Privacy Policy

TL;DR

We collect the minimum we need to run the product and bill you for it. We do not sell your data. We do not use your tune data to train AI models. Engine telemetry stays on your laptop unless you explicitly ask us to use it (e.g., an AI tuning call). Tune snapshots are stored so you can roll back; you can delete them at any time.

1. Who we are

Tuneless LLC, a Wyoming limited liability company, operating as Tuneless.tech, is the data controller for the information described below. Contact: privacy@tuneless.tech.

2. What we collect

2.1 Account information

• Email address (used as your login identifier).
• Display name (optional).
• Authentication metadata managed by Clerk (last sign-in time, IP address, device).

2.2 Subscription & billing

• Subscription tier and status.
• Billing history, invoice IDs, and payment method last-four and brand (the full card number never touches our servers — Stripe handles it directly).
• Billing address (where required for tax purposes).

2.3 Vehicle & tune data

• Vehicle profile metadata you enter (make/model, displacement, cam profile, etc.).
• Tune snapshots — the byte-level configuration of your ECU at points in time.
• Tune session metadata — when you ran a tune session, which vehicle it covered, and tune-counter state (how many of your purchased sessions you've used).

2.4 What we do not collect by default

• Continuous live telemetry. Live sensor data (RPM, AFR, MAP, etc.) stays in your browser. We only see it when you explicitly run a tune session, and only the samples needed for that session are transmitted.
• Vehicle identification numbers (VIN). We have no need for it.
• Your physical location. We do not track GPS.

2.5 Cookies & analytics

We use a small number of strictly-necessary cookies for authentication (managed by Clerk). We use Plausible Analytics for traffic statistics; Plausible is cookieless and does not track individuals across sites. We do not use Google Analytics, Facebook Pixel, or similar tracking SDKs.

3. Why we collect it (legal bases)

• Contract performance — to provide the Service you signed up for (account, purchases, tune sessions, tune storage).
• Legitimate interest — to run the business: fraud prevention, rate-limiting, security, aggregate analytics.
• Legal obligation — tax records, accounting records, lawful government requests.
• Consent — for any future optional features that go beyond the above (e.g., a community share-tune feature, marketing emails). We will ask first.

4. Who we share data with

We share data only with the service providers we need to run the product, each under a contractual data processing agreement:

• Clerk — authentication and session management.
• Stripe — payment processing.
• Cloudflare — hosting, CDN, DNS, and the Workers/D1 that run our backend.
• Google (Gemini API) — AI inference for tuning suggestions. Requests are sent under our server-side API key; Google does not retain prompts from paid Gemini API users for training (see Google's terms).
• Resend — transactional email (welcome, receipt, password reset).
• Sentry — error tracking for diagnosing crashes.
• Plausible — privacy-friendly traffic analytics.

We do not sell your data. We will not share it with advertisers or data brokers. We may disclose data if compelled by lawful process; if we receive such a request, we will challenge it where appropriate and notify you unless prohibited by law.

5. AI and your data

Tune sessions internally use a third-party large-language-model provider to produce the suggested cell-level corrections. When that happens, we send a structured request containing only the inputs needed for the task — a sample of telemetry rows, the current values of relevant tables, and your engine profile. We do not include your name, email, billing info, or other identifying information.

We do not use your tune data, telemetry, or tune-session inputs to train models — ours or anyone else's. AI provider terms governing model training apply to their handling of the request as described in section 4.

6. Retention

• Account data — kept while your account is active and for 30 days after deletion, then permanently removed (except where law requires longer retention, e.g., tax records: 7 years).
• Tune snapshots — kept while your account is active. After cancellation/downgrade to Free, kept for 90 days in a read-only export window.
• Tune session metadata — counters and per-session records kept for the life of your account so you have an audit trail of what was tuned and when. Per-session inputs sent to the AI provider are not retained after the response is delivered.
• Web server logs — 30 days, then aggregated to anonymous counts.

7. Security

We use industry-standard practices: TLS in transit, encryption at rest for D1, scoped API keys, principle-of-least-privilege access controls, and routine rotation of secrets. We do not store payment card numbers; Stripe does. We do not store passwords; Clerk does (and hashes them using state-of-the-art algorithms).

No system is perfectly secure. If we suffer a breach affecting your information, we will notify you without undue delay as required by applicable law.

8. Your rights

Depending on where you live, you may have rights under GDPR (EU/UK), CCPA/CPRA (California), PIPEDA (Canada), or similar laws. Subject to those laws, you may:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data ("right to be forgotten").
• Export your data (data portability).
• Object to or restrict certain processing.
• Withdraw consent where consent is the legal basis.
• Lodge a complaint with your local data protection authority.

Email privacy@tuneless.tech to exercise any of these. We will respond within 30 days.

8.1 California residents — CCPA/CPRA

California residents have the rights above under the CCPA/CPRA, including the right to know, delete, correct, and limit use of sensitive personal information. We do not sell or share personal information (as those terms are defined under the CCPA/CPRA) for money or for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes beyond what is necessary to provide the Service. Because we do not sell or share personal information, no "Do Not Sell or Share My Personal Information" opt-out link is required; if that changes, we will add one here along with the required opt-out mechanism.

8.2 EU/UK residents — GDPR data processing addendum

If you are a business customer (for example, a Professional Installer or Builder/OEM account) and require a Data Processing Addendum (DPA) reflecting our role as a processor and our subprocessors' obligations under GDPR, contact privacy@tuneless.tech and we will provide one.

9. Children's privacy

The Service is not directed at children under 18. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

10. International transfers

We are based in the United States. If you use the Service from outside the US, you understand and consent to the transfer of your information to the US, which may have data-protection laws different from your jurisdiction. Where required (e.g., EU/UK to US), our processors use Standard Contractual Clauses or equivalent safeguards.

11. Changes to this Policy

We will update this page when our practices change. For material changes we will notify you by email and/or in-app banner.

12. Contact

Privacy questions: privacy@tuneless.tech.