Privacy Policy

Last updated: 2026-04-17

MyCarPub ("we", "us") runs a marketplace for buying and selling cars. This page explains what data we collect, who we share it with, and what you can do about it. If anything here is unclear, email privacy@mycarpub.com.

What we collect

Account email. We use Google OAuth for sign-in, which gives us your email address and a Google user ID — nothing more.
Listing content. Photos, descriptions, price, location, and any other details you submit when you post a car.
Sign-up IP address. We record the IP address used when an account is first created. This is used strictly for abuse detection (bans, duplicate-account checks). We do not use it for marketing or profiling.
Basic request metadata. Standard server logs — timestamps, requested URL, user agent — retained for a short window for debugging and security.

We do not collect phone numbers, addresses, or payment information in v1. All buyer-seller contact happens outside the platform.

What we do not do

We do not sell personal data.
We do not run third-party ad or tracking scripts in v1 — no Google Analytics 4, no Meta Pixel, no Hotjar, no session recorders.
We do not share your email with other users. Buyers contact sellers through the in-app message flow.

Sub-processors

These are third-party services we use to run the site. Each only gets the data it needs to do its job:

Supabase — database and authentication backend.
Google Cloud Storage — storage for listing photos.
Vercel — application hosting.
Vercel Analytics — aggregate, cookie-less page analytics. No personal identifiers, no cross-site tracking.
Sentry — error monitoring. May capture stack traces and limited request context when something breaks.
Cloudflare Turnstile — bot challenge on sign-up and listing submission. Privacy-friendly alternative to reCAPTCHA.
Upstash — rate limiting and ephemeral caching.
Cloudflare may also sit in front of the site as a DDoS proxy at the network layer.

Cookies and analytics

Vercel Analytics is cookie-less and privacy-friendly — it does not set tracking cookies or build a cross-site profile of you. The only cookies we set are the ones required to keep you signed in (Supabase auth session) and functional preferences.

Your rights

Access. You can see everything on your account by signing in.
Deletion. You can delete your account at any time at /account → Settings → Delete my account. This removes your email, listings, and associated records. A short retention window may apply for fraud/abuse records where legally required.
CCPA. If you're a California resident, you have the right to request deletion of your personal data. The in-app delete flow satisfies this; if you prefer to request it by email, write to privacy@mycarpub.com.

Contact

Questions about privacy, data requests, or anything else on this page: privacy@mycarpub.com.

What we collect

Account email. We use Google OAuth for sign-in, which gives us your email address and a Google user ID — nothing more.

Listing content. Photos, descriptions, price, location, and any other details you submit when you post a car.

Sign-up IP address. We record the IP address used when an account is first created. This is used strictly for abuse detection (bans, duplicate-account checks). We do not use it for marketing or profiling.

Basic request metadata. Standard server logs — timestamps, requested URL, user agent — retained for a short window for debugging and security.

We do not collect phone numbers, addresses, or payment information in v1. All buyer-seller contact happens outside the platform.

Sub-processors

These are third-party services we use to run the site. Each only gets the data it needs to do its job:

Supabase — database and authentication backend.

Google Cloud Storage — storage for listing photos.

Vercel — application hosting.

Vercel Analytics — aggregate, cookie-less page analytics. No personal identifiers, no cross-site tracking.

Sentry — error monitoring. May capture stack traces and limited request context when something breaks.

Cloudflare Turnstile — bot challenge on sign-up and listing submission. Privacy-friendly alternative to reCAPTCHA.

Upstash — rate limiting and ephemeral caching.

Cloudflare may also sit in front of the site as a DDoS proxy at the network layer.

Your rights

Access. You can see everything on your account by signing in.

Deletion. You can delete your account at any time at /account → Settings → Delete my account. This removes your email, listings, and associated records. A short retention window may apply for fraud/abuse records where legally required.

CCPA. If you're a California resident, you have the right to request deletion of your personal data. The in-app delete flow satisfies this; if you prefer to request it by email, write to privacy@mycarpub.com.