Draft for legal review. This policy has not yet been checked by a lawyer and may change before the app is released.
Last updated 5 November 2026
Privacy policy
Who we are
Cardar is operated by SW Global Limited, a company incorporated in Hong Kong. Our users are in New Zealand, so we follow the New Zealand Privacy Act 2020.
What we collect from you
- Your account email address and sign-in code or token.
- Your alert preferences: regions, price range, kilometre limits, makes and models, and notification settings.
- An approximate home location, only if you choose to set one. We round it to about 1 km and only use it to show distances and filter deals. We never collect your location in the background, and you can clear it in Settings.
- Push notification tokens for your device.
- Deals you save.
- Feedback and ratings, such as thumbs up or down, reasons and price estimates.
- Emails you send us for support.
We do not collect your name, phone number, address or card details. Any future payments will go through Apple or Google.
Car listings
We collect publicly visible car listings from New Zealand websites: year, make, model, kilometres, asking price, approximate location, a link to the listing and the first listing photos. Photos are shown from the original listing and are not stored by us. We do not keep sellers' names, phone numbers, email addresses or number plates. Sellers can ask for a listing to be removed by emailing hi@cardar.co.nz with the link.
How we use information
- To run your account and send alerts.
- To estimate market prices.
- To improve our estimates using feedback.
- To keep the service secure.
- To respond to support requests.
We do not sell your personal information and we do not use it for advertising.
Who we share it with
We use these service providers to run Cardar:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and sign-in | Singapore |
| Render | Servers | Singapore |
| Sentry | Error reporting | EU |
| Apify | Collects public listings | EU |
| Resend | Sends sign-in emails | — |
| Telegram | Alerts during private testing | Global |
| Apple and Google | Push notifications and app downloads | Global |
| Expo | App services and push delivery | — |
This means your information is sent outside New Zealand. We choose providers that protect information in a way comparable to the Privacy Act 2020.
Where it's stored
Our main database and servers are in Singapore. Error records are stored in the EU. Database backups are kept for 14 days in private storage.
How long we keep it
- Account data is deleted within 30 days of closing your account.
- Push tokens are kept until you turn notifications off or delete the app.
- Feedback is kept, unlinked from your account, after you close it.
- Listing data is kept for price history, without seller details.
- Error records are kept for up to 90 days.
Your rights
Under the Privacy Act 2020 you can ask to see or correct the information we hold about you. We'll respond within 20 working days. You can ask us to delete your account at any time. If you're unhappy with how we've handled your information, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
Security
We use encrypted connections and access controls to protect your information. If a privacy breach happens, we'll notify you and the authorities as required by law.
Children
Cardar is not for children under 16.
Credits
Place data from GeoNames (geonames.org), licensed CC BY 4.0.
Contact
SW Global Limited, hi@cardar.co.nz.