Privacy Policy

Last updated: 19 September 2026

Dibs is a car spotting and collecting app. You photograph cars you come across, the app identifies them and adds them to your collection. This page explains what happens to your data.

1. Who is responsible

Dibs is made and operated by Kevin Baur, a sole trader based at Hochstraß 542, 3033 Klausen-Leopoldsdorf, Austria. I am the controller within the meaning of the GDPR. You can reach me at apps@kevin-baur.com for any question about your data. Full provider details are in the Imprint.

2. Your account

Dibs creates an anonymous account the first time you open the app. You do not have to register, and I do not ask for your name, your email address or your phone number to let you use the app.

Anonymous here means: without a name and without any contact detail. Technically the account carries a random identifier under which your data is stored. In data protection terms that is a pseudonym, which is why this policy applies to such accounts too.

You can optionally add an email address and a password later, so you can sign in on a second device. If you do, that email address is stored with your account. Note that email addresses are currently not verified. No confirmation message is sent, so a typo cannot be corrected automatically. If you reset your password, an email with a link goes to the address you added; it is sent through Private Email by Namecheap, which receives your address for this. If you never add an email address, your account has no contact detail attached to it at all.

3. What is stored, and where

Publicly visible to anyone:

• Your collector handle (a random name is assigned at first start; you can change it)
• Your profile picture, if you set one
• Your level, XP, number of finds, number of distinct models and rare finds, and your weekly count; these appear on leaderboards
• The cut-out vehicle images ("stickers") from your finds, so other collectors can view your collection

Visible only to you:

• The full list of your finds, including the model, any nickname you gave a car, the place name and the GPS coordinates, and the time of the find
• Your original photos, if you have Dibs+ and they are backed up (stored privately, accessible only through short-lived signed links)
• Who you have blocked

Also stored: who you follow, and any reports you submit about other collectors or their content, including the free-text note you add to a report. In addition: who invited you and whom you invited, and how many scans your account has used, because the scan limits depend on it.

All of this is stored on Supabase, hosted on Amazon Web Services in Frankfurt, Germany (EU).

4. Photos and how cars are identified

This is the most important section, so please read it carefully.

When you take a photo, the app sends that photo to a service run by me, which passes it on to an AI provider to work out which car is in the picture. This happens over the internet and is necessary for the app's core function.

Which provider sees the photo depends on your plan. With Dibs+, it always goes to Anthropic. Without Dibs+, it may first go to OpenAI, and it is passed on to Anthropic as well only if that first result is uncertain or fails. No provider receives your name, your email address or your account; they receive the photo and nothing else.

The photo sent for identification is the original photo, before any licence plate has been obscured. Identification runs in parallel with the blurring, not after it. This means a licence plate visible in your shot may be readable in the copy that is sent. Neither my service nor I store that photo; it is passed through and discarded.

Anthropic and OpenAI process the photo on my behalf, as processors, and may use it only for identification. My contracting parties are Anthropic Ireland Limited and OpenAI Ireland Limited, and processing takes place at both in the United States (see section 14). Under the terms of these interfaces your photos are not used to train models. Both normally delete requests within 30 days and keep them longer only where a request is flagged as a breach of their own usage rules or where the law requires it.

Apart from identification, your photos stay on your device, with two exceptions: the cut-out vehicle image is uploaded and is publicly viewable (see section 3), and with Dibs+ your original photos are backed up to private storage. Anything else leaves your device only when you share it yourself.

5. Licence plates and blurring: what the app does and does not do

Dibs tries to obscure licence plates, and it does that entirely on your device using the image analysis built into iOS and Android. No image is sent anywhere for this step. Once a plate is covered, it is pixelated and then blurred, so the original characters cannot be recovered from the saved image.

You need to know the limits of this, because they matter for the people around you:

• Only the plate on the vehicle you selected is detected. Licence plates on other cars in the same photo are deliberately left alone and stay readable.
• Faces are never detected automatically. If a person is in your shot, the app will not obscure them. You can cover any area yourself by hand.
• You can tap an automatically covered plate to reveal it again, and before saving or sharing you can answer "nothing to read" and skip covering entirely. The choice is yours, and so is the responsibility for it.
• On iPhones older than iOS 17, and on Android devices without Google Play services, automatic detection is not available at all. Only manual covering works there.
• As explained in section 4, blurring does not apply to the copy sent for identification.

In short: the app helps, but it does not guarantee that every plate or every person in your photos is unrecognisable. Before you share a photo, please check it yourself.

6. Location

If you allow it, the app records where you were when you made a find, and has that turned into a place name. The app does not do this itself: the coordinates go to the location service of the operating system, to Apple on iPhone and, as a rule, to Google on Android. Both the coordinates and the place name are stored on the server with that find. This applies to every user, not only Dibs+ subscribers; Dibs+ only unlocks the map view that displays them.

Location is only requested while you are using the app. There is no background tracking. You can refuse the permission or withdraw it in your device settings at any time. The app keeps working, your finds simply have no place attached.

7. Purchases

Dibs+ is an optional purchase, handled through the Apple App Store or Google Play and managed with RevenueCat. I never see your payment details. RevenueCat receives an anonymous identifier and the purchase status; the purchase itself is tied to your store account, not to your Dibs profile.

8. Advertising

Dibs shows ads in exactly one place: when you run out of free scans for the day, you can choose to watch a video ad and receive one extra scan. Ads never start by themselves, and Dibs+ members never see any ads.

These ads are delivered by Google AdMob (Google Ireland Limited). When an ad is requested, Google receives information about your device, such as its IP address, device model, operating system and app version, and, depending on your choices, the advertising identifier of your device. Google uses this to deliver the ad, to measure it and to prevent fraud, under the Google privacy terms. Google may process data outside the EU.

Before the first ad in the EU, the EEA, the UK and Switzerland, a consent dialog provided by Google asks whether ads may be personalised. On iPhone, the system also asks whether the app may use your advertising identifier. If you decline, you can still watch ads for extra scans; they are then not personalised. You can change your choice at any time in the app under Settings, "Ad privacy", and on iPhone additionally in the system settings under Privacy, Tracking.

To credit your extra scan, Google confirms the completed ad directly to my server. For this, the anonymous ID of your Dibs account is passed along with the ad request. It lets me attach the scan to your account; Google receives no name, email address or collection data from me. I store only which account received a scan and when.

Apart from these ads, there is no analytics, no crash reporting, no attribution SDK and no tracking across other apps or websites in Dibs. There are no cookies. What applies to this website is set out in section 12.

9. Notifications

Dibs sends two kinds of notifications. Reminders are created on your device, for example about your streak or after you have been away for a while. Nothing leaves your device for these.

Notifications about other collectors are created on the server: when someone you follow makes a find, and when someone likes one of your finds. They contain that collector handle and the model name.

If you allow notifications, Dibs stores a delivery identifier for your device (a push token), your platform and your language. Delivery runs through the notification service of Expo (Expo, United States), which hands the message to Apple or Google; that is the only way it reaches your device. The message text and the delivery identifier are passed on for this.

You can switch notifications off at any time, in the app settings or in your device settings. Turning them off in the app deletes the delivery identifier; it is also removed when you delete your account or when your device stops accepting messages.

10. Maps

The map showing your own finds uses Apple Maps on iOS and Google Maps on Android. When the map is displayed, those providers receive the requests needed to render it, under their own privacy terms.

11. App updates

When it starts, the app asks Expo (650 Industries, Inc., United States) whether a newer version is available and downloads it if so. Expo receives your IP address, a random identifier of the installation and technical details such as operating system and app version. Your Dibs account is not transmitted.

12. This website

This website and the pages the app links to, such as the invitation link and the password reset, are delivered through Cloudflare (Cloudflare, Inc., United States). Cloudflare processes your IP address and technical details of your browser in order to deliver the page and fend off attacks.

This website sets no cookies and keeps no visitor statistics.

13. Legal bases

I process your data on these legal bases under the GDPR:

• Contract (Art. 6(1)(b)): your account, your finds and your collection including their public display in profiles and leaderboards, the identification of your photos, the scan counters, invitations, purchases, the Dibs+ backup and the password reset email.
• Consent (Art. 6(1)(a)): location including the place name, notifications and personalised advertising. You can withdraw consent at any time, in your device settings or in the app. Processing up to that point remains lawful.
• Legitimate interest (Art. 6(1)(f)): reports and moderation, protection against abuse and fraud including the confirmation of completed ads, app updates, and the delivery and protection of this website. My interest is a safe, fair and working service. You can object to this processing, see section 16.
• Legal obligation (Art. 6(1)(c)): where I have to handle notices of illegal content or keep records.

You are not obliged to give me any data. Without an account and without sending a photo for identification, however, the core function of the app cannot be used.

There is no automated decision that has legal effect on you or similarly significantly affects you. The recognition automatically estimates which car is in a photo and whether it is a real vehicle; measures against content or accounts are decided by me.

14. Recipients and transfers to third countries

These services receive data, each only for the purpose stated:

• Supabase: database, file storage and sign-in, stored in Frankfurt, Germany
• Anthropic: identification of photos
• OpenAI: identification of photos taken without Dibs+
• RevenueCat: managing purchases
• Expo: app updates and delivery of notifications
• Cloudflare: delivery of this website
• Namecheap (Namecheap, Inc., United States, Private Email service): the password reset email and emails you write to me
• Google: advertising, and place names, maps and delivery of notifications on Android
• Apple: place names, maps and delivery of notifications on iPhone

Supabase, Anthropic, OpenAI, RevenueCat, Expo, Cloudflare and Namecheap act as processors on my behalf and under my instructions. Google and Apple are themselves responsible for advertising, maps, place names and the delivery of notifications.

Several of these providers are based in the United States or process data there, Supabase also in Singapore. The basis for this is the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the provider is certified under it; these are Google and Cloudflare. In all other cases the European Commission's standard contractual clauses apply, which concerns Anthropic, OpenAI, RevenueCat, Supabase, Expo, Namecheap and Apple. You can request a copy of the clauses at apps@kevin-baur.com.

15. How long data is kept

Your finds, your profile and your images are kept until you delete them or delete your account. Deleting your account removes them; see Delete your account. Scan counters are deleted after 31 days at the latest. Reports submitted about other users are kept for as long as needed to deal with them.

16. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. Write to apps@kevin-baur.com and I will handle it.

One practical limitation: if your account is anonymous and has no email address attached, I have no way to confirm that an account belongs to you. In that case the reliable route is the in-app deletion, which works without any proof of identity because it runs from your own signed-in device.

You also have the right to complain to a data protection authority, where you live or at the one responsible for me: Österreichische Datenschutzbehörde, Barichgasse 40 to 42, 1030 Vienna, Austria, dsb.gv.at.

17. Age

You may use Dibs from the age of 14, or from a higher age where your country requires that for agreeing to digital services on your own. Dibs is not directed at younger children and I do not knowingly collect data from them. If you believe a younger child has given me personal data, contact me and I will delete it.

18. Changes

If this policy changes, the date at the top of this page changes with it. Significant changes will be pointed out in the app.

19. Contact

Kevin Baur, apps@kevin-baur.com