Towly
Privacy Policy
1. Introduction
This Privacy Policy explains how Towly (“Towly,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects personal information when you use the Towly mobile application and related services (the “App” or “Service”).
Towly is offered worldwide. This Policy is intended to meet requirements under the EU/EEA General Data Protection Regulation (“GDPR”), the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the CPRA (“CCPA”), and other applicable privacy laws.
By using the Service, you acknowledge this Policy. If you do not agree, do not use the Service.
2. Who we are (data controller)
For personal data processed in connection with the Service, the data controller is the operator of Towly, reachable at Contact us.
If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you may contact us at the same address to exercise your rights or raise privacy questions. Where required by law, you may also lodge a complaint with your local supervisory authority.
3. Scope
This Policy applies to personal information we process about you as a user of Towly. It does not apply to third-party websites, apps, or services that we do not control (including Apple, map providers, or cloud hosts), which have their own privacy policies.
4. Information we collect
- Account and identity data: email address (including a private relay address if you Hide My Email with Sign in with Apple), Apple Sign In identifier, and display name if you provide one.
- Location data: precise or approximate device location when you grant permission, used to show nearby reports, warn you near saved places, and tag reports you submit. You can revoke location access in device settings.
- Reports and community content: incident type, notes, towing company name, photos, parking checks, and related metadata you submit.
- Saved places and preferences: places you choose to watch and related alert settings.
- Device and technical data: device type, OS version, app version, language, rough diagnostics needed to run and secure the Service, and — only if you enable notifications — a push notification token.
- Support communications: messages and related details you send to support or via Contact us.
5. How we collect information
- Directly from you when you create an account, submit reports, save places, rate parking, or contact support.
- Automatically from your device when the app runs (technical, diagnostic, and — with permission — location data).
- From Apple when you Sign in with Apple or when push notifications are delivered.
- From processors acting on our instructions (for example, cloud database, auth, and object storage).
6. Legal bases (GDPR / UK GDPR)
If you are in the EEA, UK, or Switzerland, we process personal data only where a legal basis applies, including:
- Contract: to provide the Service you request (account, map, reports, saved places, alerts).
- Legitimate interests: to secure the Service, prevent abuse, moderate community content, improve reliability, and communicate about service changes — balanced against your rights.
- Consent: where required (for example, optional push notifications or precise location where consent is required). You may withdraw consent at any time without affecting prior lawful processing.
- Legal obligation: where we must retain or disclose information to comply with law.
7. How we use information
- Operate the community map and warn drivers about reported predatory-tow areas.
- Send proximity alerts for places you save (if enabled).
- Authenticate you and maintain your account.
- Host, display, and moderate user-submitted reports and parking checks.
- Respond to support requests and investigate abuse or security issues.
- Comply with law and enforce our Terms of Service and EULA.
We do not sell your personal information and we do not use it for third-party advertising or cross-context behavioral advertising.
8. What is public
Tow reports and parking checks you submit are shared with the community on the map and feed. Your email address, saved places, and account identifiers are never shown to other users.
9. Where data is stored and international transfers
Your structured data is stored in our managed backend (Supabase). Report photos may be stored with cloud object storage (for example Cloudflare R2) and served through time-limited signed links.
Because Towly may be used worldwide, personal data may be processed in countries other than where you live, including the United States and other locations where our providers operate.
For transfers from the EEA, UK, or Switzerland to countries not deemed adequate, we rely on appropriate safeguards where required — such as Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement / Addendum.
10. Sharing and processors
- Apple — Sign in with Apple and push delivery.
- Supabase — database, authentication-related backend, and server functions.
- Cloudflare (or similar) — object storage for report photos.
- Professional advisors or authorities — only if required by law or to protect rights, safety, or the Service.
We do not sell or rent your personal information.
11. Retention and deletion
You can delete your account at any time from Settings → Delete My Account. This permanently removes your account and private data. Reports and parking checks you contributed may remain on the community map in anonymized form. Use Contact us for deletion requests.
12. Security
We use reasonable technical and organizational measures designed to protect personal information. No method of transmission or storage is completely secure. To the maximum extent permitted by law, we are not liable for unauthorized access resulting from circumstances beyond our reasonable control.
13. Your rights (EEA, UK, Switzerland — GDPR)
Subject to applicable law, you may have the right to access, rectify, erase, restrict or object to certain processing, data portability, withdraw consent where processing is consent-based, and lodge a complaint with a supervisory authority.
Use Contact us. We aim to respond to GDPR requests within one month.
14. Your rights (California and other US states)
You may have rights to know/access, delete, correct, and opt out of “sale” or “sharing” for cross-context behavioral advertising (we do not sell or share for such purposes). Use Contact us.
15. Children’s privacy
Towly is not directed to children under 13 (or under 16 in the EEA/UK where a higher digital consent age applies), and we do not knowingly collect personal information from children.
16. Changes
We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the latest version.
17. Contact
Privacy questions or GDPR requests: Contact us or use Contact us.