Política de Privacidade

1. Data controller

• Operator: Dream Car Garage
• Address: Granada, Spain
• Contact email: privacy@dreamcargarage.app

2. Data we collect

We collect the following personal data:

2.1 Registration data

• Email address
• Password (stored as bcrypt hash, never in plain text)
• Name (optional)
• Username (auto-generated from email)

2.2 Google OAuth data

If you sign in with Google, we receive your name, email address, and profile picture from Google. We also store OAuth access tokens necessary for authentication.

2.3 Usage data

• Garage collections (vehicle selections, names, descriptions)
• Evolution timelines (collection stages)
• Likes and user follow data
• Scores and view counts (public garages)

2.4 Technical data

• IP address: used in server memory for 15 minutes to limit login attempts. Where we keep a record (security logs and, if you turn it on, app usage analytics), we store only a salted hash of the IP, never the address itself.
• Cookie preferences and consent

2.5 Beta waitlist

If you join the Android beta waitlist, we collect the email address you submit for the sole purpose of inviting you to test the app. The lawful basis is the consent you give when you sign up. You can leave the waitlist at any time via the unsubscribe link included in the confirmation email.

2.6 App usage analytics

The Android app has its own usage analytics, off by default. Only if you turn it on in Settings, Privacy & Visibility, Usage analytics, the app sends us the screens you visit and the features you use, with a session identifier, your account if you are signed in, the user agent and a hash of your IP address. You can turn it off at any time from the same setting. This data stays on our infrastructure in the EU.

2.7 Ads in the Android app (Google AdMob)

The Android app shows ads served by Google AdMob: banners, native ads placed among the app's content and marked as sponsored, full-screen ads between screens or when you return to the app, and rewarded ads. A rewarded ad plays only when you choose to watch one for a reward the app states first, such as one more guess in a daily game. The website does not use AdMob.

Google's ad software in the app can read your device's advertising identifier and receives technical information about your device and about the ads it shows you. The app asks Google to limit every ad to content rated for general audiences (G). It also asks Google's consent service (the User Messaging Platform) whether consent to personalised ads is required where you are, as it is in the European Economic Area and the United Kingdom. Unless that service reports that consent has been obtained or is not required, every ad request asks for non-personalised ads, which are not based on your interests.

The ad setting follows the member who is signed in. If your year of birth (see 2.8) shows that you are certainly 18 or over, the app uses the standard setting, which follows the consent rule above. Everyone else, including anyone who is signed out, has not given a year of birth or may be under 18, gets the protected setting: every one of their ad requests asks for non-personalised ads, even where consent has been given, and is tagged as coming from a user under the age of consent.

For a reward our server grants, such as an extra guess, Google confirms directly to our server that you watched the ad. That confirmation carries a single-use code our server created for the offer and Google's reference for the view, not your advertising identifier, and we keep it with your game so that each reward is granted only once.

You can reset or delete your advertising identifier in your Android settings. Google explains how it uses this information at policies.google.com/technologies/partner-sites.

2.8 Year of birth

You can add your year of birth in the app; it is optional. We use it only to keep the ads you see suitable for younger players. The year itself is never sent to any ad network: the app derives a protected or standard ad setting on your device, and only that setting goes with the ad request. If you leave it blank, the protected setting applies. We keep it until you clear it or delete your account, and we share it with no one. It never appears on your public profile, your garages or the leaderboards.

3. Purposes and legal bases

4. Data recipients

The AI garage builder runs on our own infrastructure in the European Union (Hetzner Cloud, Germany); your message is not sent to any external AI provider and never leaves the EU.

We do not sell, rent, or share your personal data with third parties for marketing purposes other than those described above.

5. International transfers

Your database is hosted in the European Union (Hetzner Cloud, Nuremberg, Germany). The only data transferred outside the EU is:

• Google OAuth authentication data (USA) - necessary for the service you request.
• Google AdSense advertising data (USA). Currently disabled. When reactivated, only if you accept advertising cookies. Google LLC is certified under the EU-US Data Privacy Framework.
• Google Analytics GA4 data (USA). Currently disabled. When reactivated, only if you accept analytics cookies. Google LLC is certified under the EU-US Data Privacy Framework.
• Google AdMob advertising data from the Android app (USA). Google LLC is certified under the EU-US Data Privacy Framework.

The AI garage builder does NOT transfer data outside the EU: inference runs on an open-source model hosted on our own infrastructure in the European Union.

6. Data retention

• Account data: while the account is active.
• Your AI builder commissions: kept until you delete them or your account.
• Record of AI builder requests (your description, the result and technical details of the request, used to run the builder and protect it from abuse): kept until you delete your account. Deleting a commission does not remove this record.
• Year of birth (optional): until you clear it or delete your account.
• App usage analytics (see 2.6): 12 months; events linked to your account are deleted sooner if you delete your account.
• Security and activity logs: 12 months, then deleted automatically.
• Session data (JWT): 7 days.
• IP data for rate limiting: 15 minutes (in memory, not persistent).
• Consent records: for the duration of the contractual relationship plus 5 years.

7. Your rights

Under the GDPR (Articles 15 to 22) and the Spanish LOPDGDD, you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data ("right to be forgotten").
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Restriction: request restriction of processing in certain circumstances.

To exercise any of these rights, contact us at privacy@dreamcargarage.app. We will respond within one month.

For data processed directly by Google (advertising and analytics), you can manage your preferences and request deletion through Google's privacy controls at myaccount.google.com.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

8. Children

In accordance with Article 7 of the Spanish LOPDGDD, children under 14 require parental or guardian consent to register on Dream Car Garage.

9. Security

We implement technical and organisational measures to protect your data, including: encryption in transit (HTTPS/HSTS), password hashing (bcrypt), security headers (CSP, X-Frame-Options, X-Content-Type-Options), rate limiting on authentication endpoints, and a restrictive permissions policy.

10. Cookies

For detailed information about the cookies we use, see our Cookie Policy.

11. Changes

We reserve the right to update this privacy policy. Any changes will be posted on this page with the revised update date. We recommend checking this page periodically.