PRIVACY POLICY
AutoForge — Car Build Configurator · Effective October 23, 2026
AutoForge is a street car and truck build configurator developed by an independent developer in Utah, USA. This policy explains what information the app handles and where it goes. AutoForge is available as an Android app and as a web app at ape-app.pages.dev.
Summary
- Accounts are optional. Without an account (local-only mode) everything stays on your device and no name, email, or phone number is collected.
- If you create an account, we collect your email address, a Firebase user ID, and your synced builds, Garage vehicle and service schedule/log, stored on Cloudflare servers so you can use them on other devices.
- If you create a share link for a build, that build snapshot is public to anyone with the link until you revoke it.
- Service reminders are local notifications created on your device; nothing about them is sent to us.
- You can delete your account and all synced data at any time in the app or by email.
- The camera is used only to scan your VIN barcode, on your device. Camera images are not stored or uploaded.
- Vehicle details you enter (such as a VIN, year, or make) are sent to the U.S. government's NHTSA vPIC service to look up vehicle information.
- Parts and pricing searches may be sent to AutoForge's server proxy, which queries eBay.
- Text you type into Ask AutoForge (and the AI build overview on the Dyno tab) is sent to the AutoForge server and Cloudflare Workers AI to generate a response, and is not stored.
- AutoForge does not sell or share your personal information.
Accounts (optional)
You can use AutoForge without an account (local-only mode); then everything stays on your device. If you choose to create an account, we use Google Firebase Authentication to sign you in with Google or with an email and password. Firebase processes your email address, a Firebase user ID, and sign-in information needed to authenticate you (Google's privacy policy applies). We use your email and user ID only to run your account.
Sync
When you are signed in, your saved builds, Garage vehicles, and service schedules and service logs are stored on our servers (Cloudflare D1, United States) under your Firebase user ID so you can use them on other devices. This data is sent over HTTPS and stored encrypted at rest. We do not sell this data, use it for advertising, or share it with anyone; Google Firebase and Cloudflare process it only as our service providers. Synced data is kept until you delete it or delete your account. Signing out stops syncing on that device.
Shared build links (optional)
When you are signed in you can create a link to one of your builds. We store a read-only snapshot on our servers (Cloudflare D1, United States): the build name you chose, the vehicle year, make, model and configuration, and the selected parts. It does not include your email, user ID, VIN, mileage, Garage or service log. Anyone who has the link can view that snapshot, and it can be passed on, so don't put personal information in a build name. We store your user ID with the snapshot only so you can see and revoke your links; it is never shown to viewers. Revoke a link at any time in Settings > Shared links; revoking deletes the snapshot right away, and deleting your account deletes all of your shared links.
Service reminders (optional)
In the Android app you can turn on service reminders in Settings. AutoForge then schedules local notifications on your device from your Service intervals and service log (by due date, or by mileage estimated from the odometer readings you logged). Android asks for notification permission first. Reminders are created and stored only on your device; no reminder data is sent to AutoForge or anyone else. Turn them off in Settings or in Android's notification settings.
Information stored on your device
AutoForge uses your device's local storage to save your builds (build name, vehicle, configuration, and selected parts), saved dyno runs and dyno settings, your light/dark theme and accent color choice, and data-source settings (such as a proxy URL). This data never leaves your device unless you share it yourself or sign in to an optional account (see Sync above). Uninstalling the app or clearing its data (or your browser storage) deletes it.
VIN decoding and vehicle lookups (NHTSA)
When you decode a VIN or browse makes and models, the app sends the VIN or the selected make/model year directly from your device to the National Highway Traffic Safety Administration's vPIC API (vpic.nhtsa.dot.gov). A VIN identifies a vehicle, not a person, but it may be linked to you by others. NHTSA's handling of requests is governed by its own policies: nhtsa.gov privacy policy. As with any internet request, NHTSA receives your IP address.
Camera (VIN scan)
If you tap “Scan with camera”, AutoForge asks for camera permission and uses the camera only to read the VIN barcode (door-jamb or windshield sticker). In the Android app the barcode is decoded on your device by Google ML Kit; in the web app it is decoded on your device by your browser’s built-in barcode detector. Camera images are processed in memory, are never saved, and are never uploaded to AutoForge or anyone else. Only the resulting VIN text, after you confirm it, is sent to NHTSA as described above. On Android, Google’s barcode scanner module may be downloaded once through Google Play services. Google’s ML Kit library itself sends Google limited diagnostic and usage data (device model and OS version, app package name and version, performance metrics, error codes, and a per-installation identifier not intended to identify you) to keep the scanner working; it does not include camera images or the VIN. See Google’s ML Kit data disclosure. You can revoke camera permission at any time in your device settings; manual VIN entry always works without it.
Parts searches and eBay
When live pricing is enabled, the app sends a search (your vehicle year, make, model, and the parts category) to AutoForge's proxy server, which forwards it to eBay's API and returns listings. The proxy does not require or receive any account or contact information; like any web server, it and its host (Cloudflare) may briefly process your IP address and standard request logs for security and operation. If you tap "Buy on eBay," you leave AutoForge and eBay's own privacy notice applies.
Ask AutoForge and AI build overview
When you use Ask AutoForge on the Home tab, or tap “AI build overview” on the Dyno tab, the app sends the text you typed together with your selected vehicle (year, make, model, trim, engine, drivetrain), the parts in your build, any trouble codes you entered, and (for the Dyno overview) the numbers the app's dyno simulator computed, to the AutoForge server at ape-app.pages.dev. The server passes it to Cloudflare Workers AI, an AI model run by Cloudflare, to generate a response, which is sent back to your device. AutoForge does not store this text or the response and does not log it. To limit abuse, the server keeps a temporary request counter keyed to a one-way hash of your IP address that expires within about 11 minutes. Cloudflare processes the request under its own privacy policy; per Cloudflare, Workers AI does not use customer inputs to train models. Please don't type personal information (like your name, address or phone number) into Ask AutoForge. “Find a mechanic near me” opens Google Maps; AutoForge does not access your location.
eBay Partner Network affiliate links
AutoForge participates in the eBay Partner Network. “Shop on eBay” and “Buy on eBay” links include eBay Partner Network tracking parameters (campaign ID and the label “autoforge”), so AutoForge may earn a commission from eBay purchases at no extra cost to you. When you open one of these links, eBay may use cookies or similar technologies to attribute the purchase; that is governed by eBay’s privacy notice. AutoForge does not receive your name, contact details or payment information from eBay.
Advertising (planned)
AutoForge currently does not show third-party ads and includes no ad or analytics SDK. Future versions may show ads. If an advertising SDK (for example Google AdMob) is added, it may collect device identifiers such as the Android advertising ID, IP address, and app interaction data to serve and measure ads, and may show personalized ads where permitted. You can reset or delete your advertising ID or opt out of personalized ads in your Android settings. This policy will be updated, and any required consent will be requested, before such features are released.
Children
AutoForge is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children.
Security and retention
Connections to NHTSA, Firebase and AutoForge's proxy use HTTPS. Synced account data is encrypted in transit and at rest. AutoForge keeps account data only for users who create an account, and only until they delete it. Shared build snapshots are kept until you revoke them or delete your account. Data on your device stays until you delete it.
Data deletion
Account and synced data: in the app open Settings > Account > Delete account; this immediately and permanently deletes your account, all builds, Garage and service-log data stored on our servers, and all of your shared build links. You can also request account deletion by email (below). Device data: you can delete all data AutoForge stores on your device at any time: in the app open Settings > Privacy & data > Delete my data. Uninstalling the app or clearing its storage also deletes it. To request deletion of any other data, email Devbycandn@gmail.com with the subject “AutoForge data deletion request”; we respond within 30 days. Full instructions: How to delete your data.
Changes
If this policy changes, the updated version will be posted at this page with a new effective date.
Contact
Questions or requests: AutoForge, Utah, USA — Devbycandn@gmail.com