Cookies, App Software and Device Storage.

Each item below is listed with its provider, what it does, and how long it lasts. They apply in the app and in the web app at app.recovru.com.

• Sign-in session. Provider: Recovru, through Supabase. What it does: keeps you signed in so you are not asked to sign in on every screen. How long: until you sign out.
• Local app storage. Provider: Recovru, on your device only. What it does: remembers your profile (name, phone number and email address), saved vehicles, saved places, the type, last four digits and expiry date of your saved cards, the last place you searched for, and your settings, including the choices you make on the Privacy screen, so the app works offline and starts quickly. In the web app this is your browser's local storage. How long: until you delete the app, clear your browser's site data, or a different account signs in on that device. Signing out does not clear it.
• Payment. Provider: Stripe. What it does: runs the card entry and payment sheet, confirms a card with your bank where it asks for that, and detects fraud on a payment. In the web app, Stripe's script is loaded each time the app opens, and it sets two cookies on app.recovru.com for fraud prevention: __stripe_mid, which lasts one year, and __stripe_sid, which lasts 30 minutes. How long: as stated.
• Maps. Provider: Google Maps. What it does: draws the map and finds addresses. It connects to Google, which receives your device's internet address and the area of the map on screen, and may store technical information needed to show the map. How long: as set by Google.
• Notifications. Provider: Google Firebase Cloud Messaging. What it does: gives your device a token so we can tell you about quotes and your operator. In the web app this uses a background script your browser keeps, and only if you allow notifications. If you switch push notifications off in the app, the token is kept so that an in-app call can still ring your phone; switch off Calls in the app as well if you do not want that. How long: until you sign out or turn notifications off on your device.

These are exempt from consent because the service you have asked for, signing in, requesting help, seeing where your operator is, being told about it and paying securely, cannot be delivered without them.

In the app and the web app, on the Privacy screen.

• Usage analytics. Provider: Recovru. What it does: records how you move through the app, so we can fix what trips people up. It stays with Recovru, is never shared, and is kept for 12 months. Default: on, because it is used only to improve our own service, which the law allows as long as you can switch it off. Switch: Usage analytics.
• Share live location. Provider: Recovru. What it does: while the app is open on your screen, sends your device's position to us about every 45 seconds so our staff can see who is using Recovru and where. Operators never see it. We keep only the latest, and delete it once it is more than 24 hours old. Default: off. It runs only if you switch it on, and that is your consent. Switch: Share live location. The Privacy Policy, section 2.1, explains it.
• Crash reporting. Provider: Google (Firebase Crashlytics). What it does: sends a technical report when the app crashes, so we can fix it. Default: off. It runs only if you switch it on, and that is your consent. Switch: Crash reporting.
• Marketing analytics. Provider: Google (Firebase Analytics). What it does: analytics for product research, which reads an identifier for your device that Firebase creates for the app, never your device's advertising identifier. Default: off. It runs only if you switch it on. Switch: Marketing analytics.
• App error reports. Provider: Recovru. These stay with us and are controlled by the Share trip data switch on the same screen, which is on unless you switch it off. They hold the error message, the app version and your device type, tied to your account, and a note each time the app opens. Switching it off changes nothing about your requests or prices. The Privacy Policy, section 5, explains them.
• The website currently uses no optional preference, analytics or advertising technology. Its privacy notice and Cookie settings explain this and let you save an essential-only acknowledgement. The only item it stores on your device is recovr-cookie-consent in your browser's local storage: the notice version, the time you saved it and that optional preferences and analytics are off. It remains until you clear this site's data. Clearing it makes the notice return; another tab of the same site follows a change to this stored choice. This acknowledgement is not consent for unused or future tracking. Separately, the website works out roughly which town you are in from your internet address, asks your browser for your position only when you press Use my location, and sends the place you type, or your position, to Google Maps through our server to suggest or name an address; none of this is stored on your device. If we introduce optional technology, we will identify its purpose, provider and duration, update this policy and ask for fresh consent before it runs. A previous acknowledgement does not authorise it. The website's fonts are served from our own site, and it does not load advertising or social media trackers.

You can change any of these at any time. Turning them off does not affect anything you can do in the app or on the site.

The app and the web app contain software from other companies. These do not set cookies in the usual sense, but they do connect to those companies' servers, which means those companies can see your device's internet address. We think you should know about them, so here they all are.

• Payments. Company: Stripe. Why it is there: holding and taking payment, and paying operators. When it connects: when you add a card or a payment happens, and in the web app each time it opens, because Stripe's script is loaded with it.
• Identity verification, for operators only. Company: Didit Identity Spain, S.L. Why it is there: confirming an operator is who they say they are. When it connects: during operator sign-up, and for the face check before going online when that is switched on.
• Push notifications. Company: Google (Firebase Cloud Messaging). Why it is there: telling you about quotes, and that your operator is on the way, close or has arrived. When it connects: when the app starts, and when a notification is sent.
• Crash and analytics reporting. Company: Google (Firebase). Why it is there: diagnosing crashes and marketing analytics. When it connects: only if you have switched Crash reporting or Marketing analytics on (section 4).
• Maps, addresses and routes. Company: Google (Google Maps Platform). Why it is there: showing the map, finding addresses, and working out routes and arrival times. On Android every map in the app is drawn by Google's navigation map software. When it connects: whenever a map is on screen or you search for an address, and in the web app each time it opens, because its script is loaded with it.
• Naming a street. Company: Apple on an iPhone, Google on Android, through your phone's own address service. Why it is there: naming the street for your position when our servers cannot. When it connects: only then.
• Buying a plan or the membership in the app. Company: Apple (the App Store) on an iPhone, Google (Google Play) on Android. Why it is there: showing the price, taking the purchase and restoring it. When it connects: when the app starts, and when you open a plan screen, buy or restore.
• Ringing an iPhone. Company: Apple. Why it is there: ringing your phone for an in-app call when the app is closed, where we have switched this on. When it connects: when someone rings you.
• Voice calls. Company: Cloudflare. Why it is there: connecting an in-app call when a direct connection between the two devices is not possible. The call itself is encrypted, never recorded and never stored. When it connects: only during a call.
• Hosting the web app. Company: Cloudflare. Why it is there: it serves app.recovru.com. When it connects: whenever you use the web app.
• Hosting the website. Company: Vercel. Why it is there: it serves recovru.com. When it connects: whenever you visit the website.
• Sign in with Apple or Google. Companies: Apple, Google. Why it is there: signing you in without a password. When it connects: only if you choose that sign-in method.

Some of our suppliers normally never connect to your device, because our servers talk to them: for example, Brevo, which sends our emails, and the vehicle data provider that fills in your vehicle from its number plate. The one exception is a vehicle picture: if our own copy of the provider's picture of your vehicle could not be made, your device loads the picture from the provider's servers, which then see your device's internet address. The Privacy Policy, section 9, lists them.

• In the app and the web app: the Privacy screen. Every optional item has its own switch. There is no bundled "accept all".
• On the website: the cookie banner, and the "Cookie settings" link in the footer.
• On your device: your phone or browser settings control location, notifications, camera and photo access, and stored website data, independently of anything here.
• With us directly: email privacy@recovru.com and we will action it.

On the marketing website, Cookie settings can be reopened from the footer on every page. The current notice offers "Essential only" because no optional category is used. Saving records that acknowledgement, and closing settings without saving changes no stored choice. If no choice was previously saved, the notice remains available after closing settings. If optional technology is introduced, rejecting it will be as easy as accepting it, with equally prominent controls, and it will remain off until you consent. Website choices do not change the independent settings in the Recovru app.

• The summary of where information goes says that the web app at app.recovru.com is now served from a server in Manchester, England, that Hostinger provides.

The changes made by earlier versions are kept with those versions: ask us at privacy@recovru.com for a copy.