Privacy

Analysis data

CarWise is a decision-support tool and does not replace a professional mechanical inspection. Seller statements are not independently verified, and AI-assisted findings are clearly labeled.

Data handling

Authenticated reports are private to the account owner. Signed anonymous identifiers and trusted-proxy-derived client addresses are HMAC-hashed for abuse prevention; raw addresses are not stored in the usage ledger. Anonymous reports are not stored server-side. When you request an analysis, selected vehicle context and optional seller text may be processed by configured Google Gemini services; listing URLs are not sent to Gemini. CarWise also stores first-party aggregate visit events for up to 90 days: normalized route, locale, coarse country/region, device and browser class, and referrer domain. Approximate anonymous uniqueness uses a day-scoped HMAC. Raw analytics IPs, full user agents or referrer URLs, precise location, advertising identifiers, and sensitive demographics are not stored.

Explicit report sharing

Saved reports remain private by default. A report owner can explicitly create a revocable, unlisted share link. Anyone who receives that link can view the privacy-safe saved snapshot without signing in. Public snapshots exclude the raw seller description, listing URL and account details. Disabling or regenerating sharing invalidates the previous link, and shared reports are marked not to be indexed by search engines.

Necessary cookies and browser storage

Better Auth uses secure, HTTP-only cookies for sessions and temporary authentication flows. CarWise uses the signed, HTTP-only cw_guest cookie for anonymous abuse protection for up to one year. Locale routing may store NEXT_LOCALE, and the theme preference is stored locally under theme until changed. The analyzer draft and completed browser report use sessionStorage keys carwise-analyzer and carwise-analysis-result and expire when the browser session ends. These mechanisms support requested functionality or security. The first-party visit counter creates no cookie or browser-storage entry. Google receives authentication data only if you choose Google sign-in; Resend receives an email address only for requested account emails. No advertising, marketing, third-party analytics, or optional analytics storage is used.

CarWise uses privacy-minimized first-party aggregate statistics, but no advertising, third-party analytics, or optional analytics cookies. No consent banner is shown on that basis. Consent requirements must be reassessed before optional tracking or advertising is introduced.