RevID Privacy Policy

RevID collects what the service needs to work and to keep it safe:

• Account identifiers and credentials: your user ID and email address from Apple or Google sign-in (if shared), or the email address and password you choose. Passwords are stored only in hashed form by our authentication provider (Supabase Auth). If you reset your password, we send the reset email through our email provider.
• Profile information you provide: username, display name, bio, location text, avatar photo, and your date of birth. Your date of birth is used to confirm you meet the minimum age of 16, is checked on our servers, is stored in a private table for as long as your account exists, and is visible to nobody else.
• Vehicle information you add: license plate, make, model, year, engine size, colour, nickname, ownership history, photos, and modification notes.
• Posts, photos, videos, comments, stickers and GIFs you upload or send, including any location text and vehicle tags you attach to a post.
• Direct messages and group chat messages you send to other users.
• Which posts you like, save, and view. We use this to rank your home feed (showing you more of what you engage with and less of what you’ve already seen) - see "How your data is used" below.
• Plate waitlist: if you choose "Let me know if it joins" for a plate nobody has claimed, we link your account to that plate so we can tell you when it joins.
• Vehicle verification recordings: if you verify a vehicle, a video (including your voice) of you reading a code and showing the dashboard and number plate, which RevID staff review, plus a contact email address for status emails. Ownership-dispute evidence photos are handled the same way, as set out in the retention section.
• Marketing email preference: marketing emails are off by default. If you opt in, we store that choice and the time you gave it; you can withdraw it in Settings → Notifications.
• Push notification tokens, so we can deliver notifications.
• Sign-in and device records: when you sign in we record your IP address, user-agent (browser or app), device model and a city derived from the IP address. This is what you see under "Where you’re logged in" so you can spot and end sessions you don’t recognise. We also keep records of your install source and app version.
• App diagnostics: crash and reliability events from the mobile app are on by default and are linked to your account ID (they are pseudonymous, not anonymous). Optional product analytics and masked session replay are collected only if you opt in. See "Analytics, session replay and cookies" below.
• Website and web app analytics, session replay and crash reports, only if you accept the consent banner (also covered below).
• Camera, microphone and photo library access, when you use them: to take or choose photos, to record video for a post (which may include audio) or a verification, or to scan a physical number plate with your camera. Plate scanning uses on-device text recognition; the camera images are not uploaded for it.
• Plate lookups: if you look up a UK number plate - by typing it in or scanning it - we look up UK vehicle and MOT history via DVSA’s (Driver and Vehicle Standards Agency) official trade data service and cache the result. RevID holds the credentials for this lookup; you don’t need your own DVSA account.
• GIF search: the GIF picker is provided by GIPHY. When you use it, your search text and your IP address are sent to GIPHY.
• Share-to-find (mobile app): if you share a TikTok or other link, or a screenshot, into the app, it is processed on your device. A link’s page is loaded in a hidden web view on your device, any cookies it needs are read on your device, and screenshot text recognition runs on your device. The link may be sent to our share-resolve server function to find the video.

• No ads.
• No tracking across other apps or websites.
• No selling of your data to advertisers or data brokers.
• No sharing your content or activity outside RevID, except with the service providers named in the next section.

We use the following processors and recipients, only for the purposes described in this policy:

• Supabase: database, authentication, file storage and server functions.
• Vercel: hosts revid.uk and app.revid.uk, and keeps request logs including IP addresses.
• OpenAI: automated content moderation (see "How your data is used").
• PostHog: analytics, session replay and crash/diagnostic events.
• Expo, Apple and Google: delivering push notifications.
• Resend: transactional email such as email verification codes and verification status emails (password-reset emails are sent by our authentication provider, Supabase).
• GIPHY: GIF search.
• DVSA / DVLA: the source of vehicle and MOT data for plate lookups.
• Apple and Google: sign-in, if you choose it.

We may also disclose information to law enforcement or other authorities where the law requires it or to protect people from serious harm (see our Child Safety Standards).

Your data and media are stored on Supabase, our hosting provider. Data is transmitted encrypted and access is restricted by database-level security rules (row-level security) scoped to your account.

Messages: direct messages and group chats are stored on our servers rather than end-to-end encrypted, so that features like reporting abuse can work. They’re protected the same way as the rest of your data - encrypted in transit and at rest, and scoped by row-level security so only participants in a conversation can read it. We do not automatically screen direct messages; we review them only if they are reported.

Some of our providers - including OpenAI, Resend, Expo and Vercel, and possibly PostHog and Supabase - process data outside the UK. Where they do, the transfer relies on UK adequacy regulations or on safeguards such as the UK International Data Transfer Agreement or the UK Extension to the EU-US Data Privacy Framework / standard contractual clauses where relied on.

Primarily to run the service: showing your profile and vehicles to other users, delivering posts and messages, sending notifications, verifying vehicle ownership, and moderating content to keep the community safe. Under UK GDPR we rely on:

• Contract - to run your account and provide the service you asked for: your profile, garage, posts, messages, feed, plate lookups, notifications, password-reset and service emails.
• Legitimate interests - to keep RevID safe and working: moderation and report handling, age checks, vehicle verification and fraud prevention, security and sign-in records, and the operational diagnostics and crash events linked to your account ID. You can object to this (see "Your rights").
• Consent - for marketing emails, optional product analytics and masked session replay, website and web app cookies and analytics, and the camera, microphone and photo-library permissions on your device. You can withdraw consent at any time.
• Legal obligation - for child-safety reporting to the authorities and responding to lawful requests.

Content moderation: we automatically screen content using OpenAI’s moderation API shortly after you post: post captions and overlay text, comment text, post images, the cover frame and five frames extracted from each video, and user-uploaded stickers (as images). That content is sent to OpenAI for the sole purpose of detecting policy violations - none of it is used for advertising or sold on. We do not automatically screen audio, direct or group messages, avatars, bios, usernames, vehicle photos or notes, or GIFs; these can still be reported and are reviewed by people if they are.

Feed personalization: we use your likes, saves, and which posts you’ve already viewed to rank what appears in your home feed and to avoid repeatedly showing you the same posts. This is a lightweight interest signal (e.g. which hashtags/topics you engage with most) used only to order your own feed - it is not shared with other users or third parties.

Feedback: when you choose Settings → Add feedback, the app may first request an Apple App Store or Google Play review. Your rating, selected usage category, and any optional feedback text are then sent to PostHog for product improvement. Feedback is voluntary; do not include sensitive information.

If our automated screening flags a post, it is hidden from feeds automatically until a person reviews it. This is an automated decision that can affect you. People can restore or remove the post, and you can ask for a human review or contest the outcome by emailing support@revid.uk. Reports made by other users are reviewed by people.

PostHog is our analytics and diagnostics processor. We use its EU region (eu.i.posthog.com). PostHog is not used to build advertising profiles or for cross-app tracking.

Mobile app. Operational diagnostics and crash events are on by default and are linked to your account ID. That makes them pseudonymous, not anonymous: we can connect them to your account. Our lawful basis is legitimate interests (keeping the app reliable). Optional product analytics (coarse feature usage and screen views) and masked session replay are collected only after you opt in, and you can turn them off at any time in Settings → Data & privacy. Replay is configured to mask text inputs, passwords, images, messages, captions, emails, and sensitive vehicle fields. We do not send plate numbers, raw request bodies, media URLs, or private message contents as analytics properties.

Web app (app.revid.uk) and website (revid.uk). Analytics, session replay and crash reports load only after you accept the consent banner. Before that, PostHog is not loaded and sets no cookies. Your choice is stored in your browser, and you can change it at any time with “Cookie settings” in the website footer, or in the web app under Settings → Usage data. If you accept, PostHog may use cookies or browser storage.

PostHog currently retains analytics events for up to 12 months and session recordings for up to 30 days, subject to earlier deletion, project configuration, or a valid data-rights request.

• Deleting your account (Settings → Delete account, in the app or web app, or at revid.uk/delete-account) removes your profile, vehicles, posts, messages and files straight away - except where there is a safety concern (next point).
• Safety concern: if your account has an open or upheld report, a strike or ban, a copyright strike, a child-safety report, or a safety hold, deleting it closes the account and hides it from everyone instead. We keep a minimal record (your username, email address and strike information) and the relevant content as evidence for up to 12 months and then permanently delete it. We keep it longer only under a legal hold requested by law enforcement. Dismissed reports alone do not prevent deletion.
• Date of birth: kept in a private table for as long as your account exists, and deleted with it (or at the end of the safety retention period above).
• Read notifications are automatically deleted after 30 days.
• "Already seen" feed history (which posts you’ve viewed, used only to avoid repeating them in your feed) is automatically cleared after 30 days.
• Verification videos are deleted automatically 7 days after upload. If the account is under a safety hold or has an open report, the video is kept for the investigation, for no longer than the safety retention period above. Verification photos (used as dispute evidence) are kept until the case closes and are deleted with your account.
• Deletion feedback (the reason you pick and any optional note) is not linked to your account and is retained after your account is gone.
• PostHog events are retained for up to 12 months and session recordings for up to 30 days (currently). Voluntary feedback sent to PostHog follows the same retention and deletion controls.
• Content you post, and messages you send, are kept for as long as your account exists (or until you delete that item yourself), so the service can keep working for you and the people you interact with.
• If a post has been reported, we keep it (hidden from other users) even if you delete it, so it can still be reviewed as part of that report.

Plate and vehicle data (make, model, year, colour, MOT status) for a plate that no RevID member has claimed is public DVSA data. We show it only to signed-in users; logged-out visitors are asked to sign in. Claimed cars have public pages. We never show keeper names or addresses.

If you’re in the UK or EU, UK GDPR / the Data Protection Act 2018 (and EU GDPR) give you the following rights over your personal data. We respond to requests within one month (this can be extended for complex requests, and we will tell you if so) and do not normally charge a fee.

• Access: ask what data we hold on you, or request a copy (email us).
• Rectification: correct inaccurate profile or vehicle data, in-app or by email.
• Erasure: delete your account and its data at any time, in-app under Settings, or at revid.uk/delete-account without installing the app. Deletion is immediate and does not require emailing anyone, except for accounts with a safety concern, which are closed and retained for a limited time as described above. We also retain the deletion feedback described above.
• Portability: request an export of the data you gave us, in a common machine-readable format, by email.
• Restriction & objection: ask us to limit how we use your data, or object to a particular use (including anything we do on the basis of legitimate interests), by email.
• Withdraw consent at any time: marketing emails in Settings → Notifications; app analytics and replay in Settings → Data & privacy; web app analytics in Settings → Usage data; website analytics via “Cookie settings” in the website footer.
• Automated decisions: ask for a human to review a moderation decision (see section 7).
• Ask us to delete or export PostHog data associated with your account; we will verify the request and coordinate it with our processor.
• Edit or remove your profile, vehicles, posts, and photos in-app.
• Block users and report content or messages in-app.
• Complain: raise a concern with us directly by emailing the address below, or lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk, 0303 123 1113) at any time.

RevID is not intended for children under 16. Onboarding asks for your date of birth and blocks account creation if you’re under 16. People aged 16 and 17 are children under UK law; we take extra care with their data and accounts and apply the same moderation and reporting tools to protect them.

If this policy changes materially, we will notify you in the app.

Data controller: RevID Ltd, company number 16973478, registered office 42 Lord Street, Kearsley, Bolton, England, BL4 8BE.

Privacy questions, data requests, or complaints: support@revid.uk