CarCast

Effective May 4, 2026

Privacy Policy

This policy explains what CarCastAI, LLC (“CarCast”, “we”) collects when you use carcast.ai and the related dashboard, why we collect it, and how to control it. We aim for plain language. If anything is unclear, email us at /contact.

1. What we collect

  • Account info. When you sign up we store your email and a Clerk user ID. If you upgrade, our billing provider (Polar) holds card data — we never see card numbers.
  • Usage data. Vehicle searches, forecast views, alerts you create, segment requests you submit. We log these so the product can serve them back to you.
  • Technical data. IP address, user agent, pages visited, request timing. Standard server logs, retained 30 days.
  • Analytics. Anonymised page-view and click-through data via PostHog. No third-party advertising cookies.

We do not sell, rent, or share your data with advertisers. We do not buy email lists.

2. How we use it

  • To provide forecasts, dashboards, and alerts you request.
  • To send transactional emails: account confirmations, the weekly market digest if you're on Pro/Agency, alert notifications.
  • To debug, secure, and improve the product. Logs are aggregated for product analytics; we do not profile individual users.
  • To comply with legal obligations and respond to valid requests.

3. Service providers

We use a small set of providers to run the service. Each only sees the data needed for their function:

  • Clerk — authentication. Stores your email + auth state.
  • Polar — billing. Handles card data; we receive only customer ID and subscription status.
  • Neon (Postgres) — primary database. Hosts segment data, your account row, your alerts.
  • Fly.io + Vercel — application hosting in the United States.
  • Resend — transactional email delivery (welcome, digest, alerts).
  • PostHog + Sentry — product analytics and error monitoring.
  • MarketCheck, FRED, Manheim — market data sources we read FROM, not write to. They do not receive your data.

4. Cookies

We use a small number of cookies and similar technologies:

  • Essential.Authentication session (Clerk), CSRF protection. Cannot be disabled — without these the product can't function.
  • Analytics. PostHog assigns an anonymous ID to track aggregate usage patterns. No advertising trackers.

5. Your rights

You can:

  • Access your account data via the dashboard or by emailing us.
  • Correct inaccurate information from your account settings.
  • Delete your account at any time via /settings or by emailing us. We'll remove your account row and personal data within 30 days; aggregated, de-identified usage statistics may persist.
  • Export your data — email /contact and we'll send a JSON dump of what we hold on you.
  • Object to processing or restrict processing — also via email.

California residents have additional rights under the CCPA / CPRA (Right to Know, Delete, Correct, Opt-out of sale — though we don't sell data). EU/UK residents have GDPR rights including the right to lodge a complaint with a supervisory authority.

6. Data retention

Account and billing records are retained for as long as your account is active and for 7 years after closure (US tax recordkeeping). Usage and request logs are kept 30 days unless required for fraud or security investigations. Segment-level forecasts and price history are retained indefinitely as part of the product's historical data.

7. Security

All traffic uses TLS. Data at rest in Neon is encrypted by the provider. Card data never touches our servers — Polar handles it directly. We use scoped service tokens, audit logs on administrative actions, and apply the principle of least privilege for internal access.

No system is perfectly secure. If you notice a vulnerability, please email us at rick@carcast.ai so we can fix it.

8. Children's privacy

CarCast is not intended for children under 13. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it.

9. International users

CarCast is operated from the United States. If you access the service from outside the US, you consent to your data being processed in the US under US law.

10. Changes to this policy

We will update this page when our practices change. Material changes will be announced via email to active accounts at least 30 days before they take effect.

11. Contact

Privacy questions? Email rick@carcast.ai or use /contact. CarCastAI, LLC, Lakewood, Ohio, USA.