Privacy Policy

What we collect and how we use it

Account and sign-in information

We use your email and account ID to sign you in, keep your session secure, and deliver updates you request. Our sign-in provider stores a password hash for accounts that still use a password.

Starting an alert or account setup

When you submit your email to start setup on the website, we record the address, the time and where setup began so we can see whether it was completed. We keep these records in OttoQuest’s database. Starting setup does not subscribe you to emails.

Subscriptions and payments

Stripe processes web Pro payments; Apple processes subscriptions purchased in the iOS app. We keep a random billing reference, subscription status, plan and renewal date to provide your membership across devices. RevenueCat receives purchase and subscription records using that random reference. We do not send your account name or email to RevenueCat, and we do not store your full card number.

Alerts and preferences

We save your searches, alert frequency, watched vehicles, and default search area if you set one. We use these settings to find matches and send the updates you choose.

Saved cars

We store the VIN of a car you save and the mileage, state, and trim you give us. We use these details to estimate its value and send the updates you request. Your saved car list is private.

Optional iOS location

When you choose Use current location, the app sends approximate coordinates to suggest a nearby city. You can choose your shopping area manually instead.

Optional iOS notifications

If you enable push notifications or Live Activities, we associate Apple’s delivery tokens with your account and app installation so we can send the alerts you choose.

Optional mobile number

We keep your number and the time you opted in if you choose text alerts. Text alerts are not live yet. You can remove the number from your account at any time.

Cookies and analytics

When you allow optional advertising cookies, we use Meta Pixel and, when configured, Meta’s Conversions API to measure visits, searches, saved cars, alert setup, completed registrations, checkout and paid subscriptions from our Facebook and Instagram ads. Meta receives event types, permitted public page context, its browser or advertising click identifiers, and purchase amount and currency for confirmed purchases. We do not provide names, email addresses, phone numbers, authentication IDs, VINs, search text or form contents for advertising matching. Automatic advanced matching and automatic event collection are disabled in our implementation. Tracking is suppressed on private token URLs and URLs with unapproved parameters.

Advertising tracking starts only after you choose Allow. You can decline or withdraw permission using Ad privacy choices. We also suppress it when Global Privacy Control or Do Not Track is enabled. Declining does not affect your alerts, account or Pro access.

Sign-in cookies keep you signed in. A temporary cookie can hold a pending action for up to an hour while you sign in. Some saved searches can stay in your browser until you add them to your account.

We use Google Analytics to count visits to public pages. We send page categories and referring domains. The analytics tag excludes private account and VIN report pages, and we configure it without ad personalization signals. OttoQuest skips its analytics tag when your browser sends Global Privacy Control.

We use PostHog to measure public page visits, app screens, and interactions such as requesting a valuation or saving an alert. PostHog receives random session or installation IDs, page or screen categories, broad traffic-source categories (such as search or social platforms), event types, and subscription outcomes. When signed in, a random billing identifier connects activity across the website and iOS app. RevenueCat also sends subscription lifecycle events to PostHog. We exclude names, email addresses, authentication account IDs, search terms, VINs, form contents, and payment details. Website usage analytics honors Global Privacy Control and Do Not Track.

Who processes information

We use service providers for hosting, sign-in, storage, service emails, and analytics. Apple delivers iOS push notifications and Live Activities. These providers receive information needed to provide their services. We do not sell your email or saved car list. When you authorize a connected app, it can access the information covered by the permissions you approve.

Retention and your choices

After 30 days of inactivity, we remove an address from onboarding records the next time someone starts setup.

We keep account and saved information while you use those features. From Your account you can change your settings, remove your mobile number or saved cars, or request account deletion. Deletion removes your saved cars, searches, watched vehicles and mobile number, stops those updates, and queues the sign-in account for deletion.

You can also stop alerts using the unsubscribe link in each email. For questions or to request access, correction, or deletion of your personal information, email support@ottoquest.com. We may need to verify that the request is yours.

On iOS, use Saved → Phone alerts to turn off device alerts. Signing out or deleting your account also removes its device registration.