AURIA
Privacy Policy
How AURIA collects, uses and shares information — the vehicles you track, the photos and receipts you attach, and who else can see them.
Effective October 23, 2026
Who we are
AURIA is operated by ASTO LLC ("we", "us"). AURIA is a set of connected apps: a vehicle Configurator, a Garage maintenance tracker, a Shops directory for finding and working with repair shops, AURIA Community — a public directory of car events and a place members post about their cars — and mobile apps for iOS and Android. This policy covers all of them and the accounts that tie them together.
For questions about this policy, or to exercise any right described below, write to support@astomotion.com. Our postal address is 66 West Flagler Street, Suite 900, PMB 11951, Miami, FL 33130.
ASTO LLC is the data controller for the information described here, except where this policy says a repair shop acts as its own controller.
Information we collect
We collect four kinds of information: what you tell us when you create an account, what you record about your vehicles, files you attach, and a small amount of technical and usage data.
| Data | Where it comes from | Why |
|---|---|---|
| Email address | You, or your Google or Apple account at sign-in | To identify your account, sign you in, and contact you about it |
| Display name and profile photo | You, or your Google or Apple account | To label your account in the apps and to other people you share a vehicle with |
| Password | You, if you register with email and password | Sign-in. Stored by Google Firebase Authentication as a salted hash — we never see or store your password |
| AURIA ID and optional @handle | Assigned by us; the handle is chosen by you | A stable, shareable identifier so someone can grant you access to a vehicle without exchanging email addresses |
| Preferences | You | Currency, distance units, and notification settings |
If you sign in with Apple and choose "Hide My Email", we receive an Apple relay address instead of your real one, and that relay is all we ever store.
| Data | Notes |
|---|---|
| Vehicle details | Year, make, model, trim, nickname, and — if you enter them — VIN, license plate and registration expiry date |
| Odometer readings | Entered by you, or read from a record you log |
| Service records | What was done, when, at what odometer, what it cost, the shop or vendor name, and any notes you write |
| Modifications, tunes, fuel fill-ups, issues, diagnostic codes, warranties and reminders | Including brand, seller, tuner, warranty provider, costs, diagnostic trouble codes with the scanner details and readings you record, and your free-text notes |
| Insurance policies | If you record one: the insurer, policy number, type of cover, start and renewal dates, premium and your notes |
| Timeline history | An append-only record of changes to the above, used as the vehicle's audit trail |
| Valuation postal code | Only if you ask for a market valuation. This is the only location data we hold — see below |
| Photos and documents | Receipts, invoices, registration papers, before-and-after photos. Images and PDFs only |
Free-text notes are yours to write and we do not inspect them, but they are stored as you typed them. Please do not put information in a note that you would not want stored — for example, someone else's personal details.
| Data | Notes |
|---|---|
| Device and browser information | Device type, operating system, browser and screen size, collected when the apps load |
| IP address | Seen by our hosting provider and by the third-party services listed below whenever your device contacts them |
| Product usage events | Which screens and actions you use — for example that a vehicle was added, or that a limit was reached. These events carry your account identifier, so we treat them as linked to you |
| Subscription status | Whether you are on Free or Premium, where you subscribed (on the web, the App Store or Google Play), when it renews, and an identifier for your payment record at Stripe or the store |
What we do NOT collect: your device's GPS or precise location, contacts, health data, biometrics, browsing history outside our apps, advertising identifiers, or crash and performance telemetry. We use no advertising SDKs and no third-party tracking SDKs, and we do not track you across other companies' apps or websites.
Photos and documents you attach to a vehicle — receipts, invoices, registration papers — are stored as you upload them, including any details your camera or phone embedded in the file, which can include where a photo was taken. Check a photo's location setting before you attach it if that matters to you. Photos you add to a showcase page are handled differently: each one is re-encoded on your device before it is uploaded, which removes that embedded information, location included. AURIA Community likewise removes it from images you upload to Community before it publishes them.
Before you sign in, the apps may create an anonymous account so that usage events have something to attach to. It carries no name, email address or contact details — but its identifier is what ties those events to one another, so we treat it as personal information rather than as anonymous. If you later sign in, subsequent events are attached to your real account instead.
Information stored on your device
The Garage is designed to work before you sign in and while you are offline. To do that, the app keeps a copy of your garage — including any VIN, license plate and notes you have entered — in your browser's or the app's local storage on your device, and keeps attached photos and documents in the app's private storage area.
This local copy is not encrypted by the app beyond the protection your device and operating system provide. Anyone with access to an unlocked device may be able to read it. Use a device passcode, and sign out or delete the app's data on a shared device.
Signing in does not empty the local copy — it reconciles it with your account so nothing you recorded before signing in is lost. Deleting the app removes the local copy but does not delete your account; see https://auriamotion.com/account-deletion.
How we use information
- To provide the service: store and sync your vehicles and records across your devices, render your timeline, and calculate cost and mileage summaries.
- To operate your account: sign you in, keep your profile and preferences, and contact you about your account, security, or important changes to the service.
- To run subscriptions: determine whether you are on Free or Premium and apply the corresponding limits.
- To provide the features you ask for: decode a VIN, estimate a market value, share a vehicle's history with a shop or another person, or connect an AI assistant.
- To remind you: reminders you set are scheduled on your device and shown by your device. We do not send them from a server.
- To improve the product: understand which features are used and where people get stuck, using the usage events described above.
- To keep the service safe and lawful: prevent abuse, enforce our Terms, and comply with legal obligations.
We do not use your garage contents — your vehicles, records, notes, photos or receipts — to train machine-learning models, and we do not sell them.
Legal bases (EEA and UK)
If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases:
- Performance of a contract — providing the service, your account, and any subscription you buy.
- Legitimate interests — keeping the service secure, preventing abuse, and understanding how our apps are used. Usage events are not aggregated: each one carries your account identifier, which is why they are listed as linked to you above. We balance these interests against your rights, and you may object at any time.
- Legitimate interests — keeping AURIA Community usable and safe: screening what is posted, acting on reports, and enforcing the Community Guidelines. Posting is something you choose to do, and the screening applies to what you post rather than to your account generally. Also legitimate interests: showing the host of an event on AURIA how many people viewed, attended and commented on it — as totals, never as names.
- Consent — optional features you switch on, such as notifications, sharing a vehicle with a shop, or connecting an AI assistant. You can withdraw consent by turning the feature off.
- Legal obligation — tax, accounting and responding to lawful requests.
Who we share information with
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We disclose it only as described here.
| Provider | What it receives | Why |
|---|---|---|
| Google (Firebase) | Everything you store with us: account, garage records, attached files, and usage events | Hosting, authentication, database and file storage. Firebase is our infrastructure provider and processes this data on our instructions |
| Google Analytics | Product usage events, IP address, device and browser information, and an identifier tied to your account | Understanding product usage. We do not enable Google's advertising features |
| Stripe | Your payment details, entered directly on Stripe's own checkout page, plus an identifier linking the payment to your account | Processing subscription payments. We never receive or store your card number |
| Apple (App Store) and Google (Google Play) | Your payment details and the purchase, entered directly with Apple or Google when you subscribe in the app | Processing in-app subscription payments, under Apple's and Google's own terms and privacy policies. We never receive your card number |
| RevenueCat | Your account identifier and the subscriptions you buy through the App Store or Google Play | Confirming in-app subscription purchases and telling us when they renew, change or end |
| NHTSA (U.S. Dept. of Transportation vPIC) | The VIN you ask to decode, and the VIN of a vehicle you save to your account | Turning a VIN into year, make, model and trim, and checking that a saved vehicle's VIN matches the car you entered. Decoding is requested from your device and is not authenticated. The check on save is made by our server and carries no account information. Do not enter a VIN if you would rather it were not sent |
| MarketCheck | Your vehicle's VIN, postal code, odometer and condition options | Producing a market valuation, only when you request one |
| Frankfurter | No personal data — only currency codes. Your device's IP address is visible to them as with any web request | Currency conversion rates |
| Google Cloud Vision and Google Cloud Natural Language | Text and images you post in AURIA Community, and the display name on your Community profile. Nothing from your garage | Automated screening for content that breaks the Community Guidelines, before it is published. The result is a classification we act on; a person reviews anything it flags |
| Google (reCAPTCHA Enterprise) | On our websites only, not in the mobile apps: your IP address, browser and device information, and signals about how the page is being used, collected by Google's script while you use the site | Confirming that requests to our servers come from our own websites rather than from automated scripts, so that abusive traffic can be refused. Google's Privacy Policy and Terms of Service apply to its use of this information |
We also disclose information when the law requires it — to comply with a valid legal process, to enforce our Terms, or to protect the rights, property or safety of our users, the public, or us. If ASTO LLC is involved in a merger, acquisition or sale of assets, your information may transfer as part of that transaction; we will tell you before it becomes subject to a different privacy policy.
Sharing you choose to do
Several features send your information somewhere on purpose. Each is off until you turn it on.
| Feature | Who sees it | What they see |
|---|---|---|
| Sending a service request to a shop | The repair shop you chose | Your name, email address, phone number, billing address, the vehicle's full VIN, and what you wrote about the work you need |
| Granting a shop access to a vehicle | That shop, for as long as the grant lasts | The vehicle's maintenance history. The shop may add records, which appear in your timeline attributed to them |
| Sharing a vehicle with another person | The person you name | The vehicle and its history. VIN, license plate, registration, valuation and attachments each stay hidden unless you specifically permit them |
| Creating a public share link | Anyone who has the link | The vehicle's timeline and the text in it. VIN, postal code, market value and your private notes are excluded — but record titles, shop and brand names, and any dispute note you wrote are included, and so is your account identifier |
| Publishing a vehicle showcase page | Anyone who has the link, without signing in | What you choose to publish: photos, headline and story, the vehicle's name, year, make, model and trim, its modifications and tune, a summary of its service history (how many records, how many a shop verified, and the date of the last one), any social handles you add, and its odometer unless you hide it. Whether the VIN matched the car may be shown, but never the VIN itself. License plate, registration, valuation, costs, shop names and your notes are never published. The page also carries your account identifier |
| Connecting an AI assistant | The assistant you connected, and its provider | See the next section |
| Transferring a vehicle to a new owner | The buyer | The vehicle and its service history, so the car keeps its records. Your license plate, registration, valuation, private notes and receipt documents do not transfer, and your identity is replaced with “previous owner”. Before accepting, the buyer sees the car's VIN or chassis number (only its last 6 characters unless the transfer was sent to their account), when AURIA first recorded it, and how many history entries were added before that |
A public share link is not anonymous. It can be opened by anyone who has the URL, without signing in, and it contains your account identifier. Revoke a link from the vehicle's share settings when you no longer need it.
When you send a service request or grant access to a repair shop, that shop receives your information and decides how to use it for its own business records. From that point the shop is an independent controller of that copy, and its own privacy practices apply.
AI assistants
You can connect an AI assistant — such as Claude or another compatible client — to your garage. If you do, that assistant can read and, if you grant it, write to your vehicle records on your behalf. You choose what to allow on a consent screen before anything is connected, and you can disconnect at any time from Profile → Connected Assistants.
- Read access lets the assistant see your vehicles, service history, modifications, fuel logs, issues, diagnostic codes, reminders and cost summaries — including the notes and shop names in those records.
- Write access lets it add odometer readings, service records, fuel fill-ups, issues, diagnostic code readings and reminders, and mark an issue resolved. Anything it writes is permanently labelled as written by an AI assistant, and nothing can be deleted through that connection.
- VINs are masked before they leave — an assistant sees only the last four characters. Your license plate, registration, valuation postal code, attachments, email address and profile are never sent.
Once information reaches the assistant it is handled under that provider's own privacy policy, not ours. Only connect assistants you trust.
AURIA Community
Community is the one part of AURIA that is public by design. Everything in the first list below can be read by anyone, signed in or not, and copied by anyone who can read it.
- Public: your display name and @handle, your avatar, banner, bio, location and website if you add them, your posts and comments — including comments you leave on events — the posts, discussions and events you repost, the images you post, and the events you submit once they are published. A repost appears on your profile and in the Following feed of people who follow you, and the person who wrote what you reposted or quoted — or hosted it, for an event on AURIA — is notified that it was you; a quote is a post of your own. How many people repost, quote or are attending something is shown as a number. If you choose to, your profile can also show a card for each Garage showcase you have published — its name, year, make, model and trim, a one-line headline, up to three category labels and its cover photo, the same image your showcase page shows. Nothing is shown for a car you do not pick. A small badge next to your name shows if you are AURIA staff, or on the team of a brand partner or a verified, publicly listed shop — naming that business — and, only if you turn it on, that you have AURIA Premium. The Premium badge says you subscribe; it never shows what you pay or how.
- Never public: your email address, your AURIA ID, and the account identifier we use internally. Your public content is linked together by a separate, opaque member ID that exists only for this purpose.
- Private to us: the record that you accepted the Community Guidelines and which version, the interests and city you optionally set to shape your feed, the reports you file, which events you marked as attending, and whether you asked for updates about them.
Reports are confidential. The person you report is not told who reported them, and reports cannot be read back by anyone outside our moderation team — including you.
Blocking and muting are private lists. The person you block is not notified, and neither list is published.
Attending an event is counted, never listed. When you tap Attending, the event's count goes up by one, and nobody can see that it was you — not other members, and not the event's host. If you ask for updates, we tell you inside the app when the event is cancelled or removed, its time or place changes, or its host marks it full. You can stop attending at any time, and turn updates off in Community settings. If you ask for a reminder before an event, your phone schedules it and keeps that choice — we don't store it.
If you host an event on AURIA, you can see an overview of it: how many times its page was viewed, and how many people attended and commented, day by day. Those are totals only. To count a signed-in visitor once a day, we keep a hashed marker made from the event, the date and the visitor's account identifier; it is used for nothing else, never shown to anyone, and deleted after two days. Signed-out visits are counted once per session of the app or browser and carry no identifier.
Images are re-encoded before they are published, which removes the metadata cameras embed — including GPS location. The original file you uploaded is deleted once the published version exists, and it is never readable by anyone but our moderation systems in the meantime.
Text and images are screened automatically before publication, using the Google Cloud services listed above, and people review what that screening flags along with everything that is reported. When a check is uncertain the content waits for a person; it is never published on the strength of an automated check alone. We are not making decisions about you with legal or similarly significant effects by automated means alone.
Content we remove is kept in a moderation archive so we can review the decision, answer a lawful request and act on repeat behaviour. If you delete your account, that archive is erased with it, and records about you that other people's reports created are de-identified.
How long we keep information
We keep your account information and garage records for as long as your account exists. When you ask us to delete your account, we lock the account immediately and permanently erase your data after 30 days — the delay exists so you can undo a deletion you did not mean to make.
Some information outlives your account, and you should know which:
- A repair shop's copy of a service request or job — including the contact details you supplied — is that shop's own business record. We remove the link to your account, but we cannot delete the shop's copy for it.
- If you transferred a vehicle to another owner, that vehicle's service history now belongs to them and stays with the car. Your identity is already replaced with “previous owner” in it.
- Payment records held by Stripe, Apple or Google are kept as long as tax and accounting law requires.
- Usage events are kept as individual records carrying your account identifier for as long as your account exists. When your account is purged the records we hold are deleted outright. The copy Google Analytics holds is governed by Google's own retention period and is not affected by that step.
- An event you submitted to AURIA Community that was published stays listed after you delete your account — it is a real event other people are going to — but every link to you is removed from it. Reports you filed stay as evidence about someone else, without your identity.
- A forum thread you started in AURIA Community that other members replied to stays, so their replies are not lost — but its title, its text and your name are erased from it. Everything else you wrote in Community is deleted.
Full detail, including what is erased and what is kept, is on https://auriamotion.com/account-deletion.
Your rights and choices
Whatever your location, you can:
- See and correct most of your information directly in the app — your profile, and every vehicle record you have created.
- On Premium, export a vehicle's records as CSV, or a full report as PDF, from the vehicle's timeline tools. On any plan, ask us for a copy — see below.
- Delete your account and its contents — from Profile in the app, or from https://auriamotion.com/account-deletion.
- Turn off reminder notifications, revoke any share link, revoke a shop's access, and disconnect any AI assistant, at any time.
If you are on Free, or the in-app export does not cover what you need — for example you want everything across every vehicle in one file — email support@astomotion.com and we will provide a complete copy free of charge.
If you are in the EEA or UK, you have the right to access, correct, erase, restrict or object to processing, and the right to data portability. You also have the right to lodge a complaint with your local supervisory authority.
If you are a California resident, you have the right to know what personal information we collect and disclose, to request its deletion or correction, and not to be discriminated against for exercising those rights. We do not sell personal information, and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of.
To exercise any of these rights, email support@astomotion.com from the address on your account, or use the in-app controls. We will verify your identity through control of that email address before acting on a request, and will respond within the time the applicable law allows. You may use an authorised agent where the law provides for one.
Security
Your data is stored on Google Cloud infrastructure and is encrypted in transit and at rest by that platform. Access rules are enforced per account, and the databases holding your identity, your garage, shop data, Community content and assistant connections are kept separate from each other so that a component with access to one cannot reach the others.
No system is perfectly secure. Use a strong, unique password or sign in with Google or Apple, keep your devices locked, and tell us promptly if you believe your account has been accessed by someone else.
Children
AURIA is not directed to children. You must be at least 13 years old to hold an account, or at least 16 if you are in the European Economic Area or the United Kingdom.
We do not knowingly collect personal information from children under those ages. If you believe a child has given us information, write to support@astomotion.com and we will delete the account.
Where your information is processed
We are based in the United States and our infrastructure runs in United States regions. If you use AURIA from outside the United States, your information is transferred to and processed there, under laws that may differ from those in your country. Where required, we rely on the European Commission's Standard Contractual Clauses for those transfers.
Changes to this policy
We will update this page when our practices change, and the effective date at the top will change with it. If a change materially affects how we handle your information, we will tell you in the app or by email before it takes effect.
Contact us
Privacy requests, support, everything: support@astomotion.com
ASTO LLC, 66 West Flagler Street, Suite 900, PMB 11951, Miami, FL 33130