Assembly

Privacy Policy

Last updated: July 10, 2026

1. Overview

Assembly – Project Car Hub ("Assembly," "we," "our," or "us") helps users track car projects, parts, notes, files, photos, build specifications, history, and optional Community activity.

This Privacy Policy explains what information we collect, how we use it, how it may be shared, how long it may be retained, and the choices available to you. It also describes how we process information used for Community reporting, account blocking, content moderation, and enforcement.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use advertising trackers or behavioral advertising analytics.

2. Information We Collect

Information you provide

We collect information you create or add in the App, including:

• Account information, such as email address, username, display name, and authentication identifiers.
• Profile information, such as name, handle, profile photo, biography, optional location fields, profile preferences, and license-card display fields.
• Garage and vehicle information, such as vehicle year, make, model, trim, nickname, VIN, mileage, photos, and archive status.
• Project, plan, part, specification, note, and history information, including rich text, task lists, links, dates, purchase prices, odometer readings, part numbers, source URLs, and other written content.
• Photos, images, documents, CAD files, PDFs, spreadsheets, text files, and other files you upload or attach.
• Community content and activity, such as public or shared vehicle, project, or build information, posts, comments, reactions, follows, follow requests, read states, and notification preferences.
• Subscription information, such as your active plan, entitlement status, product identifier, purchase source, and subscription expiration status.

Community safety information

When you use reporting or blocking features, we may collect:

• Your account identifier and the identifier of the account or content involved.
• The type of content reported, such as a profile, post, comment, or image.
• The report reason and any optional details you provide.
• Relevant parent-content identifiers and technical context needed to locate the reported item.
• A snapshot of the reported content and related information as it appeared when the report was submitted.
• The date the report was submitted and its review deadline.
• Block records identifying the blocking and blocked accounts.
• A limited snapshot of a blocked account’s display name, handle, and profile photo so you can identify and manage that account in your blocked-accounts list.

Reports are associated with the reporting account internally. They are not anonymous to Assembly.

Moderation and enforcement information

We generate and retain information needed to review reports and enforce our rules, including:

• Report status and review timestamps.
• Moderation outcomes, such as no violation, content removal, or Community account restrictions.
• Internal moderator notes and reviewer identifiers.
• Records of Community bans, content restrictions, or reversals.
• Moderation-notification delivery attempts, timestamps, provider identifiers, and delivery errors.

Automatically collected information

We collect limited technical information needed to operate the App, including:

• Device and platform information needed for synchronization, storage, notifications, subscriptions, security, and troubleshooting.
• Expo push-notification tokens if you enable notifications.
• Synchronization and error logs related to failed sync operations, media processing, or backend requests.
• Basic API request logs, such as route, status code, request duration, and related diagnostic information.

We do not collect precise GPS location. Location fields in your profile are entered by you.

3. Device Permissions

Assembly may request access to device features only when needed:

• Camera and photo library: To add vehicle, project, profile, note, file, and Community images.
• Files and document picker: To attach documents, CAD files, PDFs, spreadsheets, and other files.
• Notifications: To send Community-related and account-related alerts if enabled.
• Motion sensor: To animate the driver-license-style profile card.
• Clipboard and sharing: Only when you choose an action such as copying content, sharing an image, or exporting data.

You can manage these permissions through your device settings.

4. How We Use Information

We use information to:

• Provide, operate, synchronize, and maintain the App.
• Authenticate accounts and protect account access.
• Store and organize garage, vehicle, project, part, specification, note, media, and file data.
• Power Community features, including posts, comments, follows, reactions, sharing settings, and notifications.
• Receive, validate, and investigate Community reports.
• Preserve evidence of reported content even if the original content is later edited or deleted.
• Hide reported content from the reporter while a review is pending where supported.
• Apply blocks in both directions across Community surfaces.
• Remove follow relationships and filter posts, comments, profiles, mentions, reactions, and notifications after a block.
• Review reports, restrict content, enforce Community rules, and prevent abuse or enforcement evasion.
• Notify authorized moderators that a report requires review.
• Process subscription access and membership status.
• Generate CAD previews and media variants when supported.
• Provide data-export and account-deletion features.
• Debug, secure, and improve App reliability.
• Comply with legal obligations and protect the rights and safety of Assembly, its users, and others.

We do not use your content for advertising, resale, or third-party behavioral profiling.

5. Storage and Processing

Your information may be stored or processed:

• On your device using local App storage and local media or file caches.
• In Supabase for database persistence, synchronization, file storage, media storage, notification records, Community safety records, moderation evidence, and backend functions.
• In Clerk for authentication and account management.
• In RevenueCat for subscription and entitlement management.
• With Expo for push-notification delivery.
• With Resend or another email-delivery provider for Community moderation alerts.
• With Apple App Store or Google Play for purchase processing, depending on your platform.
• With hosting and infrastructure providers that operate the API and related services.

Uploaded media and files are stored in Supabase storage. Private files are stored under owner-scoped paths. Media associated with Community content may be available to signed-in users who are permitted to view that Community content.

Community reports and their evidence snapshots are stored in a protected moderation database. They are not made available through ordinary Community queries.

When a moderation-alert email is sent, the email provider may receive the report identifier, reported content or account identifier, parent-content identifier, report reason, optional report details, submission time, and review deadline. The standard moderation-alert email intentionally omits the reporter’s account identifier. The complete evidence snapshot remains in the protected moderation database.

6. Community Sharing and Safety Privacy

Private workspace data is not intentionally shared with other users unless you publish or share it through Community features.

When you use Community, other users may be able to see profile information, vehicle, project, or build information, images, posts, comments, reactions, and follow activity according to your privacy settings, follow settings, and applicable moderation restrictions.

Private accounts and follow-approval settings can limit visibility, but content you publish to Community should be treated as shared content. Other users may capture, copy, or share content outside Assembly, and we cannot control copies made outside the Service.

Community notifications may include limited previews, such as an actor’s name or handle, vehicle reference, post or comment context, and notification text.

Reports

Other users cannot ordinarily access your report record, report reason, optional details, or identity as the reporter.

The reported user may learn that content was removed or that an account was restricted, and may infer that a report occurred.

We may disclose report information where reasonably necessary to investigate a safety concern, comply with law, protect rights or safety, or work with service providers and professional advisers.

Blocks

Your blocked-accounts list is intended to be visible only to you and authorized Assembly systems or personnel.

The blocked account is not given direct access to the block record or told through the blocking system who blocked them. However, they may infer that they were blocked because profiles, content, follows, or notifications are no longer visible.

Blocking may remove existing follow relationships between the accounts. Unblocking deletes the applicable block record, but does not automatically restore previous follows or follow requests.

Moderation actions

Removing content from Community does not necessarily delete the corresponding vehicle, project, image, or other original record from its owner’s private workspace. Assembly may retain a protected evidence snapshot and moderation record after Community visibility is restricted.

7. Data Sharing

We do not sell or rent personal information or share it for cross-context behavioral advertising.

We share information only as reasonably necessary to operate and protect Assembly, including with:

• Clerk for authentication and account management.
• Supabase for databases, files, synchronization, backend functions, Community safety records, and moderation evidence.
• RevenueCat for subscriptions, entitlements, paywalls, and customer-center features.
• Expo for push-notification delivery.
• Resend or another email-delivery provider for moderator alerts.
• Apple App Store and Google Play for purchase processing.
• Hosting and infrastructure providers that operate the App, API, and related services.
• Authorized Assembly personnel and administrators responsible for reviewing reports, resolving safety issues, and enforcing Community rules.
• Other Assembly users, only for Community content and activity visible under your sharing settings.

We may also disclose information:

• If required by law, legal process, or a valid government request.
• To investigate fraud, abuse, threats, or security incidents.
• To protect the rights, property, or safety of Assembly, our users, or others.
• To professional advisers or service providers subject to appropriate confidentiality obligations.

Service providers may process information only for the services they provide to Assembly and under their own applicable terms and privacy commitments.

8. Data Retention and Deletion

We retain information while your account is active or as reasonably necessary to operate, secure, and support the App.

Block records are generally retained until you unblock the account, either account is deleted, or the record is otherwise removed. The associated blocked-profile snapshot is deleted with the block record, subject to temporary backups or logs.

Reports, evidence snapshots, moderation decisions, and enforcement records may remain after a report is resolved or after the original content is edited or deleted. We retain these records as reasonably necessary to document moderation decisions, detect repeat abuse, protect users, enforce our rules, resolve disputes, and comply with legal obligations.

You can delete many types of content in the App. Deleted Community records may leave limited deletion or synchronization records so other devices can remove cached copies.

Assembly includes in-app account deletion. Account deletion is designed to remove:

• Assembly database records associated with your account.
• Community reports in which your account is the reporter or reported content owner.
• Block records in which your account is either party.
• Stored media and notification records.
• Your Clerk account.
• Your RevenueCat subscriber record where deletion is configured and supported.

Operational logs, backups, moderation-alert emails, email-provider records, purchase records, and other provider records may remain for a limited period where required for security, reliability, legal compliance, provider operations, or dispute resolution.

Purchase records may remain with Apple, Google, RevenueCat, or other providers according to their own policies.

You may also request deletion by contacting:

tom@driverevivetinker.com

9. Data Export and Your Choices

You can access, edit, and delete much of your information in the App.

Assembly provides an iOS data-export feature that creates a local export containing supported locally stored App data and available media. The standard export may not include protected moderation records, internal moderator notes, report evidence, security logs, provider records, or information belonging to another user.

If you share or save an export outside Assembly, the destination application or service handles it under its own policies.

You can also:

• Manage and unblock accounts through the blocked-accounts settings.
• Control Community privacy and follow settings where supported.
• Control notification preferences in the App and through device settings.
• Control camera, photo, notification, and other permissions through device settings.
• Contact us to request access, correction, or deletion of personal information, subject to applicable law and appropriate identity verification.

Some information may be exempt from access, correction, deletion, or export where necessary to protect another person’s privacy, preserve security, prevent fraud or abuse, comply with law, or protect legal rights.

10. Security

We use reasonable technical and organizational measures intended to protect information, including:

• Secure third-party authentication.
• Authenticated API access.
• Row-level database access controls.
• Owner-scoped private storage paths.
• Restricted access to report evidence and moderation records.
• Service-role controls for the moderation queue.
• Limited data in moderator-alert emails.
• Controlled backend access and authenticated safety operations.

No system is completely secure, and we cannot guarantee absolute security.

11. Children’s Privacy

Assembly is intended only for users 18 years and older. We do not knowingly permit users under 18 to create accounts or knowingly collect personal information from children.

If we learn that a person under 18 has provided personal information in violation of our eligibility requirements, we will take reasonable steps to suspend the account and delete the information as appropriate.

A parent or guardian who believes a minor has provided information may contact us at the address below.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted in the App or on our website with a revised "Last updated" date.

Where required by law, we may provide additional notice or request consent before materially changing how we use previously collected information.

13. Contact

Questions or requests about this Privacy Policy, Community safety information, or your personal information can be sent to:

tom@driverevivetinker.com