Effective date: Mar 5, 2026 Last updated: Mar 5, 2026
VRoom is built so that your vehicle records stay on your phone. There is no account, no login, and no server holding your data.
Three features are exceptions, and they only run when you ask for them: scanning a vehicle, checking a symptom, and looking up recalls. Those send specific information off your device to Google and to the US National Highway Traffic Safety Administration (NHTSA). Reporting an AI response also sends information, if you choose to use it. This policy explains exactly what gets sent, to whom, and what happens to it.
Everything below is the detail behind those two paragraphs.
VRoom – Virtual Garage ("VRoom", "the App") is published by Nomad Utilities / Cam Gillum. Contact details are in §10.
The following never leaves your phone. It is stored in the App's local storage on the device itself, not on any server we control:
Your vehicles and their specifications
Your full maintenance and service history — dates, mileage, costs, parts, notes
Component records: batteries, tires, brakes, custom and aftermarket parts, including brands, install dates and warranty information
Maintenance schedules and reminders
Photos of insurance cards, vehicle registration and driver's license
Your PIN, stored as a cryptographic hash rather than as the PIN itself
Your app settings, themes and preferences
We cannot see any of it. There is no account system, no cloud sync, and no server-side database. If you uninstall the App or clear its data, this information is gone — including from our side, because it was never on our side to begin with.
EXPORTS: You can export your records to csv/text(clipboard) via settings page. Once exported, that file is yours to manage and this policy no longer covers it.
The App uses your camera only when you start a scan or attach a photo to a symptom check.
Photos you capture for scan-to-add are sent for analysis so the vehicle's details can be read and filled in automatically. See §5.
Photos you attach to a symptom check are sent for the same reason — so the description can account for what you're showing. See §5.
Photos you save as documents — insurance cards, registration, license — are not sent anywhere. They are stored on your device behind your PIN and are never read by the scan or symptom features.
Before a photo is sent, it is resized to reduce what is transmitted. The App does not record video and does not access your camera in the background.
We do not operate an analytics service, an advertising network, or a user account system. The App contains no analytics SDK, no advertising SDK, and no third-party tracking library. We do not build profiles, we do not sell data, and we have nothing to sell.
Requests to our scanning service pass may through a server we operate. That server may record standard technical log entries — including IP address, timestamp and request status — which are used only to keep the service running and to investigate abuse. These logs are not linked to any account, because there are no accounts.
Three features require a network connection. Each runs only when you initiate it.
What is sent: the photo you captured, or the VIN you typed, or the symptom description you wrote — together with the relevant vehicle details needed to make the answer specific to your car.
Where it goes: through a service we operate, to Google's Gemini API.
What Google does with it: we use Gemini's paid service tier. On that tier, Google does not use prompts or responses to improve or train its products. Google retains prompts and responses for a limited period — currently up to 55 days — solely to detect and prevent abuse of the service, after which they are marked for deletion. Google's handling is governed by the Gemini API Additional Terms of Service and Google's own privacy policy.
What is never sent: your maintenance history, your service records, your component logs, your costs, your reminders, or your stored documents. The AI features do not have access to them.
What is sent: the VIN. Where it goes: vpic.nhtsa.dot.gov, the US National Highway Traffic Safety Administration's public vehicle-information API. Why: to return factory specifications for that vehicle.
What is sent: vehicle identifying details needed to match recalls. Where it goes: api.nhtsa.gov, NHTSA's public recall API. Why: to return open safety recalls issued for your vehicle.
NHTSA is a US government agency and its use of data is governed by its own policies, not ours. We send no personal information to NHTSA — only vehicle identifiers.
5.4 Reporting an AI response — us
What is sent: the response you are reporting, the prompt or photo that produced it, the vehicle context attached to it, and anything you write in the comment field.
Where it goes: A service we operate. IF the service fails: our support inbox, via your device's email app. You can read and edit the message before it sends.
Why: so we can review the output and improve the App's filtering.
Retention: we keep reports for 30 days and use them only to review and improve the App's AI features. Reports are not published, shared, or used for advertising.
Reporting is always your choice. Nothing is sent unless you tap the report control.
Every other feature works with no connection. You can log maintenance, track components, manage reminders and open your stored documents entirely offline. If you use the App without a connection, the three features above will tell you they need one; nothing is queued or sent later without your action.
The symptom checker returns AI-generated information. It is triage, not a diagnosis. It can be wrong, and it does not replace inspection by a qualified technician — particularly for anything safety-critical such as brakes, steering, tires, airbags or warning lights.
If the App returns a response you believe is offensive, unsafe, or inappropriate, you can report it from within the App using the report control shown on every AI response. §5.4 sets out exactly what a report sends.
7. Children's privacy
VRoom is a vehicle maintenance tool intended for adults who own or maintain vehicles. It is not directed at children, and we do not knowingly collect personal information from anyone under 13.
The App's scanning and symptom features transmit user-supplied photos and text to Google as described in §5. If you are a parent or guardian and believe a child has used these features, contact us at the address in §10 and we will help you understand what was sent and how to request its deletion.
Because the App holds your records only on your own device, most privacy rights resolve directly on the device:
Access: your data is visible to you in the App at all times.
Correction: edit or delete any record in the App.
Deletion: clearing the App's data or uninstalling it removes everything permanently. We cannot recover it, because we never had it.
Portability: See "EXPORTS" described in §2
Reporting: you can flag any AI-generated response as offensive or inappropriate from inside the App, without leaving it. See §5.4.
For the information described in §5, which passes to Google and NHTSA, those organizations' own policies and retention rules apply.
If you are in the UK or the European Economic Area: we process the information in §5 to deliver a feature you have asked for. You have the right to access, correct, delete, restrict or object to processing, and to complain to your local supervisory authority. Given that we store nothing, requests will usually be answered by explaining what was transmitted and directing you to the relevant provider.
If you are a California resident: we do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use personal information for targeted advertising. You may contact us at §10 to exercise your rights.
Records on your device are protected by your device's own security and, for stored documents, by the PIN you set. Your PIN is stored as a cryptographic hash, not in readable form, and the App applies lockout protection after repeated failed attempts.
Data transmitted under §5 is sent over encrypted HTTPS connections.
No system is perfectly secure, and a device that is unlocked, rooted or compromised puts the data on it at risk. Set a device passcode and keep the App's PIN private.
Questions about this policy, or about what the App transmits:
Email: nomadxframework@gmail.com
11. Changes to this policy
We will update this policy when the App's behavior changes, and we will update the "Last updated" date above. Material changes — particularly any change to what leaves your device — will be noted in the App's release notes so you can see them without re-reading this page.