Privacy Policy

1. About This Policy

This Privacy Policy explains how Mecha App LLC ("Mecha," "we," "our," "us"), a Georgia limited liability company headquartered in Atlanta, Georgia, collects, uses, discloses, and protects personal information when you interact with the Mecha website (trymecha.com), our iOS and Android mobile apps, our APIs, and related services (collectively, the "Service"). It applies whether you are a Driver / customer, a Mechanic / shop owner, or a website visitor. It is incorporated by reference into our Terms of Service.

By creating an account or otherwise using the Service, you agree to this Privacy Policy. If you do not agree, do not create an account and do not use the Service.

2. Personal Information We Collect

The following table maps each category of personal information we collect (as defined in the California Consumer Privacy Act) to the source, purpose, and typical retention period.

Categories we do NOT collect:

• Payment card details (Stripe collects and processes these directly under Stripe's privacy policy; we only see the last-4, brand, expiry, and subscription status).
• Government identification numbers, driver's license images, or passport data.
• Precise real-time GPS coordinates of Drivers (we keep only a ZIP-level home area; exact shop location is stored for Mechanics).
• Biometric identifiers.
• Health information.
• Union membership, religious, political, philosophical, sexual-orientation, or race data.
• Any data from anyone under 13 (we do not knowingly collect from anyone under 16).

3. How We Use Personal Information

We use the categories above for these business purposes:

• Create, authenticate, secure, and support your account;
• Display Mechanic shop profiles to Drivers searching for service;
• Route messages, appointment requests, bids, and reviews between Drivers and Mechanics;
• Process Mechanic subscription payments via Stripe and manage billing lifecycle;
• Deliver push notifications, verification codes, transactional SMS (if you opt in), and account emails;
• Generate repair-cost estimates, maintenance schedules, and vehicle-data lookups (see Section 5 on AI processing);
• Prevent, detect, and investigate fraud, abuse, spam, phishing, and unauthorized use; enforce our Terms; and moderate user-generated content (including URL blocking + Safe Browsing checks on shop website links);
• Maintain, secure, back up, and improve the Service; debug and monitor performance;
• Comply with legal, regulatory, tax, and law-enforcement obligations;
• Aggregate or de-identify data for internal analytics and product improvement (in a form that cannot reasonably identify you).

We do not use your personal information for cross-context behavioral advertising, and we do not "sell" or "share" personal information as those terms are defined by the CCPA/CPRA.

4. Service Providers, Subprocessors, and Recipients

Mecha uses the following third-party service providers to operate the Service. Each is bound by a written contract that restricts their use of your information to providing services to Mecha.

• Amazon Web Services, Inc. (US) — database (RDS PostgreSQL), file storage (S3), content delivery (CloudFront), DNS (Route 53), secrets, and infrastructure. Sees: substantially all account, shop, appointment, message, review, and vehicle data.
• Supabase, Inc. (US) — authentication (email, phone OTP), edge-function runtime, cron scheduling. Sees: email, hashed password, session tokens, phone numbers used for verification, edge-function request payloads.
• Stripe, Inc. (US) — subscription billing and Customer Portal for Mechanics. Collects card and payment data directly (we do not receive full card numbers). Provides us with Stripe customer/subscription IDs, subscription status, and billing metadata.
• Anthropic, PBC (US) — repair cost estimates and vehicle data lookups via the Claude API. Sees: vehicle year, make, model, optional trim, and the service term. Anthropic contractually does not train models on data submitted via API.
• Google LLC — (a) Firebase Cloud Messaging for Android/web push notifications (device tokens, notification payloads); (b) Safe Browsing v4 API for validating shop website URLs (URLs only, no user identifiers); (c) OAuth sign-in if you use "Continue with Google."
• Apple Inc. — Apple Push Notification service (iOS push) and Sign in with Apple (if used).
• OpenStreetMap Foundation (Nominatim geocoding, EU) — reverse geocode shop addresses to lat/lng. Sees: the address string you enter; no user identifiers.
• NHTSA vPIC / Recall API (US Government) — vehicle recall lookups. Sees: VIN and vehicle metadata; no user identifiers.
• Twilio, Inc. (US) — SMS delivery for phone verification and, where enabled, transactional appointment reminders. Sees: mobile phone number, message body.
• GoDaddy.com, LLC (US) — domain registrar for trymecha.com (no user data).

We may disclose your information as required to (i) comply with law, subpoena, court order, or other valid legal process; (ii) enforce our Terms; (iii) protect the rights, property, or safety of Mecha, our users, or the public; or (iv) in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case successor entities will remain bound by this Policy (or provide notice of change).

Mecha does not sell your personal information for money, and we do not share it for cross-context behavioral advertising.

5. AI-Generated Content and Automated Processing

Our repair-cost estimator and vehicle-data lookups use Anthropic's Claude large language model. For each request, the following is sent to Anthropic: vehicle year, make, model, optional trim, mileage bucket, and the service term you're asking about — with no account identifier, name, email, or IP. Anthropic contractually does not train general-purpose models on API data.

Responses may be cached in our database for up to 30 days so repeated queries do not re-trigger the model.

AI output is advisory only and may be inaccurate. See Section 9 of the Terms of Service for the corresponding no-reliance disclaimer. We do not make automated decisions with legal or similarly significant effects about you.

6. Push Notifications, Email, and SMS (TCPA)

Push notifications: if you grant permission, we send device-level pushes for new messages, appointment requests / confirmations / reminders, safety alerts (e.g., open recall on your vehicle), and optional in-app tour hints. You can revoke permission at any time in your OS or browser settings. We do not use push for marketing.

Email: we send transactional email (verification, billing, account, safety) to the address on your account. We do not send marketing email unless you separately opt in.

SMS text messages: if you provide a mobile phone number and opt in to SMS (for example, to verify your phone for the shop-website feature), you consent under the federal Telephone Consumer Protection Act (TCPA) to receive verification and transactional messages, which may be sent by automated system. Message and data rates may apply. Message frequency varies. Reply STOP to any SMS to unsubscribe or HELP for help. Consent is not a condition of any purchase. We do not send marketing SMS.

7. Cookies, Local Storage, and Similar Technologies

Our website and app use browser storage (cookies, localStorage, sessionStorage, IndexedDB) and mobile-app equivalents (AsyncStorage on iOS/Android) for essential functionality only: keeping you signed in, remembering your preferences and in-progress form state (e.g., onboarding draft, review-prompt cooldowns), and caching data for performance. We do not use third-party advertising or analytics cookies.

You can clear these at any time via your browser or device settings, but doing so will sign you out and reset in-app preferences.

8. Data Retention

We retain personal information for as long as your account is active and for a limited period thereafter to satisfy legal, tax, accounting, and fraud-prevention obligations. See the retention column in Section 2 for per-category periods.

If you request account deletion, we will remove or de-identify your personal data within 30 days, subject to the following carve-outs:

• Reviews you posted about a Mechanic may remain publicly displayed (with your name replaced by "Former user") to preserve marketplace integrity.
• Financial and billing records may be retained up to 7 years to meet US tax and accounting requirements.
• Backups may temporarily retain your data for up to 90 days pending routine backup expiration.
• Records of moderation actions and safety events may be retained as required by law.

9. Data Security and Breach Notification

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information, including: TLS encryption in transit; encryption at rest on the primary database and file storage; salted password hashing handled by Supabase Auth; least-privilege access controls for our staff; regular dependency and infrastructure security updates; rate limiting on write endpoints; server-side URL / content moderation; and Google Safe Browsing checks on shop website links.

No system is perfectly secure and we cannot guarantee absolute security. If we discover a security incident that affects your personal information, we will notify you and any required regulator without undue delay, and within the timeframes required by applicable state breach-notification laws (typically 30–60 days).

10. Your Privacy Rights

Rights available to all users:

• Update your profile, phone, vehicles, and shop details via account settings.
• Delete vehicles, favorites, or your entire account (Profile → Delete my account). Account deletion takes effect after a 7-day grace period during which you can restore it; after that your data is permanently removed.
• Disable push notifications via OS/browser settings.
• Reply STOP to any SMS to opt out of further messages.
• Contact us at contact@trymecha.com with any privacy question or request.

California residents (CCPA / CPRA). You have the right to:

• Know the categories and specific pieces of personal information we hold about you, the sources, purposes, and recipients (see Sections 2, 3, 4).
• Request a copy of the personal information we hold about you in a portable format.
• Request correction of inaccurate personal information.
• Request deletion of your personal information (subject to legal / financial retention).
• Limit the use and disclosure of sensitive personal information — Mecha already limits SPI to what's necessary to provide the Service.
• Opt out of "sale" or "sharing" of personal information — Mecha does not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of. We honor Global Privacy Control (GPC) browser signals as a "do not sell/share" preference for any future changes.
• Not be discriminated against for exercising these rights.

To exercise these rights, email contact@trymecha.com (subject: "CCPA Request") from the address on your account. We will verify your identity and respond within 45 days. You may designate an authorized agent to make a request on your behalf; the agent must provide written permission signed by you.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Delaware, Iowa, Indiana, Tennessee, Montana, New Hampshire, New Jersey, Minnesota, Maryland, and other US states with comprehensive privacy laws. You have rights comparable to California residents' rights above, including:

• Right to confirm we process your data;
• Right of access;
• Right of correction;
• Right of deletion;
• Right of data portability;
• Right to opt out of targeted advertising, sale, and profiling with legal or significant effects (Mecha does none of these; there is nothing to opt out of);
• Right of appeal — if we deny any request, you may appeal via reply to our response, and if we deny the appeal, you may contact your state Attorney General's consumer-protection division.

Nevada residents (NRS 603A). You may email us to opt out of any sale of covered information. Mecha does not sell covered information.

EEA / UK / Swiss residents (GDPR / UK GDPR). Where GDPR applies, our legal bases for processing are (a) performance of a contract when you have an account; (b) legitimate interests in operating a secure marketplace, preventing fraud, and improving the Service; (c) legal obligation; and (d) consent, where required (e.g., non-transactional SMS). You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority. We are not currently offering the Service to EEA/UK residents; if you access it from those regions, contact us to exercise your rights.

11. Children

Mecha is not directed to children under 13 and we do not knowingly collect personal information from anyone under 13. Driver accounts require users to be at least 16 years old (a house rule set above the federal COPPA minimum), and Mechanic accounts require at least 18 years old. If you believe a child under 13 has provided us with personal information, email contact@trymecha.com and we will investigate and, where confirmed, delete the account without requiring parental verification of the child's identity.

12. Apple App Tracking Transparency (ATT)

Mecha's iOS app does not track you across other companies' apps and websites, and we do not use the IDFA (advertising identifier). We do not trigger the App Tracking Transparency prompt because we do not engage in "tracking" as Apple defines it. If we ever introduce such a feature, we will request permission via the ATT prompt and update this Policy.

13. Cross-Border Transfers and Data Location

The Service is operated from the United States and our infrastructure (AWS, Supabase, Stripe, Anthropic) is US-hosted. If you access the Service from outside the United States, your personal information will be transferred to and processed in the United States, which may have data- protection laws different from those in your country. By using the Service, you consent to that transfer.

14. Data Brokers and "Sale"

Mecha is not a data broker under California Civil Code § 1798.99.80 or comparable laws in other states. We do not buy or sell personal information about consumers with whom we have no direct relationship.

15. Third-Party Links and Shop Websites

The Service may display links to third-party websites (for example, a Mechanic's opt-in shop website). Those sites are governed by their own privacy policies. Even though we require shop links to pass Google Safe Browsing checks and display a warning interstitial before opening, we do not endorse or control the content or privacy practices of those third- party sites. Use them at your own discretion.

16. Changes to This Policy

We may update this Privacy Policy as the Service evolves. If we make material changes (for example, expanding the categories of data we collect, adding a new third-party service provider that receives your data, or changing how we use it), we will notify you at least 30 days before the changes take effect via in-app notice or email to the address on your account. Non-material changes take effect on the Effective Date at the top of this page. Your continued use of the Service after a change takes effect constitutes acceptance.

17. Contact

Questions about this Privacy Policy or to exercise any of the rights described in Section 10: