Privacy Policy

Effective October 19, 2026

1. Who we are

Bayrabbit Engineering (“we”, “us”), Washington State, USA, runs bayrabbit.com. This policy explains what personal information we collect, why, and the choices you have. We do not sell your personal information.

2. What we collect

• Account details: email, password (stored only as a secure hash by our login provider), name, phone if you add it, and when you accepted our Terms.
• Vehicle details: year, make, model, engine, VIN, fuel and modifications you tell us about.
• Files and messages: stock files, datalogs, photos and other files you upload, tune files we send you, and the messages in your requests.
• Contact form: your name, email, phone if you add it, and your message.
• Email preferences: whether you want marketing emails, and newsletter sign-ups from our “notify me” forms.
• Technical data: basic logs our hosting providers keep for security and reliability (such as IP address and browser type). Your login session is kept in your browser's local storage. We do not use advertising cookies. We count visits with Vercel Web Analytics, which works without cookies and shows us only aggregated statistics (such as pages viewed and country).
• Payments (when enabled): handled by Stripe. We receive payment status and the last digits of the card, never the full card number.

3. How we use it

• To create and secure your account, and to let you sign in.
• To build, deliver and support your tunes and unlocks: reading your stock files and datalogs, sending revisions, answering messages.
• To send service emails (confirmations, password resets, updates on your requests).
• To send marketing emails — only if you opted in. You can unsubscribe at any time.
• To keep records required by law (for example tax and accounting) and to handle disputes.

4. Who we share it with

Only with service providers that run the site for us, under their own security and privacy terms:

• Supabase — accounts, database and file storage.
• Vercel — website hosting and anonymous visit statistics.
• NHTSA (U.S. Department of Transportation) — when you press “Decode VIN”, only the VIN is sent to NHTSA's free public decoder to fill in your car's details.
• Our email provider — sending service and (if you opted in) marketing emails.
• Stripe — payments, when enabled.

We may also share information if the law requires it, or to protect our rights and the safety of others.

5. How long we keep it

We keep your account data, files and messages while your account is open. After you close it, we delete or anonymize them within a reasonable time, except what we must keep for legal, tax or dispute reasons. Newsletter addresses are kept until you unsubscribe.

6. Security

Data is sent over encrypted connections (HTTPS). Each customer can access only their own requests, files and messages; our staff can access them to provide the service. Files are stored privately and downloaded through short-lived links. No system is 100% secure, so please use a strong, unique password.

7. Your choices and rights

• See and update your details in your account profile.
• Turn marketing emails on or off in your profile, or use the unsubscribe link in any marketing email.
• Ask us for a copy of your data, to correct it, or to delete your account — send us a message from your account.
• Depending on where you live (for example California), you may have additional rights under local law; we will honor them.

8. Children

Our services are for adults. We do not knowingly collect information from anyone under 18.

9. Changes

We may update this policy. If the change is material, we will tell you by email or in your account.

10. Contact

Privacy questions: use the contact form or the messages in your account. A postal address will be added before launch.