Privacy Policy

1. Who We Are

Blitzergram is operated by Private Enterprise “ISMA-SERVICE” (ПП “ІСМА-СЕРВІС”), EDRPOU 33927324, registered in Ukraine. When we say “Blitzergram,” “we,” “us,” or “our,” we mean PP “ISMA-SERVICE.”

For privacy-related questions, contact us at support@blitzergram.com.

2. Information We Collect

2.1 Information you provide

Account data: Email address (including an Apple relay address where used), account ID, public alias and authentication session information. Accounts are created in the iOS app; the website lets existing members sign in.

Ticket data: The website reads tickets saved from the iOS app. Private images and ticket details require the owner to sign in. Approved public cards contain the preview image and public statistics selected for sharing. Saved fields include the fine amount, currency, speed over the limit where present, ticket date and city, plus codes recording whether a value was read or typed. A ticket city can describe a past location; it is not live GPS data.

Legacy payment data: The website no longer starts purchases. Stripe transaction references may be retained to complete or reverse earlier payments. Existing Pro access is preserved. We do not store full payment card numbers.

Profile data: Username, avatar, and display preferences.

Comments and safety: Comments on public tickets are visible to signed-in members with your alias and posting date. We store reactions, reports, block relationships and moderation decisions to operate the community and prevent abuse. Support messages contain the information you choose to send us. Do not put addresses, contact details or other people's private information in comments.

2.2 Information collected automatically

Usage data: Pages visited, features used, and aggregate visit information via optional Vercel Web Analytics on the website. The native iOS app has no analytics SDK.

Device data: Browser type, operating system, screen resolution, and IP address may be processed in website requests and infrastructure security/diagnostic logs. This is not advertising tracking or a request for your iPhone's location.

Cookies: Authentication session cookies (Supabase), browser preferences and your optional analytics choice. Vercel Web Analytics is cookieless. See Section 9.

2.3 Website and iOS app

The website is for viewing and sharing. You can browse approved public cards, profiles and awards. After signing in, you can view your own private tickets and statistics. The website does not scan documents, upload photos, edit or publish tickets, accept reactions, or sell Pro.

Ticket creation and photo processing take place in the iOS app. The website displays the saved account data and approved public previews from our shared backend.

The iOS app reads the original scan on your iPhone. It uploads the cropped and redacted photo you confirm, the ticket fields you save, and whether each amount or speed was read from the letter or entered by you. These records support your private statistics and the checks that determine which values count for awards. The iOS app has no advertising or analytics.

2.4 Optional publication and automatic photo checks

When you choose Publish, our backend automatically checks the exact edited photo you selected before making it public. We run the open-source NSFWJS model in our own authenticated Vercel service, configured in Frankfurt. The check targets sexual imagery. A photo that passes can appear immediately; flagged photos and unsuccessful checks wait for human review and remain visible only to you. Reports can also return shared content to review.

The screening endpoint receives the edited image, without your account details, ticket fields or OCR transcript. Private-only saves are not sent to it. The service does not save photos or predictions or write them to application logs. We do not send these photos to OpenAI or another external AI API. Supabase and Vercel still process the data as infrastructure providers. Automatic checks are fallible; reporting, blocking and human moderation remain available.

3. How We Use Your Information

• Provide, maintain, and improve the Blitzergram service
• Provide account access and handle existing payment records
• Display public ticket cards only when you choose to publish them. An alias or a blurred plate does not guarantee anonymity
• Calculate statistics, scores, and leaderboard positions
• Send account confirmation, password reset and security emails, and communications about earlier purchases where necessary
• Respond to your support requests
• Analyze usage patterns to improve performance and user experience
• Prevent fraud, abuse, and enforce rate limits
• Moderate shared content for policy compliance
• Comply with legal obligations

Automatic rules check photo content, currency and value eligibility and calculate award standings. These checks can hold a photo or exclude a value from awards; they do not decide whether a fine is legally valid or paid. Ask for human review at support@blitzergram.com.

4. Legal Basis for Processing (GDPR)

If you are in the EU/EEA, we process your data under these bases:

Traffic-offence records: Depending on the offence and applicable law, these records may receive the additional protection of Article 10 GDPR. That provision requires official control or authorization by Union or Member State law with appropriate safeguards. Choosing to save or share a ticket does not by itself replace those requirements. You may withdraw your choice to publish by making a card private, or delete your ticket or account.

5. How We Share Your Information

We do not sell, rent, or trade your personal data. We share data only with:

Supabase — authentication and database hosting (AWS infrastructure, EU region Ireland). See supabase.com/privacy.

Vercel — application hosting, automatic checks of edited photos selected for publication (Frankfurt configuration), and website performance analytics. See vercel.com/legal/privacy-policy.

Resend and Zoho Mail — delivery of account emails and handling of support correspondence respectively. Account email recipients and the message content needed for delivery are processed for those purposes; ticket photos are not attached to account emails.

Stripe — legacy payment records, refunds and disputes. Stripe collects transaction data and device identifiers under its own privacy policy. See stripe.com/privacy.

6. International Data Transfers

Your data is primarily processed on servers in the EU (Ireland and Frankfurt, Germany) via Supabase and Vercel. Where data is transferred to the United States (legacy Stripe records, some Supabase infrastructure), these transfers are protected by the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

7. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of account deletion.
• Fine data & blurred images: Retained while your account is active. Deleted upon account deletion or individual fine deletion.
• Public cards: Visible until you unpublish or delete your account. Removed from gallery immediately upon request.
• Payment records: Retained for 7 years as required by tax and commercial law.
• Comments: Kept while the comment and account remain active. Deleting your comment clears its text. Comments are also removed when the associated ticket or account is deleted. Reports, blocks and review records are retained for safety and handling disputes where needed.
• Value review history: A moderator's rejection of an amount or speed can remain linked to your account after the individual ticket is deleted, so re-uploading it does not bypass the decision. This record is removed with the account.
• Analytics data: Anonymized, retained per Vercel Analytics defaults.
• Browser data: The website does not perform OCR or photo processing. Authentication and language preferences are handled separately as described below.

8. Data Security

We protect your data with TLS encryption in transit, encrypted databases at rest (Supabase on AWS), Row Level Security (RLS) policies ensuring you can only access your own data, with document processing handled in the iOS app. Legacy payment card data is handled entirely by Stripe (PCI-DSS Level 1 certified).

Crop the scan to the photo and hide personal details before saving. You control the final crop and additional blur; automatic suggestions may miss details. Check names, addresses, case references, plates and faces before confirming the edited photo.

9. Cookies & Tracking

Essential cookies (no consent required)

• Supabase authentication tokens (access token, refresh token) — required for login
• Sidebar state preference — required for UI function

Optional website analytics

• Vercel Web Analytics — aggregate website usage without analytics cookies; loaded only after you accept optional analytics

Your choice is stored in this browser. You can withdraw it or reopen the choice using the button below. Withdrawing stops the optional analytics component; it does not delete reports already aggregated.

You can also manage cookies through your browser settings. Disabling essential cookies will prevent you from logging in.

10. Your Rights

All users

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and all associated data
• Object to processing of your data
• Withdraw consent at any time

EU/EEA residents (GDPR)

• Right to data portability (export your data in machine-readable format)
• Right to restrict processing
• Right to lodge a complaint with your local data protection authority

How to exercise your rights

Self-service: Use the iOS app to delete individual tickets, unpublish cards, or delete your entire account from your profile settings. Account deletion removes all associated data within 30 days.

Contact us: For data export, access requests, or any other privacy rights, email support@blitzergram.com. We will respond within 30 days.

11. Children's Privacy

Blitzergram is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

12. Content Reporting

If you believe content on Blitzergram reveals your identity or violates your privacy rights (e.g., an insufficiently blurred image showing you or your vehicle), please contact support@blitzergram.com with the URL of the content. We will review reports and act on confirmed violations within 48 hours. You can also report cards, comments and members or block members in the iOS app. Our Community Guidelines describe the rules for shared content.

13. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the site at least 14 days before changes take effect. Your continued use of Blitzergram after the effective date constitutes acceptance of the updated policy.

14. Contact Us

Private Enterprise “ISMA-SERVICE” (ПП “ІСМА-СЕРВІС”)
EDRPOU: 33927324
Email: support@blitzergram.com