Castly Privacy Policy

Last updated: 14 October 2026 · Covers the Castly app for iPhone and iPad

The short version

Castly has no account, shows no ads and does not track you. It keeps the photos of the cars you scan, what it found out about them, your credits and your purchases, all tied to a random number made on your device. It also counts, without knowing who you are, which screens are opened and which steps are taken, so the app can be made better. You can delete everything from the app at any time.

1. What Castly collects

The photos you scan

When you scan a car, the part of the photo you framed is uploaded so the car can be identified and priced. The photo is kept with the car in your Garage, together with the result: its name, year, series, marks, condition and recent sold prices. A photo that could not be read is deleted within minutes.

A random identifier

Because Castly has no accounts, a random identifier is created on your device the first time you open the app. It ties your cars, credits and purchases to you, and it is kept in your device's keychain, so reinstalling the app on the same device brings them back. It contains nothing about you. It is shown in Settings as your support ID.

Reports you send

If you report a wrong answer, the reason you chose and any note you wrote are kept with that car so the answer can be checked.

Purchases

Payments are made through Apple. Castly never sees your payment details. A purchase validation service confirms your subscription and credit purchases using your random identifier, and your credit balance and its history are kept so your credits are correct on every device you restore to.

Notifications

If you allow notifications, a notification token is kept so Castly can tell you when a scan you left has finished. Nothing else is sent by notification.

Product analytics

Castly records which screens are opened and which steps are taken, such as finishing the introduction, opening the plans, starting a scan or buying credits, together with the app version, the device model, the system language and the approximate country or city worked out from the network address. These counts use a random app instance identifier that is separate from your support ID and is not tied to your Garage, your photos or your name. They are used only to see how the app is used and where it can be improved, never for advertising.

2. What Castly does not collect

• No name, email address, phone number or password
• No crash reports, and no analytics tied to your Garage or your identity
• No precise location, contacts or advertising identifier
• No tracking across other companies' apps or websites, so Castly never shows the App Tracking Transparency prompt

The base codes you type in, your haptics setting and the order of your shelf stay on your device.

3. Who processes your data

• Image recognition providers receive the photo you scan, only to identify the car
• Image search and market listing services receive the photo or the car's name, only to find matching items and recent sold prices
• Cloud hosting provider stores your Garage, photos, credits and reports
• Purchase validation service receives your random identifier and receipt data, never card numbers
• Notification delivery service receives your notification token and the short message that a scan has finished
• Analytics service receives the screen and step counts described above, with the app instance identifier
• Apple processes payments and runs the App Store, as an independent controller

Your photos are not used to train AI models, and the providers are not permitted to use them for training. The names of the providers are available on request at me@berkaydonmez.dev.

4. How long it is kept

• Cars, photos and results: until you remove them, delete your data, or 12 months after you last opened the app
• Photos that could not be read: deleted within minutes
• Reports: as long as the car they belong to
• Analytics counts: at most 14 months, then deleted by the analytics service
• Notification tokens: 12 months after they were last renewed; a phone still in use renews its token at its next scan
• Purchase and credit records: as long as needed for your credits and for legal and tax obligations

5. Deleting your data

Remove one car from its page with Remove from Garage. Delete everything with Settings, Delete My Data: every car, photo and report is removed from your device and from Castly's servers at once. Your plan and credits stay, because they are not data about your cars. To also have your random identifier and purchase records erased, email me@berkaydonmez.dev with the support ID from Settings; it is done within 30 days and confirmed by reply.

6. Your rights

You have rights of access, correction, deletion, restriction, objection and portability under the GDPR, and equivalent rights under the CCPA/CPRA if you live in California. Castly does not sell or share personal information. To use any of these rights, email me@berkaydonmez.dev with your support ID; requests are answered within one month. In Türkiye you also have the rights in Article 11 of the Personal Data Protection Law No. 6698 (KVKK) and may complain to the Personal Data Protection Authority. In the EEA and the UK you may complain to your supervisory authority (in the UK, the ICO).

7. Legal bases

Contract, to identify and price the cars you scan and keep your Garage and credits; legitimate interest, to prevent abuse of credits and to improve the app from anonymous usage counts; consent, for notifications; and legal obligation, for purchase records.

8. Where it is processed

Data is processed in the United States, the European Union, Türkiye and other countries where the providers above operate. Where required, transfers rely on safeguards such as Standard Contractual Clauses.

9. Children

Castly is not directed to children under 16, and personal information is not knowingly collected from them. If you believe a child has used Castly, contact me@berkaydonmez.dev and the data will be deleted promptly.

10. Security

Data is encrypted in transit and stored in access-controlled cloud storage, where each photo sits at an address that cannot be guessed. No system is completely secure; risk can be reduced but not eliminated.

11. Changes and contact

This policy is updated as Castly changes, and the date above always shows the current version. Berkay Dönmez is the data controller. Contact: me@berkaydonmez.dev.