Privacy Policy — Wash Map

Welcome to Wash Map ("we", "us"). This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our mobile application.

1. Data Controller

Data Controller: Maxim Sargarovschi (Individual Developer)
Location: Chisinau, Republic of Moldova
Contact: dev.swiftstein@gmail.com

2. Information We Collect

2.1 Personal information you provide

• Account details: name, email, phone number
• Vehicle details: car make, model, license plate (optional)
• Authentication data: password (hashed and encrypted)

2.1.1 Business owners also provide

If you register as a car wash business owner, you provide:

• Business name and descriptions
• Business address and GPS coordinates
• Business phone number and email
• Photos of your facility (stored in Firebase Storage)
• Business logo (optional)
• Service offerings and pricing information
• Operating hours and status

Note: This business information is publicly visible to app users.

2.2 Automatically collected information

• Location data (only with your permission) to find nearby car washes
• Device information: OS version, device model, unique identifiers
• Usage and analytics data (pseudonymised) and crash reports
• Push notification tokens (FCM)

2.3 Third party sources

• Firebase (Google) for cloud storage and push notifications
• Mapbox for mapping and location services
• Google Sign-In for OAuth authentication (when you choose to sign in with Google)
• Sign in with Apple for authentication (when you choose to sign in with Apple)

2.4 Third-Party Authentication Providers

Google Sign-In:

When you sign in with Google, we collect:

• Google ID token (for authentication)
• Google user ID
• Email address
• Display name (if provided)

Sign in with Apple:

When you sign in with Apple, we collect:

• Apple identity token (for authentication)
• Apple user identifier
• Email address (or private relay email if you choose to hide it)
• First name and last name (if provided)

This information is used solely for account creation, authentication, and linking your account across devices. We do NOT access any other data from your Google or Apple accounts, including contacts, photos, or other personal information.

Managing OAuth Connections:

• Google: Visit https://myaccount.google.com/permissions
• Apple: Settings > Apple ID > Password & Security > Apps Using Your Apple ID

3. How We Use Data

• Provide core services: search, booking, navigation
• Manage user accounts
• Send transactional communications (booking confirmations)
• Improve and secure the app (analytics, fraud prevention)

4. Data Storage, Retention & Security

Data is stored on secure servers. We retain account data while your account is active. When you delete your account, your personal data is anonymized immediately (phone, email, password, and other personally identifiable information are removed). Booking history is preserved in anonymized form for business operations, analytics, and legal compliance (accounting, tax obligations).

All transmissions use HTTPS/TLS. Passwords are hashed. Access is limited to authorized personnel.

5. Sharing & Disclosure

We share data with:

• Service providers: Firebase (Google) for cloud infrastructure and push notifications, hosting providers
• Authentication providers: Google and Apple (only the profile data you authorize during sign-in)
• Business partners: Car wash owners receive booking information for reservations made at their location
• Legal authorities: When required by law or court order

6. Your Rights

• Access, rectify, erase, restrict processing, data portability, objection, withdraw consent
• To exercise these rights contact: dev.swiftstein@gmail.com (subject: GDPR request)

7. Children's Privacy

The app is not intended for children under 16 years. We do not knowingly collect data from children under 16.

8. International Transfers

Your data may be transferred to countries outside your residence. We use appropriate safeguards (standard contractual clauses or adequate protections) where required.

9. Third-party services

We use Firebase (for cloud storage and push notifications) and Mapbox (for mapping). Location data is processed in real-time and not permanently stored.

Firebase: Privacy Policy
Mapbox: Privacy Policy

OAuth Authentication Services

Google Sign-In:

When you sign in with Google, we use Google's authentication service to verify your identity. Google may collect data about your use of authentication services. Review Google's privacy policy at https://policies.google.com/privacy

Sign in with Apple:

When you sign in with Apple, we use Apple's authentication service. Apple provides privacy features including email relay and limited data sharing. Review Apple's privacy policy at https://www.apple.com/legal/privacy/

Apple's Privacy Features: Apple allows you to hide your email address by using a private relay email (like xyz@privaterelay.appleid.com). This means we may receive a relay email instead of your actual email address. Apple will forward messages to your real email address.

You can revoke access to these services at any time through your Google Account settings or Apple ID settings.

10. Legal basis & Regional Compliance

European Union & EEA: GDPR applies. Legal bases: consent, contract performance, legitimate interest.

Republic of Moldova: Legea nr. 133/2011 privind protecția datelor cu caracter personal and Legea nr. 17/2018 privind libera circulație a datelor în spaţiul naţional de date.

Ukraine: Law of Ukraine "On Protection of Personal Data" (No. 2297-VI) applies to Ukrainian residents.

You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

11. Changes to this Policy

We may update this policy. Material changes will be notified via the app or email.