Legal

Privacy Policy

Version 1.4 · Effective June 17, 2026

CarLink Privacy Policy

Effective Date: June 17, 2026 Last Updated: June 17, 2026

---

1. Who We Are

This Privacy Policy explains how CarLink HQ LLC ("CarLink HQ," "we," "us," or "our") collects, uses, shares, and protects information when you use the CarLink mobile application, website, and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information described here. If you do not agree, please do not use the Service.

---

2. Information We Collect

2.1 Information you provide

Account information. Email address, display name, username,

password (stored as a salted hash), profile photo, banner photo, bio, website URL, pronouns (optional), date of birth.

Date of birth. Collected at signup to verify you meet our

minimum age requirement of 13 (see Section 10 — Children's Privacy). Date of birth is stored on your account row, is never shown to other users, is not used for targeted advertising, and is treated as sensitive personal information under the safeguards described in Section 7 (Security).

Garage and content. Vehicle make, model, year, photos, build

notes, modifications, performance specs, ownership history, achievements you choose to surface on your profile.

Posts, comments, and messages. Photos, captions, comments,

direct messages, group-chat messages, story uploads (which expire 24 hours after posting), and any other content you post.

Show and event metadata. Show names, dates, locations, ticket

information, attendee lists, organizer requests, and event RSVPs.

Privacy settings. Whether your account is private, your

Garage Visibility, who can DM you, who can tag or @mention you, your blocked-users list, your muted-conversations list.

Verification information. If you apply for verified status, we

may request a government-issued ID, business documentation, or other proof of identity. We use that information solely to verify your identity and delete it after the review is complete.

2.2 Information collected automatically

Device information. Device model, operating-system version, app

version, language, timezone, mobile carrier, screen size, and crash logs.

Usage information. Pages and screens you view, features you

use, time spent in the app, taps on posts and stories, search queries.

Approximate location. With your permission, we use device

location to show shows and groups near you, surface "Local" discovery results, and (if you check in to a show) record your attendance. You can revoke location permission in iOS / Android Settings at any time.

Stored network identifiers. IP address, push-notification token,

and a randomized device identifier used for fraud prevention and abuse detection.

2.3 Information from third parties

Sign-in providers. If you sign in with Apple, Google, or

another OAuth provider, we receive the basic profile fields the provider supplies (typically a stable user ID, email, and display name).

Mapping providers. Map tiles and geocoding are provided by

third parties; their data handling is governed by their own privacy policies.

Advertising partners (website). When you visit

carlinkhq.com, our advertising partner Google may collect information automatically through cookies and similar technologies. See Section 4.5 for details.

We do not collect sensitive personal information (race, religion, biometrics, precise medical data, etc.) and we do not knowingly collect information from children under 13.

---

3. How We Use Information

We use the information we collect to:

Operate the Service. Authenticate accounts, deliver posts,

show stories, route messages, render maps, send push notifications, and generally run the app you signed up for.

Personalize. Surface posts, shows, builders, hashtags, and

groups likely to interest you. Surface People You Might Like, Now Happening, and Discover content.

Communicate. Send transactional emails (password resets,

receipts), in-app announcements, and (with your consent) occasional product updates.

Keep the community safe. Detect and respond to spam,

impersonation, harassment, intellectual-property infringement, and other abuse. Enforce our Community Guidelines.

Improve the Service. Diagnose crashes, measure performance,

test new features, and analyze aggregate usage trends.

Comply with the law. Respond to lawful requests from courts,

regulators, and law enforcement.

We do not sell your personal information. Our website at carlinkhq.com uses Google AdSense to display advertisements on public pages; see Section 4.5 below for the details on what information Google receives and how to opt out. We do not share your contact information, posts, garage content, or direct messages with any advertiser.

---

4. How We Share Information

We share information only as described below.

With other users. Anything you post publicly — your profile,

posts, photos, garage cars (if Garage Visibility is set to Public), comments — is visible to other users by default. If your account is private, only approved followers can see your posts, garage, and full followers list.

With organizers and groups. If you RSVP to a show, the

organizer can see that you've RSVPd. If you join a group, group admins can see your membership and any messages you post in the group.

With service providers. We use trusted third-party providers

to run the infrastructure behind CarLink — including database hosting (Supabase), object storage, push notifications, email delivery, crash reporting, and analytics. They are contractually bound to use the data only to provide their services to us.

For legal reasons. If we receive a valid subpoena, court

order, search warrant, or other lawful request, we may disclose information to comply. We may also disclose information if we believe in good faith that doing so is necessary to prevent fraud, abuse, imminent harm, or to enforce our Terms of Service.

Business transfers. If CarLink HQ is acquired or merges with

another entity, your information may be transferred as part of that transaction. We will notify you in advance of any change of ownership and let you delete your account before the transfer completes if you choose.

4.5 Advertising on the website

Our website at carlinkhq.com uses Google AdSense to display advertisements on public pages.

What Google receives. When you load a public web page that contains an AdSense unit, Google may receive:

Your IP address and approximate location derived from it
Device characteristics (browser, operating system, screen size)
The page URL you are viewing
Cookies and similar identifiers stored on your browser
Whether you have interacted with previous Google ads

What Google uses it for. Google uses this information to deliver, measure, and personalize the advertisements you see — including across other websites — and for ad fraud prevention. Under California law, this constitutes "sharing" of personal information for cross-context behavioral advertising.

Your choices. You can:

Opt out of personalized advertising across Google's network at

https://www.google.com/settings/ads. You will still see ads, but they will not be personalized using your Google activity.

Use the "Do Not Sell or Share My Personal Information" link

in the footer of carlinkhq.com to opt out (California residents).

Configure your browser to block third-party cookies, which

materially reduces ad personalization.

Enable Global Privacy Control (GPC) in your browser. We

treat GPC signals as a valid opt-out request under CCPA.

What Google does NOT receive from us. Google AdSense does not receive your email address, password, name, profile content, garage content, posts, comments, direct messages, or any other account-bound personal information. The AdSense integration is strictly the standard web-page-level script Google provides; we do not pass user identifiers or account data into the ad request.

The full Google AdSense privacy disclosure is available at https://policies.google.com/technologies/ads.

---

5. Your Choices

Update your profile. Edit your display name, username, bio,

pronouns, photos, and links anytime from Settings → Edit Profile.

Privacy controls. Toggle a Private Account, scope Garage

Visibility, restrict who can DM or tag you, mute or block individual users, and turn off Activity Status, Read Receipts, or Story Replies.

Push notifications. Manage notification categories from

Settings → Notifications, or turn them off entirely in iOS / Android system settings.

Location. Revoke location permission in your device settings.

Location-aware features (Local feed, Now Happening, distance to shows) will be unavailable but the rest of the app works.

Advertising on the website. Use the "Do Not Sell or Share My

Personal Information" link in the website footer, enable Global Privacy Control in your browser, or use the Google Ads Settings opt-out described in Section 4.5.

Account deletion. Delete your account from Settings →

Privacy & Safety → Delete Account. We will remove your profile, posts, garage, stories, and messages from public view within 30 days. Some content may persist in encrypted backups for up to 90 days for security and legal-compliance reasons.

---

6. Your Rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you.
Correct inaccurate or incomplete information.
Delete your information (subject to legal retention

requirements).

Restrict or object to certain processing.
Port your information to another service in a structured,

machine-readable format.

Opt out of "sales" or "sharing" of personal information for

cross-context behavioral advertising. CarLink HQ shares limited browsing information with Google AdSense for advertising on carlinkhq.com (see Section 4.5). You can opt out at any time via the "Do Not Sell or Share My Personal Information" link in the website footer, by enabling Global Privacy Control in your browser, or by emailing [email protected]. CarLink HQ does not sell personal information.

Withdraw consent for processing that requires consent, at

any time, without affecting the lawfulness of processing carried out before withdrawal.

Lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us at [email protected] and include enough detail for us to verify your identity. We will respond within the statutory timeframe in your jurisdiction (e.g., 45 days under California's CCPA/CPRA, 30 days under the EU's GDPR).

We do not discriminate against users who exercise their privacy rights.

---

7. International Transfers

CarLink HQ is based in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country. By using the Service you consent to this transfer. Where required by law (for example, transfers from the EU/EEA, UK, or Switzerland), we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.

---

8. Data Retention

We keep your information for as long as your account is active and as long as needed to provide the Service. After you delete your account, we remove your content from public view within 30 days and from our production systems within a further 60 days, except where retention is required by law or where retention is necessary for fraud prevention, abuse review, security audits, or to enforce our Terms.

Stories expire 24 hours after posting and are removed from the public rail. The underlying row may be retained for a short additional period for the author's view-count analytics and is then deleted.

Direct-message content is retained until the participants delete it or delete their accounts.

---

9. Security

We protect your information with industry-standard administrative, technical, and physical safeguards: TLS in transit, encryption at rest where supported, hashed passwords, scoped database row-level security, periodic access reviews, and audit logging. No system is perfectly secure, and we cannot guarantee absolute security. If we ever learn of a security incident affecting your information, we will notify you without undue delay as required by law.

---

10. Children's Privacy

CarLink is not intended for children under 13. We do not knowingly collect personal information from anyone under 13.

Age verification. At signup, we ask you to provide your date of birth. If the date you provide implies you are under 13 years old, we reject the signup before any account is created and no information is stored. This check is enforced both in the iOS app and on our database server, so the gate cannot be bypassed by using a custom client. Accounts created before this verification was introduced are subject to a one-time date-of-birth confirmation the next time the account holder opens the app.

If we learn we have collected information from a child under 13, we will delete it promptly. Parents or guardians who believe their child has provided us with personal information may contact us at [email protected].

---

11. California Residents — Additional Disclosures

If you are a California resident, the California Consumer Privacy Act of 2018 (as amended by the CPRA) provides specific rights regarding your personal information.

Categories of personal information collected. Identifiers (name, email, IP), commercial information (account activity), internet activity (logs, device info), geolocation (approximate), inferences (content interests).

Sources. You, your device, third-party sign-in providers, and (on the website only) advertising-cookie identifiers set by Google AdSense.

Purposes. As described in Sections 3 and 4 above.

Sharing for cross-context behavioral advertising. We share limited identifiers and browsing information (IP address, page URLs, browser/device characteristics, AdSense cookie identifiers) with Google AdSense for advertising on carlinkhq.com. This is "sharing" as defined by the CCPA. You can opt out at any time via the "Do Not Sell or Share My Personal Information" link in the website footer, by enabling Global Privacy Control (GPC) in your browser (we honor GPC signals as opt-out requests), or by emailing [email protected].

Sale of personal information. None.

Sensitive personal information. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

You can submit a request to know, delete, correct, or port at [email protected]. You may designate an authorized agent to make a request on your behalf, in which case we will require verification of the agent's authority.

---

12. EU/EEA, UK, and Swiss Residents

If you are in the EU/EEA, UK, or Switzerland, the General Data Protection Regulation (GDPR), UK GDPR, or Swiss Federal Act on Data Protection applies.

Legal bases. We process your personal information under one or more of: (a) performance of a contract (operating the account you signed up for); (b) legitimate interests (operating the Service securely, preventing abuse, improving the product); (c) consent (for optional features like push notifications, location, and advertising cookies on the website); and (d) legal obligation (responding to lawful requests).

Advertising cookies (website). Advertising cookies on carlinkhq.com are placed only after you have given consent via the cookie-consent banner shown on first visit. You can withdraw consent at any time via the "Cookie settings" link in the website footer.

Controller. CarLink HQ LLC is the controller of your personal information. You can reach our privacy team at [email protected].

Right to lodge a complaint. You have the right to complain to your supervisory authority (e.g., the ICO in the UK, or your national DPA in the EU).

---

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email or through the Service at least 30 days before the change takes effect. Your continued use of the Service after the effective date of the change constitutes acceptance of the updated policy. The current version is always available at legal/privacy_policy.md and inside the app under Settings → Legal.

---

14. Contact

CarLink HQ LLC Woodstock, Georgia, USA Privacy: [email protected] Legal: [email protected] Support: [email protected]