Privacy Policy

We collect the minimum needed to run a parts store — nothing is collected for its own sake:

• Account data — email address and password (password handling is managed by our authentication provider; we never see or store your password itself).
• Order data — items, amounts, contact email, and a shipping name/address snapshot needed to fulfill and account for your order (kept for tax and warranty obligations).
• Garage data — vehicles you save (year/make/model/trim) so fitment answers are instant.
• Inquiry data — what you send through the services/contact forms, plus the submitting IP address for abuse prevention.
• Security logs — rate-limit and security events, kept to protect the platform. Account and guest identifiers are shortened and email addresses are masked before they are written; the submitting IP address is recorded in full.
• Promo redemptions — when you use a promo code, we record the code together with a normalized form of your email address (and your account ID if you were signed in) so each code can only be used once per person. That record is what enforces the limit, so it is kept even if you later delete your account — it contains no name, no address, and no order contents.

All card entry happens on Stripe's hosted checkout page. Card numbers are never received, transmitted, rendered, or logged by this site — we store only Stripe's reference IDs and the card brand and last four digits Stripe reports back for your receipts.

We set only cookies the store cannot work without: your session, your cart, and your saved garage. There is no third-party ad or analytics tracking, which is why you don't see a cookie consent banner — there is nothing non-essential to consent to. If that ever changes, consent will be asked first.

Four processors, each getting only what its job needs: Stripe (payments), our database/auth provider (Supabase — storage encrypted at rest), our hosting platform (Vercel — serves the site and, like any host, sees request logs including IP addresses), and our email provider (transactional messages only — order confirmations and inquiry acknowledgments). We do not sell or rent personal data. Ever.

• Deletion — delete your account yourself, at any time, from your account page. It takes effect immediately: your sign-in, garage, cart and the messages you have sent us are erased for good. Order rows we must keep for tax law are anonymized — your email, name and shipping address are stripped from them and they are no longer linked to you. Prefer to ask us instead? Requests are still honored within 30 days.
• Export — ask, and you receive a machine-readable JSON export of your personal data.
• Correction — vehicles in your garage can be added or removed directly in your account. Anything else — your email address, an order's shipping details — is corrected by asking us.

Requests go through the contact form and are honored within 30 days.

Privacy questions reach the same humans as everything else — via the contact page. The responsible legal entity and registered address are available on request while this page completes legal review, and will be published here.