Privacy Policy
Simena Digital LLC · privacy@mytinygarage.app
Last updated: October 15, 2026
Tiny Garage: Diecast Scanner ("Tiny Garage") is a personal app for cataloguing your die-cast and toy car collection, made by Simena Digital LLC ("we," "us," or "our"), a Wyoming limited liability company based in the United States. Tiny Garage does not sell cars or any physical product — this policy explains what data the app itself collects, why, and how we protect it.
1. Information You Provide
When you use Tiny Garage, you may provide the following information:
- Account information: name and email address (via Apple Sign-In), used to identify your account and restore your subscription on a new device.
- Collection data: the cars you add, whether you own them or want them — name, brand, casting, series, year, identifying code, colour, packaging, description, storage location, notes, date acquired, price paid, and any other details you choose to record.
- Photos: up to three photos per car, and an optional profile photo. When you save a car, its photos are stored on our servers with the car so they appear on every device you sign in on, until you delete the car or your account. Each photo is stored behind its own private, hard-to-guess web address that we never index or share. Your profile photo, and any earlier profile photos you replaced, are kept until your account is deleted.
- Profile settings: your display name, language, and timezone.
2. Information Collected Automatically
When you access Tiny Garage, we automatically receive:
- IP address and user agent (standard HTTP request data)
- Session tokens for authentication
If crash reporting is enabled for your app version, a technical report (device model, OS version, app version, stack trace) is sent to Sentry when the app crashes or errors, so we can fix the bug. Reports are scrubbed before sending: no email addresses, no IP addresses, no collection content.
We do not run ads in the app, and we do not track you: Tiny Garage contains no advertising or attribution SDK and never reads your device's advertising identifier. RevenueCat uses Apple's AdServices framework to tell us whether an install came from an Apple Search Ads campaign; Apple designed it so that it does not identify you or your device.
3. Car Identification and Your Data
When you scan a car, the photo is sent to OpenAI to suggest its details. The identification request itself is not stored by us, and OpenAI does not keep it beyond the request, apart from the abuse monitoring described below. If you save the car, the photo is kept with the car like any photo you add. We keep a record of the scan (the suggested details, model and time) so the feature can run responsibly and enforce fair-use limits, but that record never includes the image. OpenAI does not use API data to train its models by default. OpenAI may retain request data for abuse monitoring, normally for up to 30 days; see developers.openai.com/api/docs/guides/your-data for details.
4. How We Use Your Information
We use your information to:
- Provide and sync your collection and wishlist across your devices
- Authenticate your account and keep it secure
- Restore your subscription on a new device via your Apple ID
- Run the car-identification feature and enforce its daily fair-use limit
- Let you export your collection whenever you like
- Deliver optional local reminders, if you have allowed notifications (see §11)
- Enforce subscription entitlements and prevent abuse of introductory pricing
5. Third-Party Services
| Service | Purpose | Data shared |
|---|---|---|
| Apple | Authentication (Sign in with Apple) | Name, email |
| OpenAI (GPT models) | Car identification | The scan photo, for that single request only — not kept by OpenAI beyond the request (see §3). If you save the car, the photo is kept with it like any photo you add. |
| RevenueCat | Subscription management and entitlement enforcement | Anonymous user ID and purchase history |
| Sentry | Crash and error reporting (if enabled for your app version) | Technical crash reports (device model, OS version, stack trace) — scrubbed of email, IP address, and all collection content |
All third-party service providers listed above are contractually required to protect your data to a standard equivalent to or greater than described in this policy.
We do not sell your personal data, and we do not share your collection content with anyone except as described above.
6. Data Storage and Security
Your account record, collection data, and uploaded photos are stored on secure servers in the European Union (Germany), hosted by Hetzner Online GmbH. Communication between the app and our servers uses HTTPS (TLS 1.2+), and authentication uses timing-safe token comparison to prevent timing attacks.
On your device, Tiny Garage stores data using:
- AsyncStorage: preferences, app settings, and an offline cache of your collection for fast, offline browsing
- expo-secure-store: authentication tokens (encrypted by the OS keychain)
- The app's documents folder: copies of photos waiting to upload, deleted once our servers confirm the upload
7. Data Retention and Deletion
Your data is retained as long as your account is active. You can delete any car at any time; deleting a car removes it and its photos from our servers. You can delete your account at any time from Settings within the app. Deletion is soft-applied immediately — your active session is ended and your Apple refresh token is revoked — and finalized after 30 days. During this 30-day grace window you may restore the account by signing in again with the same Apple ID. After 30 days, your account, cars, scan records, and uploaded photos are permanently and irreversibly removed from our servers. We keep one small record after deletion: a one-way hash of your Apple account identifier, the date of deletion, and whether you had already used an introductory offer. It contains no name, email, or collection content, and we use it only to stop introductory pricing being claimed twice and as a record that your deletion was carried out.
Data held by third-party services (e.g. RevenueCat purchase records, Apple account data) is subject to those services' own retention policies.
8. International Data Transfers
Simena Digital LLC is a U.S. (Wyoming) company, but your account data and user content are stored on servers in the European Union (Germany) — see §6 — regardless of where you are. Some processing occurs in the United States by the service providers named in §5: Apple (sign-in and subscriptions), OpenAI (car identification), RevenueCat (subscription management), and Sentry (crash diagnostics, if enabled). When your data is transferred to these providers, it is protected by Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR and UK GDPR.
9. Legal Basis for Processing (GDPR / UK GDPR)
If you are in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases:
- Contract performance: to provide the Tiny Garage service you signed up for, including account management, collection sync, and subscription entitlement.
- Consent: for optional features that require your explicit opt-in, including camera and photo-library access and local notifications.
- Legitimate interest: for service security and fraud prevention (e.g., preventing abuse of introductory pricing or the daily scan limit).
You may withdraw consent for consent-based processing at any time by disabling the relevant feature or contacting us at privacy@mytinygarage.app.
10. Your Rights Under GDPR / UK GDPR
If you are in the European Economic Area or the United Kingdom, you have the following rights regarding your personal data:
- Access: request a copy of the data we hold about you
- Rectification: correct inaccurate personal data
- Erasure: delete your account and its associated data (see §7 for the one deletion record we keep)
- Portability: receive your data in a machine-readable format — you can export your collection at any time from Settings as a ZIP file containing a cars.csv file and your car photos
- Restriction: limit how we process your data
- Object: object to processing of your data
- Withdraw consent: withdraw consent at any time where processing is based on consent
- Lodge a complaint: file a complaint with your local data protection authority if you believe your data has been mishandled
To exercise any of these rights, email us at privacy@mytinygarage.app. You can also delete your account directly in the app under Settings. We will respond to requests within 30 days.
11. Notifications
Tiny Garage uses local notifications only, and only if you have allowed notifications for the app in iOS Settings — optional reminders to update your collection, and reminders about a subscription offer. No push notification tokens are sent to our servers. All notification scheduling happens on your device.
12. Camera and Photos
Tiny Garage requests camera access to scan and photograph your cars, and photo library access to add existing photos to a car or to your profile. Photos you add are uploaded to our servers as described in §1 and §6. You can remove a photo by editing the car it belongs to while your subscription is active, or at any time, with or without a subscription, by deleting the car.
13. Children's Privacy
Tiny Garage is not directed at children and requires users to be at least 13 years old (or 16 in the EEA), as our Terms of Service say. We do not knowingly collect personal information from children under 13 (or 16 in the EEA). If you believe a child has provided us with personal data, please contact us at privacy@mytinygarage.app and we will delete it promptly.
14. Your Rights by Jurisdiction
In addition to the GDPR and UK GDPR rights described above, the following rights may apply based on your location:
United States (California — CCPA/CPRA): California residents have the right to know what personal information we collect, request its deletion, and opt out of the sale of personal information. We do not sell your personal information. To exercise your rights, contact us at privacy@mytinygarage.app.
Canada (PIPEDA): Canadian users have the right to access, correct, and request deletion of their personal data. We only collect personal information for purposes that a reasonable person would consider appropriate. Contact us at privacy@mytinygarage.app to exercise your rights.
Australia (Privacy Act 1988): Australian users may access and correct their personal data under the Australian Privacy Principles. If you believe we have breached the APPs, you may lodge a complaint with us at privacy@mytinygarage.app or with the Office of the Australian Information Commissioner (OAIC).
Japan (APPI): Japanese users have the right to request disclosure, correction, and deletion of their personal data. We handle personal information in accordance with the Act on the Protection of Personal Information. Contact us at privacy@mytinygarage.app.
South Korea (PIPA): Korean users have the right to access, correct, delete, and suspend processing of their personal data under the Personal Information Protection Act. Contact us at privacy@mytinygarage.app to exercise your rights.
For all jurisdictions: regardless of where you are located, you can delete your account and its associated data at any time from Settings within the app (see §7).
15. Changes to This Policy
We may update this privacy policy from time to time. If we make material changes, we will notify you through the app or by email. The "Last updated" date at the top of this page indicates when the policy was last revised.
16. Contact Us
If you have questions, concerns, or requests regarding this privacy policy or your personal data, contact us at:
Simena Digital LLC
1021 E Lincolnway, Suite 9026
Cheyenne, WY 82001, United States
Email: privacy@mytinygarage.app