Privacy Policy

Who is responsible for your data

Classic Source is operated by DattaDock LLC, Oklahoma City, Oklahoma, United States. For any privacy question or request, email info@classicsource.app.

What we collect

If you create an account

• Your email address.
• Your name, only if you provide one. It is optional and it is only used to greet you in the app.
• Your password, stored only as a scrypt hash with a random salt. We cannot read your password, and it is never stored in plain text.
• If you sign in with Google, the account identifier Google gives us plus the email address and name on your Google account. We never receive your Google password.
• Which plan you are on, and the date you created the account.

What you save in the app

• Your garage: the vehicles you save, meaning year, make, model, submodel, engine and an optional note.
• Your saved searches: the title you give them, the vehicle they are scoped to, and the part term.

These are stored against your account and are private to you. If you are not signed in, they are kept in your own browser's local storage instead and never reach our servers.

If you subscribe to a paid plan

• A Stripe customer reference and subscription reference, plus the status of the subscription, so we know which plan your account is on.
• A count of how many AI questions you have used in the current calendar month, so the monthly allowance can be enforced.

Search activity, kept in aggregate

We keep a running count, one record per day, of what people search for: part terms, vehicles, searches that returned nothing, which retailers responded and how many results they returned, and how long searches took. This is how we find out that a retailer has gone quiet or that a common part gets no results, which is what tells us what to fix next.

• These counts are not linked to your account. Your user id is not written into them, and there is no way to read back what any one person searched for.
• To stop a single source from flooding the lists and to avoid counting the same search several times while it is still running, the requesting IP address is folded into a short one-way digest that lives only inside that day's record. The IP address itself is not stored, and the digest is never displayed anywhere.
• Search terms that look like an email address, a phone number or a long account number are redacted or dropped before anything is written, so free text you typed cannot end up in these counts.

What we do not collect

Who else is involved

These are the only third parties that receive data, and only for the purpose listed.

• Netlify hosts the site and runs the application. Your account record, garage, saved searches and the aggregate counts are stored in Netlify Blobs. Netlify also keeps standard server logs, which include request information such as IP addresses, for operating and protecting the platform.
• Stripe processes payments, and only if you subscribe. Stripe receives your email address and your card details directly from you, and it becomes the controller of that payment information under its own privacy policy.
• Anthropic is involved in two ways. First, on every search that is not already cached, the part you typed and the vehicle you selected are sent to Anthropic's API to work out which catalog terms to search for. This happens whether or not you use the AI assistant. Second, if you do ask the assistant a question, the part term, the vehicle, the product listings currently on your screen and the question you typed are sent to generate the answer. In neither case is your name, email address or account identifier sent.
• Google is involved only if you choose to sign in with Google. Google's sign-in script loads on the app page when you open the sign-in dialog, and Google may set its own cookies at that point. Google tells us your account identifier, email and name.
• The retailers. We query their public catalogs from our servers, not from your browser, and product images are proxied through our own server. Your browser does not contact a retailer until you click a link to visit them. Once you do, you are on their site under their privacy policy.

We may also disclose information if we are legally required to, or where it is necessary to investigate abuse or protect the service.

Cookies and sessions

• Signing in sets one cookie, named cs_session. It holds a random token and nothing else. It is HttpOnly, Secure, SameSite=Lax, and it expires after 30 days.
• The session token is stored on our side only as a SHA-256 hash, so a copy of our storage would not yield a usable session.
• Signing out invalidates the session.
• There are no advertising or tracking cookies. We do not use a cookie banner because there is nothing optional to consent to.
• If you are signed out, your garage and saved searches are held in your browser's local storage. Clearing your browser data clears them.

How long we keep things

• Account data, garage and saved searches: for as long as your account exists, until you ask us to delete it.
• Sessions: 30 days, then they expire.
• Aggregate daily search counts: 30 days, after which the day's record is automatically swept.
• Billing records: Stripe keeps payment records under its own retention rules, and we may keep basic records of a subscription for as long as tax and accounting rules require.

Getting a copy of your data, or having it deleted

Email info@classicsource.app from the address on your account and tell us what you want. We will delete your account record, your garage and your saved searches, and we will confirm when it is done. We aim to handle requests within 30 days.

Two honest caveats. The aggregate daily counts cannot be traced back to an individual, so there is nothing in them to pull out, and they age out on their own within 30 days. And if you have subscribed, Stripe holds its own payment records under its own policy, so you may need to contact Stripe as well for those.

Depending on where you live you may have additional rights over your data, such as access, correction, deletion or objecting to processing. Write to us at the address above and we will handle the request the same way.

Security

The site is served over HTTPS. Passwords are hashed with scrypt, session tokens are stored hashed, API keys are held server side only and never reach your browser, and the site sets a strict content security policy. No system is perfectly secure, but we are not holding payment data, and that is deliberate.

Children

Classic Source is not directed to children and is not intended for anyone under 13. We do not knowingly collect information from children. If you believe a child has created an account, email us and we will remove it.

Where data is handled

DattaDock LLC is based in the United States, and the services above process data in the United States and other countries where their infrastructure operates. If you use Classic Source from outside the United States, your information will be processed in the United States.

Changes to this policy

If we change what we collect or who we share it with, we will update this page and change the "last updated" date at the top. If a change is significant and you hold an account, we will tell you by email.