostics. Server logs needed to run and debug the service. When a listing fails to read, we record the URL, the failure reason, and your account id for 30 days so we can fix the extractor. If the app crashes, or if something fails on our servers while your check runs, a report goes to Sentry carrying your account id and the id of the check that failed. Listing links, listing text, photo links and email addresses are removed from those reports before they are sent.

We do not use any advertising or product-analytics SDK, we do not track you across other apps and websites, and we therefore never show the iOS tracking permission prompt. We do not collect your precise location, contacts, or advertising identifier.

How we use data

• To generate your car check report, including AI analysis of your photos.
• To look up public or licensed vehicle data — recalls, VIN decodes, market comps, and for paid US and Canadian checks the NMVTIS title, odometer, lien and theft records.
• To enforce free-check limits, subscriptions, passes, and credits.
• To send the price-drop and listing-gone alerts you asked for.
• To keep the service reliable, debug failures, and prevent abuse.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use your photos for advertising. We do not use your photos or reports to train our own AI models.

Who we send data to

Running a check means asking other services questions about the car. They act as our processors and may only use what they receive to answer us. Most of them get nothing but a VIN.

One consequence worth stating plainly: pasting a listing link — in the app or into the website's browser check — means that link is sent to the services above so the page can be read, what the page says (including the seller's own description and the town they list the car in) is sent to the AI models that analyze it and write your report, and your photos are sent to Google's Gemini models so they can be analyzed. That is the product working, not a side effect.

We may also disclose data where the law requires it, or to protect our rights, users, or the safety of others.

Where data is processed

Our database and files are hosted in the United States, and several of the services above are US-based. If you use SiftCar from the UK, EEA, or Switzerland, your data is transferred outside your country; we rely on the European Commission's Standard Contractual Clauses, or an equivalent safeguard, for those transfers.

Legal bases (UK / EEA)

• Contract. Running the checks you asked for, and enforcing what your plan includes.
• Consent. Push notifications, and joining the waitlist. You can withdraw either at any time — turn off notifications in your device settings, or email us to leave the waitlist.
• Legitimate interests. Keeping the service secure and reliable, debugging failures, and preventing abuse.
• Legal obligation. Keeping transaction and tax records.

How long we keep it

• Your account, checks, reports and photos: while your account exists, so you can reopen past checks. The record that your one free browser check was used lives here too. Deleting your account removes them.
• Listing failure logs: 30 days, then deleted automatically.
• Purchase event records and the working data behind a report: 90 days, then deleted automatically.
• Waitlist emails: until launch, or until you ask us to remove yours.
• Encrypted backups and legally required records: backups roll off on a short schedule measured in days; transaction and tax records are kept as long as the law requires.

Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, export it in a portable format, restrict or object to how we use it, or withdraw a consent you gave. You can also complain to your local data protection authority. We will not treat you differently for exercising any of these rights.

The fastest route is the app itself: everything in your garage is visible there, and deleting your account from Settings removes it immediately. For anything else, email privacy@siftcar.com and we will respond within 30 days. Accounts can be anonymous, so we may need something that identifies yours before we can act — please write from the email linked to it, or include a shared report link.

Security

Data is encrypted in transit and at rest. Your photos are stored privately and served only through short-lived signed links; database rules restrict every row to the account that created it. No system is perfectly secure, but that is where we spend the effort.

Children

SiftCar is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us data, email us and we will delete it.

Contact

Privacy questions and data requests: privacy@siftcar.com. App support: siftcar.com.

Changes

We may update this policy as the product changes. The "Last updated" date at the top will change when we do, and we will tell you in the app if a change materially affects you.