Privacy Policy

PitPulse (“we,” “us”) is operated by an individual sole proprietor based in California. This policy explains what we collect through getpitpulse.com and the PitPulse app, why we collect it, and what control you have over it.

Business contact: PitPulse. Email contact@getpitpulse.com for privacy questions or requests. For written privacy requests, you may also write to PitPulse at 9204 Opal Crest Ct, Elk Grove, CA 95624.

What we collect

We collect only what the product needs to function:

• Vehicle Identification Number (VIN) — used once, in the moment, to look up your vehicle's year, make, model, engine and fuel type against the public federal NHTSA vPIC database. We never store it on our servers.It is stripped from the vehicle record before that record is written. It stays temporarily in your own browser's session storage, with a local-storage backup for up to 24 hours, while setup and checkout are in progress. That is what lets the app return you to the same flow, including when hosted checkout opens a new tab. Because we don't keep it on our servers, we cannot look up your VIN, hand it to anyone, or restore it for you after the browser draft expires.
• Email address — to create your account, sign you in, and send account-security emails. Passwords are managed by Supabase and are never visible to us.
• Odometer readings and typical weekly mileage — to project when each service is actually due.
• Service history you log — what was done, when, at what mileage, and optionally cost and shop name.
• Billing information, if you subscribe — handled entirely by Stripe. We never see or store your card number. We keep only your Stripe customer ID, subscription status, plan, and renewal date.
• Essential technical and security information — hosting, authentication, and security providers may process your IP address, browser/device details, timestamps, and request metadata to deliver and protect the service.
• Analytics information — Google Analytics may process page views, main “Check my car” CTA clicks, online activity, device, browser, and approximate location information on the homepage and three niche landing pages so we can measure aggregate marketing performance and improve it. We do not use the site to serve targeted advertising, and setup, legal, and authenticated vehicle/account pages are excluded.

Before you subscribe, setup answers are held temporarily in your browser's session storage with a local-storage fallback for up to 24 hours so authentication and Stripe checkout can return you to the same flow. A vehicle or service record is not saved until an active subscription exists. After that, it moves to our database and becomes tied to your account.

Who we share it with

We don't sell your data, and we don't share it with data brokers, insurers, or advertisers. We use a small number of service providers to run the product, each of whom only sees what they need to do their job:

• Supabase — hosts our database and handles authentication.
• Stripe — processes payments. Stripe is PCI-compliant; we never touch raw card data.
• Resend — sends maintenance and mileage check-in emails on our behalf.
• Google Analytics — provides aggregate website-usage measurement. Google's handling of information is described in its Privacy Policy.
• Cloudflare — hosts the app at the edge and provides routing and rate-limiting infrastructure. We do not use Cloudflare Web Analytics on the customer-facing site.
• NHTSA (National Highway Traffic Safety Administration) — a public federal API. Your VIN is passed through to it once, at the moment you enter it, to decode your vehicle's specs, and is not written down on the way. The lookup is not persisted in PitPulse's data cache. Recall checks are made by year, make and model only — no VIN is sent for those. This is a one-way lookup; NHTSA does not receive your email, mileage, or any other account information.

Cookies and local storage

We use a first-party cookie to keep you signed in, and your browser's local storage only for legacy vehicle data created before the paid-only change. New setup drafts use session storage plus a short-lived local-storage fallback and are not product records. We also store your dismissal of the privacy notice locally on your device so it does not appear on every visit. PitPulse uses Google Analytics on the homepage and niche landing pages for aggregate marketing measurement, which may set analytics cookies or similar identifiers. We do not use Cloudflare Web Analytics, Google Ads, advertising pixels, or other advertising trackers.

How long we keep it

We keep your data as long as your account is active. If you delete your account, we delete your vehicles, service history, and personal information within 30 days, except where we're legally required to retain billing records longer.

Your VIN is not retained on our servers. It is never written to our database — not in a column, not inside the stored vehicle record. A browser-only setup copy expires after 24 hours or is cleared when setup completes or you start over. If you cancel or delete your account there is no server-side VIN for us to erase. Any VINs stored by earlier versions of PitPulse have been permanently erased from our database.

Your rights

You can, at any time:

• See everything tied to your account by opening it in the app.
• Correct or delete a vehicle or service entry yourself.
• Request an export or deletion of your account by emailing contact@getpitpulse.com.

California residents: under the CCPA, you have the right to know what personal information we hold, request its deletion, and opt out of its sale. We do not sell personal information, so there's nothing to opt out of — but you can still exercise your right to know or delete by contacting us above, and we won't discriminate against you for doing so.

If you're located outside the United States, including in the EU or UK, contact us and we'll honor equivalent access, correction, and deletion rights.

Security

Your data is protected by row-level security in our database — technically, that means every table is scoped so a person can only ever read or write their own records, enforced by the database itself, not just application code.

Children

PitPulse is not directed at children under 13, and we don't knowingly collect information from them.

Changes to this policy

If we make a material change to how we handle your data, we'll update the date at the top of this page and, for significant changes, email active account holders.