Privacy policy

Here we explain, with no small print, what data we store, why, and what you can do with it, under the General Data Protection Regulation (GDPR) and Spanish law.

Who is the data controller

• Controller: Leonardo Pantoja Aguilera, a private individual resident in Spain.
• Contact for any privacy matter: contacto@apexrank.info

What data we store and why

• Your account: email and password. The password is stored encrypted and we never see it. We use them to create your account, let you sign in and send you the necessary emails (account confirmation, password reset). Your email is never published.
• Your public profile: nickname and, if you want, your Instagram, TikTok, YouTube, X and Facebook usernames. They are public: they appear next to your cars with a link to your profile on each network.
• Your cars: photos, name, description (optional) and category. They are public: they make up the ranking.
• Your votes: we store which cars you vote for so you can only vote once per car per week. Nobody else can see who you vote for: only each car's total number of votes is published.
• Reports: the reason and an encrypted fingerprint of the connection it was sent from, to prevent repeated reports. We don't store the IP address.
• Security: to stop bots, Cloudflare Turnstile analyses technical data from your browser when you sign up or sign in. To reject passwords that have already leaked online, your browser sends the Have I Been Pwned service only the first 5 characters of an encrypted fingerprint of the password: the password never leaves your device and the service can't tell which one it is.
• Reactions to Garage cars (❤️ 👍 🔥): no account needed. We store which emojis you've given each car, linked to a random code in your browser (“ar_visitor” cookie) and, only for one day and to prevent abuse, an encrypted fingerprint of the connection (not the IP). Only the totals are shown, never who reacted. They are deleted if the car is deleted.
• Dealers near you: if you tap “Use my location” (your browser will ask for permission) or type your postcode, we use that point only to work out which dealers are closest to you. We don't store it or link it to your account.
• Visitor statistics: aggregated, cookie-free data (pages viewed, country, device type), with Vercel Web Analytics. It can't be used to identify you.
• Suggestion box: your message and, only if you type it, your email so we can reply. If you're signed in, we link it to your account. To stop spam we store an encrypted fingerprint of the connection (not the IP). It's never published.
• Emails you send us: we only use them to reply to you.

Why we can process it (legal basis)

• To provide the service you request when you create your account (account, profile, cars, votes and necessary emails): performance of the Garage terms you accept when signing up.
• For security, reports, reactions to cars, the suggestion box and aggregated statistics: our legitimate interest in protecting the website and its users, making what you ask for work, improving it and knowing how it's used.

Who else processes it

We don't sell your data or share it with anyone for advertising. It's only processed, on our behalf, by the providers that run the website:

• Supabase: database, accounts and photos. Servers in London (United Kingdom).
• Resend: sending the website's emails.
• Cloudflare: anti-bot check (Turnstile).
• Vercel: website hosting and visitor statistics.
• ImprovMX and Google (Gmail): forwarding and receiving the emails you send us.

The European Commission recognises the United Kingdom as providing an adequate level of protection. Some of these providers are US companies: in that case, transfers are made with the safeguards required by the GDPR (EU-US Data Privacy Framework or standard contractual clauses).

How long we keep it

• For as long as you have an account.
• If you delete it, we immediately erase your profile, your cars, their photos, the votes you've given and the suggestions you sent while signed in.
• Suggestions sent without an account, for as long as needed to deal with them.
• Photos you upload but never use are deleted automatically within a day or two.
• Emails you send us, for as long as needed to deal with them.
• Providers may keep backups for a few more days, protected and not used for anything else.

Your rights

• Access and portability: in My garage → “Download my data” you get a copy of everything in a file.
• Rectification: you can change your profile and your cars whenever you like from My garage.
• Erasure: in My garage → “Delete my account”.
• Objection and restriction: write to us at contacto@apexrank.info.

If you think we haven't handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the supervisory authority of your country.

Minors

ApexRank is only for people aged 18 or over. If we detect an account belonging to a minor, we delete it.

Cookies

We don't use advertising or tracking cookies. We explain it in the cookie policy.