This Privacy Policy describes how MECH.AI LLC ("we," "us," or "our") collects, uses, and shares information when you use MECH AI (the "Service"), including our iOS and Android apps, the web app, and the mechai.app website. Questions? Email alex@mechai.app.

1. Information we collect

Account info. Name, email, and login credentials.
Vehicle & usage data. VINs, year/make/model/trim, engine type, mileage, service history, and questions, photos, and answers you submit to Quick Help (the AI Mechanic), Diagnostics, Vehicle Health, Support Assist, Repair Guides, and Maintenance Schedule features.
App activity and device data. Which screens and features you use, app and operating-system version, device model, language, app and device identifiers, IP address, and, if you allow notifications, a push-notification token. We use analytics tools to collect this (see Section 4).
Crash and error reports. When something goes wrong, the error message, the technical trace of where it happened, the page or screen, and your app, browser, and device versions.
Advertising identifiers. On iOS, Apple's advertising identifier (IDFA) only if you allow tracking (see Section 5). On Android, Google's advertising ID, which you can reset or delete in your device settings.
Ad and campaign information. If you reach MECH AI from an ad or a tagged link, the ad's click identifier and campaign tags (see Section 4).
Payment and subscription info. Payments are handled by Apple, Google, or Stripe — we never see your card. We receive which plan you bought, store transaction identifiers, and your subscription, trial, and renewal status.

2. How we use information

Deliver and improve the Service
Provide customer support
Understand how the app is used and find and fix crashes and errors
Manage subscriptions and restore purchases across your devices
Measure which of our ads and campaigns lead to installs, sign-ups, and subscriptions
Show ads on the free plan when in-app ads are turned on (see Section 4)
Communicate product updates (you can opt out of marketing emails)
Comply with legal obligations

3. AI processing & third-party AI providers

The AI features in MECH AI — including Quick Help (the AI Mechanic chat), Diagnostics, Vehicle Health analysis, Support Assist, Repair Guides, and Maintenance Schedule optimization — are powered by Google's Gemini large language models, operated by Google LLC ("Google"). To answer your question, the following data is transmitted to Google for processing on our behalf:

The text of your question, message, or symptom description.
Vehicle context you have entered: year, make, model, trim, engine type, mileage, and (where you provide it) VIN.
Any photos or images you attach (for example diagnostic photos of a component, dashboard light, or wear pattern).
Your previous turns in the same conversation (so the AI can keep context), your selected expertise level (DIY / experienced / pro), and your interface language.

We do not transmit your name, email address, password, payment information, or precise device location to Google. Your account ID is not attached to AI requests.

Google processes this data as our service provider under the Google Cloud / Vertex AI data processing terms (Cloud Data Processing Addendum) and Google's Gemini for Google Cloud data governance. Under those terms, Google does not use your prompts, photos, or responses to train its foundation models, retains the data only as long as needed to deliver the response (plus a short abuse-monitoring window), and provides protections substantially equivalent to those described in this policy.

Before the first time MECH AI sends any of your data to Google's Gemini service, the app shows you an in-app disclosure explaining what will be sent and asks for your explicit consent. You can decline at any time, in which case the AI feature will not run and no data will be transmitted. You can also revoke consent later under More → Settings → Privacy → AI Assistance, which will stop further AI requests from your account until consent is granted again.

4. Sharing

In addition to the AI processing described in Section 3 and advertising measurement described below, we share information with service providers (hosting, analytics, crash reporting, payments, email delivery) who are contractually bound to protect it. Each provider is engaged under a data processing agreement that requires confidentiality, security, and use of your data only to deliver the service to us. We do not exchange your personal information for money. Advertising-related sharing is described below.

Analytics, crash reporting and purchases

Google Firebase. Firebase Analytics receives app activity and device data so we can see how the app is used. Firebase Authentication handles sign-in, including Sign in with Google and Apple, and Firebase Cloud Messaging delivers push notifications.
Amplitude. Amplitude receives product-usage events, your MECH AI account ID, device and app information, and campaign tags so we can understand which features help people and where they get stuck. On the web, in places where the law requires cookie consent, Amplitude runs only after you accept cookies.
Amplitude Session Replay. We may use Session Replay to see how a sample of sessions moves through the app and web app, so we can find and fix confusing screens. When it is on, it records page layout, taps, clicks, and scrolling for about 1 in 10 sessions. It masks all text you type and all text shown on screen, and it does not record images, photos, or video. It never runs while you are opted out of Amplitude. Session Replay is currently turned off.
Sentry. Sentry receives crash and error reports, and on the web a sample of performance timings. We remove request and response contents from reports about failed network requests and redact sensitive addresses before they are sent.
RevenueCat. RevenueCat manages subscriptions across the App Store, Google Play, and the web. It receives your MECH AI account ID, the products you buy, store transaction and receipt data, and your subscription status. Where you have allowed attribution, it also receives your AppsFlyer ID.

Mobile app install attribution (AppsFlyer)

The iOS and Android apps include the AppsFlyer SDK to attribute installs and measure in-app events such as sign-ups and trial starts. Depending on your choices, AppsFlyer receives device and advertising identifiers, IP address, device type and operating system, install and in-app events, and your MECH AI account ID. AppsFlyer waits for your consent decision where one is required. On iOS, if you choose Ask App Not to Track, AppsFlyer runs with advertising identifiers turned off and without your account ID. AppsFlyer can share attribution results with ad networks we work with, such as Meta and Reddit. Learn more in the AppsFlyer Services Privacy Policy.

Ads in the free plan (Google AdMob and Meta Audience Network)

The free plan of the iOS and Android apps is built to show ads from Google AdMob, including optional rewarded ads, and AdMob may fill some ad requests through Meta Audience Network. In-app ads are currently turned off. When they are on, these networks may collect your advertising identifier (only where you have allowed it), IP address, device information, and how you interact with ads, to serve, limit, and measure ads and, where you have consented, to personalize them. Google's practices are described in How Google uses information from sites or apps that use its services , and Meta's in the Meta Privacy Policy. Paid plans do not show these ads.

Our own product cards

On the free plan of the web app we may show dismissible cards for parts or products from retailers such as Amazon. MECH AI chooses these cards; an ad network does not, and we do not send your personal information to the retailer to show them. If you tap a card, you go to the retailer's site, the retailer can see that you came from MECH AI, and we may earn a commission. Paid and trial accounts do not see these cards.

Advertising measurement on our website and web app

The mechai.app website uses Google Analytics, Google Ads, and Google Tag Manager, which loads the Quora pixel, plus the OpenAI Ads measurement pixel. The web app uses the Reddit Pixel. These tools use cookies and similar technologies to count visits and to tell an advertiser when someone who saw or clicked its ad later visits, signs up, or subscribes.

When you arrive from an ad, we store the ad's click identifier (from Google, Meta, Microsoft, Reddit, Quora, or TikTok) and campaign tags in a first-party mechai.app cookie for 90 days, or 180 days for the Reddit click identifier in the web app, so a later sign-up or purchase can be credited to that ad. When you sign up or subscribe on the web, our servers may also send Reddit and Quora a conversion event that includes a hashed (SHA-256) version of your email address, your IP address, browser information, and any click identifier, so they can match the conversion to an ad.

Optional Facebook and Instagram web-trial measurement

Where this feature is available, visitors arriving from a Meta ad can choose whether to allow optional measurement in the web app. If you allow it and start a confirmed web subscription trial, MECH AI sends Meta Platforms your ad-click identifier, a browser identifier, browser type, trial start time, an opaque event identifier, and the app's website address. We use this to measure and improve Facebook and Instagram advertising. This event does not include your name, email, phone number, IP address, payment details, repair content, vehicle details, or private page address.

Meta may combine event information with information it already holds to measure advertising, personalize ads and other content, and improve its services. Its processing is described in the Meta Privacy Policy and Meta Business Tools Terms. The service-provider-only description above does not describe all of Meta's uses.

You can decline without losing access to MECH AI, or revoke future web-trial sharing through Ad measurement preferences in the web app. The browser's measurement choice and identifiers expire after 90 days. This feature honors Global Privacy Control and does not send events when that browser signal is enabled. Revoking consent stops future sharing through this feature; it does not recall information already sent to Meta. You can also review advertising choices in Meta's ad preferences. These controls apply to this optional web-trial feature, not to every analytics or mobile attribution service.

Facebook and Instagram links to the mobile app

Our mobile download links use AppsFlyer to route you to the appropriate app store and attribute installs. For eligible Facebook and Instagram campaign clicks, AppsFlyer can send Meta the campaign and click identifiers, eligible device attribution identifiers, IP address, browser/device type, install events and trial-start events. Our Meta Web trial mapping excludes extra event values and revenue, and advanced matching is disabled. iOS Advanced Privacy remains enabled: this integration does not send postbacks for non-consenting iOS 14.5+ users. The website does not forward the Meta click identifier to this mobile download link when Global Privacy Control is enabled. The separate web-trial preference above does not control the mobile app's operating-system tracking permission.

5. Tracking, ads and analytics choices

App Tracking Transparency (iPhone and iPad). Before we or our partners use your device's advertising identifier (IDFA) or otherwise track you across apps and websites owned by other companies, the app asks your permission through Apple's tracking prompt. If you choose Ask App Not to Track, we do not access the IDFA. You can change this at any time in iOS Settings → Privacy & Security → Tracking.
Consent in the EEA, UK and Switzerland. Where the law requires it, the app shows Google's consent form before ads or ad measurement run, and attribution waits for your decision. You can review or change your choice in the app under More → Settings → Privacy & Ad consent.
Android advertising ID. You can reset or delete your advertising ID in your Android device's settings (usually Settings → Privacy → Ads, or Settings → Google → Ads).
Cookies on the web. In places where the law requires cookie consent, the web app shows a cookie banner. If you choose Reject non-essential, the web app does not run Amplitude analytics. You can also block or delete cookies in your browser settings.
Marketing email. Every marketing email has an unsubscribe link. We only send marketing email to people who agreed to receive it.

6. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your data. Email alex@mechai.app and we'll walk you through it.

7. Retention

We keep your account data for as long as your account is active, plus a short period after deletion to comply with legal obligations.

8. Children

MECH AI is not directed to children under 13. We do not knowingly collect personal information from children.

9. International transfers

Data may be processed in the United States and other countries. We rely on standard contractual clauses where required.

10. Changes to this policy

We'll notify you of material changes via the app or email.