Carcenzus privacy policy

Last updated: November 12, 2026 · Covers: the Carcenzus app for iPhone and carcenzus.com

The short version

• You can browse the feed, the cars and the picks without an account. You sign in to post what you paid, check a dealer quote, comment, mark Helpful, add a car you own, or rate it.
• Other people see you as a member: a username, never your name, phone number or email. What you post, comment and own shows with that username.
• A price you post shows the car, the date on your bill of sale, the final price paid and its extra charges. You choose whether it also shows the dealership, your city and your payment.
• Your bill of sale and your ownership proof are never published. Only our reviewers can open them, and we delete them a year after the decision.
• Quote checks are private: only you see them.
• Claude, an AI model made by Anthropic, reads your photos and picks cars only if you allow it. It works in the United States.
• No ads, no third-party trackers, and we never sell your information.
• We store your information in Canada, in Amazon Web Services' Montréal region, except email you send us, which Google Workspace keeps in the United States or other countries where Google has data centres. A few services work from the United States; they're listed below.
• You can delete a post, a comment, a car you own, or your whole account in the app at any time.

Who we are

Carcenzus is responsible for the personal information it collects.

Our privacy officer is Yiukit Cheung, founder. Write to support@carcenzus.com with "Privacy" in the subject.

We plan to move Carcenzus to its own company. If we do, we'll tell you in the app before your information moves, and the promises in this policy will move with it.

What we collect and why

Almost everything comes from you, through the app. Apple or Google send us an account ID when you sign in with them. Some technical data comes automatically when the app connects to our servers.

We don't collect:

• your name or your email. We don't ask Apple for them. Google's sign-in token includes them; we read only the account ID and discard the rest;
• your phone's location. You pick your area yourself, and the app removes location data from photos before they're uploaded;
• your trade-in, down payment, VIN, or any name or address on a bill of sale, except in the photo itself;
• card or bank details. Carcenzus is free, with no in-app purchases;
• your contacts, or anything from your microphone;
• which screens and buttons you use. This version of Carcenzus doesn't record usage stats. If a later one does, it will ask first, and stay off until you allow it.

We don't keep your phone number. If you sign in with it, we use it to text you a code, and keep only the keyed hash above.

Kept only on your phone: a post you haven't finished, a photo until you upload it, your answers for picks and your saves until you sign in, and your sign-in tokens (in the iPhone's Keychain).

We don't use your information to show ads, build marketing profiles, train AI models, or sell or rent it to anyone.

What's public and what's private

Everyone can see, in the app, and on carcenzus.com for a post or a car someone shares (search engines may list those pages):

• your member: your username, your standing (Member, Verified buyer or Trusted contributor), the month you joined, your city if you chose one, the cars you're a verified owner of (the model and year, with your car photo once approved), how many verified prices you posted, how many people found you helpful and how many saved your prices, and your newest posts;
• each price report you post: your username and standing, the car, the date on your bill of sale, the final price paid with its sales tax and discount, each extra charge as your bill names it, freight & PDI, whether it's In review or Verified, and how many people marked it Helpful or commented. Also, unless you turn them off: the dealership's name (its city always shows), your city, and your payment, rate and term with the payment by the math. Anyone can work out how much you financed from those;
• your comments and replies, with your username, and a Verified owner badge naming the car when you own the model;
• medians of prices paid, and each model's owner score once 3 owners have rated it.

Never shown to other people:

• your account, your sign-in, your phone number, your Apple or Google account;
• your bill-of-sale photos, ownership proof and anything on them, which only our reviewers can open;
• the trade-in, the down payment and the amount financed on your bill;
• your quote checks and their photos;
• your answers for picks, and your picks;
• one owner's car rating. Only averages show, and they move once a night so no single rating shows through;
• whom you saved, marked not useful, reported or hid. A poster sees how many people saved their prices, never who;
• how many cars you rated, which only you see.

About usernames. Your username isn't your name. Still, a post shows the car, the dealership, the day and the price. The dealership that sold you the car, or someone you told about your deal, might recognise it. Turn off the dealership or your city to make that harder. If you think something we show could identify you, write to us and we'll take it down.

Who handles your information

At Carcenzus. Our reviewers, a small group of team members, open bill-of-sale photos, ownership proof that Claude couldn't check or that you sent without allowing it, and reported posts, comments and members, so they can decide on them. The people who run Carcenzus can reach stored information only to operate it, fix problems or answer your requests, and they must keep it confidential.

Service providers. These companies process information for us under contract, and may use it only to provide their service to us.

Services you choose. If you sign in with Apple or Google, they handle that step under their own privacy policies, and they know you use Carcenzus. Apple also runs the App Store and TestFlight: if you've agreed in your iPhone's settings to share analytics with app developers, Apple may give us crash reports and app statistics, and if you test a beta, Apple passes on the feedback you send us through TestFlight.

We never sell or rent personal information. We don't share it with dealers, carmakers, lenders or advertisers. When a dealership objects to a post, we never tell it who posted. We disclose personal information only when the law requires it, such as a valid court order, to protect someone's safety, or when Carcenzus moves to its own company.

Information processed outside Canada

We store your information in Canada, except email you send us, which Google Workspace keeps in the United States or other countries where Google has data centres. Some is processed in the United States:

• photos you allow Claude to read: dealer quotes, bills of sale, ownership proof and car photos;
• your answers for picks, if you allow picks with Claude;
• notifications, through Expo and Apple;
• update checks, through Expo, which receives the app version and a random ID for this install;
• signing in with Apple or Google, if you choose them.

There, it's subject to US law, and courts, law enforcement and national security authorities may be able to access it. Questions about our service providers outside Canada go to our privacy officer.

If you live in Québec: AWS's Montréal region is in Québec. Before any of your information is processed outside Québec, we assess the privacy risks and sign a written agreement with the provider, as Québec law requires.

How long we keep it

The table above gives each period. Also:

• When price reports are deleted or removed, we work out medians again without them. We don't keep anonymous copies.
• When you delete a comment, its words go. If others replied to it, it stays as "Comment deleted", without your username, so the replies still make sense.
• Deleted information can stay in our encrypted backups for up to 35 days, until they're replaced.
• We keep bill-of-sale photos and ownership proof a year after the decision because privacy law in Québec and British Columbia gives you a year to ask to see the information used to decide about you. No law currently requires us to keep anything else longer. If that changes, we'll tell you what we keep and for how long.

Your choices and rights

Choices in the app

• Browse without an account.
• Choose what each post shows when you post it: the dealership, your city and your payment. To change it afterwards, delete the post and post it again, or write to us.
• Choose your city in Edit profile, or none.
• Picks with Claude are off until you allow them. Pick without AI instead, or turn Claude off later in Profile.
• AI reading of your photos happens only with your permission. Type the lines in instead. Withdraw it in Profile.
• Notifications are off until you allow them in iOS. Turn replies off in Profile, or all notifications in your iPhone's Settings.
• Hide a member's posts and comments with "Hide this person", and undo it in Profile → Hidden people.

Delete in the app

• A post: in My posts, swipe it left and tap Delete. It comes off the feed with its photo, its comments and their Helpful.
• All your posts: Delete my posts, in My posts.
• A comment: tap Delete under it.
• A car you own: in Profile → Your cars, swipe it left and tap Remove. Its proof, its car photo and your rating of it go too.
• A quote check: Delete this check, on the check.
• Delete my account (Profile) removes everything tied to your account, right away: your posts with their bill-of-sale photos, and the comments and Helpful on them; your comments, ratings, cars you own with their proof, quote checks, saved posts and answers for picks. A comment others replied to stays as "Comment deleted". It also ends Carcenzus's access to your Apple or Google sign-in, and deletes your sign-in record. Copies in our encrypted backups are gone within 35 days. Signing in again starts a new account, with a new username.

Ask us at support@carcenzus.com

• Access: a copy of the personal information we hold about you, and how we use it.
• Portability: the information you gave us in a structured, commonly used format, sent to you or to an organization you name that's allowed to receive it.
• Correction: we'll fix anything inaccurate, including a price you posted.
• Withdraw consent: at any time, subject to legal or contractual limits. We'll tell you what it changes. For example, an account can't work without a sign-in ID.
• Take it down: if something Carcenzus shows could identify you, or harms your reputation or privacy, ask us to stop showing it.
• No account? Information tied only to this install, such as reports you made signed out and "Tell us" requests, can be deleted too. Include the install ID shown in Profile → Help and contact. Deleting the app stops all collection.

We answer within 30 days, free of charge. We may ask you to confirm that a request is yours, and we use what you give us only for that.

Complaints. Please contact us first. You can also complain to:

• the Office of the Privacy Commissioner of Canada (priv.gc.ca);
• in Québec, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca);
• in Alberta, the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca);
• in British Columbia, the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).

Minimum age

Accounts are for people 18 and older. You don't need an account to browse, and Carcenzus isn't meant for children; we don't knowingly collect their personal information. If we learn that an account belongs to someone under 18, we delete it. A parent who thinks their child has shared information with us can write to us.

Reading photos with AI

Claude can read the photos you add, so you don't have to type every line. It's optional.

• We ask first. Before your first photo of a dealer quote or a bill of sale, and again before your first ownership proof, the app explains what happens and asks for your permission. If the explanation changes, it asks again.
• Who reads it. Claude, an AI model made by Anthropic, on Anthropic's servers in the United States (the Claude API).
• What we send. Only the photos, with their location and other hidden data removed. Never your name, username, account or contact details. Cover your name, address, VIN, licence and policy numbers and signature before you take the photo; leave the prices readable.
• What Claude reads. On a dealer quote or a bill of sale: the vehicle line, each line's words and amount, the total, the trade-in and the payment. On ownership proof: what kind of document it is, the car's year, make and model, and whether the date can be read. On a car photo: whether it shows a car, a licence plate or a face. A read that shows a VIN, a phone number, an email address or a postal code in a line is thrown away.
• What Anthropic keeps. Anthropic deletes the photos and what it read within 30 days, keeps them longer only if its systems flag them for misuse or the law requires it, and doesn't use them to train its models.
• What we keep. A dealer quote's photo goes as soon as it's read, and within 24 hours if the reading fails. A bill of sale you post stays as your proof, as above. What Claude read from a bill is kept 24 hours, and only the lines you confirm are posted.
• Check the result. AI can misread a line, so check each one before you rely on it or post it.
• Without it, type the lines in; then nothing goes to the AI. Your bill of sale still goes to a reviewer as proof.

How we choose your picks

After you pick your area, the app asks five questions, each of which you can skip, and offers to pick up to three cars that fit.

• We ask first. "Yes, pick with Claude", "Pick without AI" and "Not now" are offered side by side. Without Claude, a fixed score ranks the cars, with fixed sentences.
• Our code filters first. Only cars that fit your budget and seats, and the body type and power you chose, are ever considered.
• What we send Claude. Your answers (whether your budget is monthly or a total, but never its amount), your area, and the sourced specs of the cars that fit. Never your name, account, install or contact details.
• What Claude does. It chooses among those cars and writes the reasons. Our code keeps a reason only if every figure in it matches the car's sourced specs, and fills any gap with the fixed score.
• What's kept. Anthropic keeps what we send as it does for photos, above. We keep your answers as the table says, and of the request only that it was made, for 2 days.
• Picks are suggestions. They don't decide anything about you, and they don't change what the feed or a quote check shows.
• Change your mind in Profile: turn picks with Claude off, or redo the questions.

Messages we send

• Sign-in codes by text: a 6-digit code to your Canadian mobile number, when you ask for one.
• Notifications you allow: replies to your posts and comments (at most one an hour for each thread), your bill of sale or ownership proof checked, the outcome of something you reported, and a removal, a suspension or the answer to an appeal. They name the car, never a price or a username.
• No marketing. We don't send promotional messages. If we ever want to, we'll ask for your permission first, and every message will let you unsubscribe.

How we protect it

• Information is encrypted in transit (HTTPS) and where it's stored.
• Proof photos sit in private storage. Reviewers open them through links that expire after 5 minutes.
• The app removes location and other hidden data from photos before upload, and our servers remove it again before Claude reads a photo.
• Phone numbers are kept only as a keyed hash. Apple sign-in tokens are encrypted.
• Your sign-in tokens stay in your iPhone's secure storage (the Keychain).
• Only the people who need personal information can reach it.
• Comments can't carry links, phone numbers or email addresses, so nobody posts yours by mistake.

No system is perfectly secure. If a breach creates a real risk of significant harm to you, we'll tell you and the privacy commissioners, as the law requires.

Decisions made by software

• Ownership proof is checked by software, with your permission. Claude reads the photos, and our code decides whether they match the car you added: the make, model and year, and a readable date. No person takes part unless the check can't give an answer, or you sent the proof without allowing it. The app tells you the result and, if it didn't match, why. You can send another photo, or write to us and a person will look at it.
• A person decides everything else about you: whether a bill of sale matches its post, and whether a reported post, comment or username stays up.
• Suspensions follow fixed rules set out in our terms of use, counted from removals a reviewer decided. So do the limits, such as 3 posts a day. If one stops you, the app tells you why, and you can ask a person to look at it.
• Information only: the line marks on a post or a quote check (Required, Negotiable, Add-on) come from the province's fee rules, and picks are suggestions. Neither decides anything about you.

Not offered in this version

Earlier test versions of the app had a service check, service invoices, My car, following a car, saved comparisons and "Notify me" when a coming brand goes on sale. This version doesn't offer them. If you used them, what you gave us stays covered by this policy until it's deleted on its schedule, or with your account.

Changes to this policy

When we change this policy, we post the new version here with its date. If a change matters to you, such as a new use of your information or a new place where it's processed, we'll tell you in the app before it takes effect, and ask for your consent where the law requires it.

Contact

Carcenzus Privacy officer: Yiukit Cheung support@carcenzus.com (put "Privacy" in the subject)