Privacy policy

Car Image API is operated by Meter (“Meter”, “we”, “us”). This policy explains what personal data we collect when you use the website at https://carimage.dev, the dashboard, the REST API, the MCP endpoint, the command-line tool, the SDK and the agent plugins (together, the “Service”), why we collect it, and the choices you have. Questions go to hello@meterapp.co.

This policy covers Car Image API only. Other Meter products have their own privacy policies.

The Service turns text parameters (a make, model, year, color and camera view) into a vehicle render. You never upload images to us, so no image content we hold is about you. What we do collect:

Account

• Your email address, which you give us when you sign in with a magic link or with Google. If you sign in with Google we also receive the display name and profile picture URL from your Google profile.
• Your credit balance, purchase history and a ledger of every credit added or spent.

API keys and access tokens

• We store a SHA-256 hash of each API key together with its short prefix, the name you gave it, its scopes, when it was created and when it was last used. The full key is shown to you once and is never stored in plain text; we cannot recover it for you.
• If you connect Car Image API to a third-party assistant or app, sign-in and consent are handled by Supabase Auth, which issues the app an access token for your account. We store a per-app connection key (hashed, limited to generating images and reading your balance) and which app it belongs to. You can revoke the connection from Connected apps in your dashboard or by disconnecting in the app.

Request logs

• Every API call is logged with a request_id, a timestamp, the route and method, the response status, credits charged, latency, an error code if any, and the vehicle parameters requested (make, model, year, view, color, format and size).
• Each log line also carries the client identifier your SDK, CLI or plugin sends, the first 300 characters of the user agent, a country code derived by our hosting provider, and a salted hash of the calling IP address (see below).

Product analytics

• We record product events (for example a page view, a signup, an API key created, a first image, a purchase) with an anonymous visitor id, a session id, the page URL and referrer, campaign parameters such as ?ref= and utm_*, the truncated user agent, the country code and the same salted IP hash. Event properties are stripped of email addresses and credentials before they are stored.

Billing

• When you buy credits, Stripe handles the payment. We store your Stripe customer identifier, the payment-method summary Stripe reports back (card brand, last four digits and expiry) so the dashboard can show it and, if you turn it on, charge auto-reloads, and the signature-verified webhook events Stripe sends us. Full card numbers never reach our servers.

Feedback and support

• The rating, verdict and reason you submit when you rate a render.
• The contact details and any message you send us by email, or through the lead form, including a company name and use case if you choose to give them.

We do not keep raw IP addresses in our request logs or analytics. Before a log line is written the IP is combined with a secret salt (ANALYTICS_IP_SALT), hashed with SHA-256 and truncated. The hash lets us count distinct callers and spot abuse; it cannot be reversed into the address without the salt.

Two things use the address itself for a short time: rate limiting on endpoints that do not require a key (device login, the lead form, the playground), whose counters are deleted within an hour, and the Cloudflare Turnstile check that guards the playground, which receives the IP to decide whether the visitor is a person. Our hosting provider also sees IP addresses in the normal course of serving requests.

• To run the Service: authenticate you and your keys, render and deliver images, meter credits and bill you.
• To keep it secure: rate limiting, abuse and fraud detection, and investigating incidents.
• To support you: a request_id you quote lets us find exactly the call that went wrong.
• To improve renders and the product: feedback and request logs tell us which prompts produce bad images and where people get stuck.
• To understand how people find and use the Service: aggregate analytics on signups, activation and purchases.
• To contact you: a welcome email after signup, transactional messages about your account or billing, and replies to your support requests. Every non-transactional email carries an unsubscribe link.

We do not sell personal data and we do not share it with advertisers. We use the following providers to run the Service; each receives only what its job needs:

• Supabase — database, authentication and file storage. Holds the data listed above and sends magic-link sign-in emails from login@carimage.dev.
• Vercel — hosting and content delivery. Processes every request and supplies the country code we log.
• Stripe — payments, saved payment methods, invoices and the billing portal. Stripe’s own privacy policy applies to the payment details you enter there.
• OpenAI — image generation. When a render does not exist yet we send a prompt describing the vehicle (make, model, year, color and view) and receive an image. No account or personal data is included in that prompt.
• AgentMail — sending and receiving our transactional and support email on the carimage.dev domain.
• Cloudflare — the Turnstile bot check on the playground.
• Google — sign-in with Google, if you choose it, and Google Analytics 4 for aggregate site analytics where it is configured. We do not load Google Analytics when your browser sends a Do Not Track or Global Privacy Control signal.

We may also disclose data when the law requires it, to protect the Service or its users from abuse, or as part of a merger or acquisition, in which case this policy continues to apply to the data transferred.

We use a small number of first-party cookies, none of them for advertising:

• Session cookies set by Supabase Auth when you sign in, so the dashboard knows who you are. They are HTTP-only and refreshed as you use the site.
• First-touch cookie that records how you first arrived (the ?ref= or utm_* parameters and the referring site) for 90 days, so we can attribute a later signup to the right place. It is HTTP-only and holds no identifier.
• Playground cookie that remembers you passed the Turnstile check for two hours so previews stay free while you explore.
• Anonymous visitor id stored in a cookie and in local storage for product analytics, and a session record in session storage. Both are skipped when Do Not Track or Global Privacy Control is on.
• Your light/dark theme preference, kept in local storage.

The API itself sets no cookies; it is authenticated by the Authorization header only.

Account data, API key records, the credit ledger and billing references are kept while your account is active and for a reasonable period afterwards so we can answer billing questions and meet our legal obligations. Request logs and product analytics are kept while the account is active and for a reasonable period after; we use them in aggregate for as long as they help us run the Service.

Some records are deleted on a schedule by the database itself:

• Rate-limit counters: about one hour after their window closes.
• Device-login codes and single-use image delivery records: one day after they expire.
• Connected-app sign-in records and tokens are kept by Supabase Auth for as long as the connection exists; we keep only the hashed connection key, marked revoked when you disconnect.
• Completed render-job records: seven days.

Revoked API keys stay in our records as revoked so a leaked key can never be reused. When you ask us to delete your account we remove your profile, keys, connections and billing settings; ledger and log entries are anonymized or deleted unless we have to keep them for tax or accounting purposes.

Depending on where you live you may have rights to access, correct, export, restrict or delete your personal data, and to object to some processing. You can exercise any of them by emailing hello@meterapp.co from the address on your account; we answer within 30 days. You can also:

• See and revoke your API keys and connected apps in the dashboard.
• Manage saved payment methods and download invoices in the Stripe billing portal, linked from the dashboard.
• Unsubscribe from non-transactional email with the link in any message we send.
• Turn on Do Not Track or Global Privacy Control in your browser to opt out of analytics.

If you are in the EU, UK or another jurisdiction with a supervisory authority, you may also lodge a complaint with it. Our providers may process data in the United States and other countries; where the law requires it we rely on their standard contractual safeguards for those transfers.

All traffic to the Service is encrypted in transit. API keys and connection keys are stored only as hashes, database access is default-deny with server-side policies, and card data is handled by Stripe rather than by us. No system is perfectly secure; if we learn of a breach that affects you we will tell you without undue delay.

The Service is a developer tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, email us and we will delete it.

When we change this policy we update the date at the top of this page and, for changes that materially affect how we use your data, email account holders before the change takes effect. Continuing to use the Service after that date means you accept the updated policy.

Privacy questions and requests: hello@meterapp.co. For the rules that govern use of the Service, see the terms of service.