Last updated: May 2, 2026
Summary: Carva automatically blurs faces and license plates in all photos before storage. We never store unprocessed originals. Your spot data syncs across devices via our secure servers. Your username, profile stats, follow graph, and spots are publicly visible to other Carva users (with a 24h delay and 5km offset on others' coordinates). We do not sell your data.
This Privacy Policy describes how Shiftware ("we", "us", "our") collects, uses, and protects your information when you use the Carva application.
Stored on our servers:
Stored locally on your device:
Sent to third-party services for processing (not stored by them):
Carva requests location permission to tag your spots on the map. We use Mapbox to display maps — please review Mapbox's Privacy Policy.
How spot locations are shared: You always see your own spots at their exact coordinates. Spots created by other users only become visible to you 24 hours after they were captured, and their coordinates are offset by approximately 5 km in a random direction before being sent to your device. This offset is applied server-side, so exact locations of other users' spots never reach your device.
Carva is designed with privacy by default. Every photo undergoes the following process before it is stored:
If you choose not to save a spot, no photo data is retained anywhere. Third-party processors handle images in memory under their respective data processing agreements and do not retain image data.
Carva requires camera access to photograph vehicles. Photos are taken within the app and transmitted to our server for identification and privacy processing. The original photo exists only temporarily in your device's app cache and is not saved to your camera roll.
Subscription purchases are processed by Apple or Google. We do not collect or store payment information.
Your spot data and privacy-processed photos are stored on our secure servers (Supabase, hosted on AWS), allowing you to restore your collection if you reinstall the app or switch devices. We use encryption in transit and at rest. You may delete your entire account and all associated data from within the app (Account settings), or request deletion via our account deletion page, or by contacting us at .
If you are the owner of a vehicle featured in a spot and wish to have it removed, please use our Spot Removal Request form or email with the spot ID (visible on the spot detail screen in the app), a photo of the vehicle registration certificate showing the make and model (personal details may be redacted), and a brief explanation. We will process requests within 30 days.
Carva is intended for users aged 18 and above. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected data from a user under 18, we will promptly delete that data and terminate the associated account.
If you are located in the European Economic Area, you have the right to access, correct, or delete your personal data. You can delete your account and all data from within the app. For data access requests or other inquiries, contact us at .
Carva includes social features. The following information is visible to other Carva users:
You can unfollow any user at any time, delete your own comments, and remove your likes. Reports of inappropriate comments or spots can be submitted in-app via the report button.
Carva may send you push notifications for the following events:
You can disable all notifications at any time through your device settings, or remove only social notifications by clearing the push token on the account settings screen.
We may update this Privacy Policy periodically. We will notify you of significant changes through the app and on this page.