This policy explains how the ScanWrench iOS app, scanwrench.com, optional accounts and cloud features, purchasing services, compatibility contributions, and support workflows process information. Joshua Black is the founder and publisher responsible for operating ScanWrench (“ScanWrench,” “we,” “us,” or “our”). ScanWrench is the controller of personal information it receives through these services.
Your three data modes
Where available in the app, you choose how a diagnostic session is retained:
- Device only: eligible scans and notes remain in local app storage unless you export, share, or deliberately submit them.
- ScanWrench account: you may sign in to use the eligible sync, entitlement, contribution, or support features identified in the app.
- Save nothing: the app uses session data to perform the requested work without adding the diagnostic record to ScanWrench history. Temporary memory, vehicle-side records, operating-system activity, adapter behavior, and separately requested network calls are not the same as saved ScanWrench history.
There is no silent conversion from device-only or save-nothing use to cloud diagnostic storage. A workflow that uploads evidence identifies the submission before it is sent.
Information you provide
You can use core diagnostic features without creating an account. If you create one, we process your email address, display name, internal user ID, authentication provider and tokens needed to maintain the session, and optional organization or profile information. We use these data to authenticate you, sync eligible features, associate purchases, protect access, and provide account deletion.
If you create a vehicle-profile draft, compatibility contribution, publisher application, professional case, fleet or ReturnProof record, support request, or correction report, we receive the information you choose to submit. This can include vehicle application, adapter and firmware details, diagnostic observations, timestamps, notes, evidence hashes, photos, and contact information. Do not place a full VIN, access credential, face, license plate, or unrelated personal information in free-text or support fields.
Vehicle and diagnostic data
The app communicates with a vehicle only after you choose an adapter and initiate a connection. Diagnostic trouble codes, readiness, freeze frames, live readings, supported vehicle identifiers, scan notes, and evidence records are stored locally by default under the mode you selected.
When you request a VIN decode, recall lookup, safety record, complaint search, manufacturer communication, fuel-economy match, or similar public-data feature, the identifier or year, make, and model needed for the request is sent to ScanWrench's service or the identified public source, such as NHTSA. We use it to return that result and operate the requested feature—not for advertising.
A diagnostic record otherwise leaves your device only when you deliberately export or share it, submit an eligible evidence workflow, or activate a clearly identified cloud feature. ScanWrench does not sell vehicle or diagnostic data.
EV pilot and connected-vehicle evidence
The EV pilot application asks for a contact email, broad region, model group, model year, evidence goals, owner authority, and pilot consent. The contact address is encrypted and stored with a separate keyed hash. The application does not request a VIN, Tesla password, precise location, phone number, route, license plate, media, occupant data, or payment information. Applying does not connect a vehicle or start telemetry.
If a selected owner separately connects a supported provider account, the provider handles the password and sign-in screen. ScanWrench receives the minimum approved authorization tokens and vehicle reference needed to operate the requested read-only evidence session. Tokens and provider vehicle references are encrypted and kept out of evidence exports. A raw VIN may be used transiently to address the authorized provider vehicle, then replaced in evidence with a keyed pseudonymous vehicle binding.
The EV Flight Recorder requests a bounded allowlist such as charging, returned range estimates, pack electrical values, temperature extrema, odometer, and energy context. It excludes precise location, saved places, media, occupants, camera, audio, and general vehicle commands. Server-streamed provider telemetry requires account custody during collection and is not labeled Device Only or Save Nothing. You can stop recording or disconnect the provider, subject to limited records needed for security, evidence integrity, disputes, or law.
Public EV findings are unavailable below ten distinct pseudonymous vehicle bindings. A published aggregate removes individual bindings and does not contain raw VINs, contact addresses, routes, locations, or raw telemetry. ScanWrench does not represent the pilot as a representative population study, manufacturer validation, battery-health certification, warranty decision, or safety determination.
Bluetooth, local network, and location
Bluetooth is used to discover and communicate with compatible adapters. Local-network access is used for Wi-Fi OBD-II adapters. Foreground location is requested only when you start a feature that needs trip or nearby context and grant the permission. Precise route samples used by the production app are held for the active trip and are not uploaded; saved trip summaries omit route points. ScanWrench does not use location for advertising or cross-app tracking.
Purchases and entitlements
Apple processes App Store payment information. RevenueCat receives purchase history, subscription status, product identifiers, an anonymous or account-linked app user ID, and limited device and transaction information so ScanWrench can validate receipts, prevent purchase fraud, restore access, operate entitlements, and understand subscription performance. ScanWrench does not receive your full payment-card number.
Purchase records may remain with Apple and RevenueCat even after you delete a ScanWrench account because they maintain transaction, tax, fraud, refund, and platform records under their own obligations. Deleting a ScanWrench account does not cancel a subscription; cancellation occurs through Apple.
Support and communications
When you contact ScanWrench, we process your contact details, request category, message, and the technical context you voluntarily include to answer, investigate, secure, and document the request. The public support form intentionally rejects attachments and asks you not to send a full VIN. We do not ask for passwords, one-time codes, key or immobilizer credentials, or full payment-card details.
An Android beta-access request uses the Google account email you enter and any optional device or Android-version description only to review tester eligibility and reply about access. Approval is manual. The request is private support correspondence and is not marketing consent.
Service communications concern account access, security, purchases, support, or material product changes. A newsletter or marketing email, if offered, requires its own signup flow and unsubscribe control. We do not treat a support request as marketing consent.
Website operation and analytics
Our hosting and security providers may process routine request information such as IP address, device and browser type, requested page, timestamps, coarse network location, and error or security logs to deliver, diagnose, and protect the website. We do not use third-party advertising trackers.
ScanWrench uses Google Analytics to understand site performance, page paths without query strings, navigation categories, broad country or region, device and browser information, and interaction events such as article opens, visible reading milestones, scrolls, and outbound App Store clicks. Article measurement uses the public article slug and bounded engagement milestones; it does not capture the text you read or anything from a vehicle. ScanWrench does not send diagnostic records, VINs, support-form contents, names, email addresses, advertising identifiers, or precise location through website analytics. Advertising storage, ad-user-data, ad-personalization, and Google Signals are disabled.
The Google tag may load for visitors who have not turned analytics off. In the EEA, United Kingdom, and Switzerland, analytics storage is denied until you affirmatively allow it; Google may receive limited cookieless measurement and consent-state signals during that period. In other regions, non-advertising analytics is enabled by default unless you turn it off. Read Google's business-data privacy information for details about how Google processes measurement data.
You can turn analytics off and continue using the public website. Use the “Privacy choices” control on any page to allow or withdraw analytics. Withdrawing records the preference on that browser, sends a denied consent state when the tag is present, and prevents optional analytics from loading after refresh.
How and why we use information
Depending on the feature and the law that applies, we process information for the following purposes and legal bases:
- Provide the service or take requested steps: connect the selected workflow, return public vehicle data, maintain an account, validate a purchase, restore an entitlement, sync an eligible record, or answer support.
- Your consent: optional analytics where required, location permission, a deliberate evidence submission, optional cloud use, and any future marketing signup. You may withdraw consent without affecting earlier lawful processing.
- Legitimate operational interests: secure the service, prevent abuse and fraud, diagnose failures, measure non-advertising website performance, maintain evidence integrity, and improve features—balanced against your rights and data choices.
- Legal obligations and claims: comply with valid legal process, financial and transaction obligations, protect safety and rights, and establish or defend legal claims.
Where a jurisdiction does not use these legal-basis categories, we process information only for the purposes disclosed here or with another lawful notice or permission.
Automated and generated outputs
Diagnostic Coach, compatibility states, Lemon Tracker indicators, parts matching, and similar features may use rules or generated analysis to organize vehicle evidence and suggest questions or tests. They do not make decisions that produce legal or similarly significant effects about you. They do not determine legal lemon status, credit, insurance, employment, guilt, driver abuse, or guaranteed vehicle condition. A person should review the underlying evidence before acting.
Service providers and disclosure
We disclose information only as needed to operate the feature you request or meet a legal obligation. Providers can include Apple for authentication and purchases, Supabase for accounts and eligible cloud records, RevenueCat for purchase validation and entitlement analytics, Google for website measurement under the choices above, hosting and security providers, connected-vehicle providers selected by the owner, and public vehicle-data services. Each provider processes data under its agreement with us or its own disclosed terms.
We may disclose information when reasonably necessary to comply with valid law or legal process, protect a person or system, investigate fraud or abuse, or complete a business reorganization where the recipient must honor this policy or provide legally required notice. We do not sell personal information or share it for cross-context behavioral or targeted advertising.
International processing
ScanWrench and its providers may process information in the United States and other countries where they operate. Privacy laws can differ from those where you live. When law requires a transfer safeguard, we use the provider and contractual or other lawful mechanism appropriate to that transfer. Device-only records that you do not submit are not transferred to ScanWrench.
Retention and deletion
We keep information only while reasonably needed for the disclosed purpose, taking into account your storage mode, account status, feature integrity, security, fraud prevention, disputes, transaction records, legal obligations, and whether data can be de-identified. In practice:
- Device-only scans and trips remain until you delete them or remove local app data.
- Save-nothing diagnostic history is not added to ScanWrench storage after the session.
- Account and eligible cloud records remain while the account or requested feature is active, then are deleted or de-identified subject to necessary security, dispute, transaction, and legal records.
- Support and correction records remain only as long as reasonably needed to answer, preserve review integrity, protect security, resolve disputes, and meet legal obligations.
- Compatibility evidence may be retained in de-identified or aggregated form when needed to preserve the integrity and audit history of a published compatibility state.
- Apple, RevenueCat, Google, and public-data providers apply their own retention rules to information they independently process.
You can delete local records in the app and signed-in users can request or perform cloud-account deletion through ScanWrench. Deletion from an active system may not remove a record that another person or independent provider separately controls, information already exported by you, or a minimally retained record required by law or security.
Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, or obtain a portable copy of personal information; object to or restrict certain processing; withdraw consent; opt out of sale, targeted advertising, or certain profiling; and appeal a denied request or complain to a privacy authority. ScanWrench does not sell personal information, use it for targeted advertising, or use qualifying personal data for legally significant profiling.
Submit a privacy-rights request through the official ScanWrench intake. We may need to verify your identity and authority before completing a request. We will not discriminate against you for exercising an applicable privacy right. An authorized agent may submit a request where law allows, but we may verify both the agent's authority and the user's identity.
U.S. state disclosures
For U.S. state privacy laws, the categories we may collect are identifiers and account information, purchase and entitlement records, internet or device activity, coarse network-derived location, precise location only when you activate and permit an applicable feature, vehicle and diagnostic submissions, support communications, and inferences limited to the diagnostic or compatibility feature requested. We collect these categories from you, your device at your direction, Apple and authentication providers, adapters and vehicles you lawfully connect, and public vehicle-data sources. We use and disclose them for the purposes and provider categories described above.
ScanWrench does not offer a financial incentive in exchange for personal information. A Founders price or subscription promotion is a product offer, not payment for personal data.
Security
ScanWrench uses transport encryption, platform-protected local storage, scoped access controls, signed evidence mechanisms where identified, and data minimization. No system is perfectly secure. Protect your device and sign-in provider, and report a suspected vulnerability or account issue through ScanWrench security.
Children
ScanWrench is not directed to children under 13 and we do not knowingly collect their personal information. If local law sets a higher age for consent to an online service, a parent or guardian must provide any consent that law requires. Contact us if you believe a child submitted personal information so we can review and take appropriate action.
Changes and contact
We may update this policy as the product, providers, or law changes. The effective date above identifies the current version. We will provide additional notice when a material change requires it.
Send privacy questions, rights requests, or deletion requests through the official ScanWrench intake. Review the Terms of Use for product, account, and purchase conditions.