Privacy Policy

Wrenchy, LLC ("Wrenchy", "we") makes shop management software for auto repair shops. This policy says what personal information the current version of the Wrenchy app handles, why, which companies handle it with us, how long it stays, and what you can ask of us. It covers the app at www.wrenchy.io: the sign-in pages, the app itself, and the pages a shop's customers open from a text or an email, such as an estimate, an invoice, a booking or a payment page.

The forms and the page and action counts on this website are described in a separate notice, How we use your information. Where that notice is more specific than this policy, the notice governs.

1. Who you are to us

• A shop user: an owner or a member of staff who signs in. The shop holds the account; we handle your information to run it.
• A shop's customer: a person whose vehicle a shop services with Wrenchy. The shop collects your information and decides what to do with it; we hold it for the shop and act on the shop's instructions. Ask the shop first about anything it recorded, and ask us if you cannot reach the shop.
• A visitor to the sign-in pages.

2. What we collect

• From a shop user: your name, email address and mobile number, the shop's name, address and hours, and what you do in the app, with the time.
• At each sign-in: your network address, your browser's description of itself, and a rough location (city and region) worked out from the network address by ipapi.co. The app keeps these so you can see your own sessions and so a new device can be told from a known one. A sign-in lasts seven days unless you sign out.
• From a shop's customer, as the shop enters it or as you give it on a page we host: your name, phone number, email address and address; the vehicle (year, make, model, VIN, plate and odometer); the work estimated and done; photos and notes from an inspection; the appointment you booked and any files you attached to it; your approval of an estimate, recorded with your name, the time, your network address, your browser's description and your signature; the payment record; and the texts and emails exchanged with the shop through the app, with their delivery status.
• Card details go straight to Stripe. We never see or store a card number.
• If you rate a shop from an invoice page: the stars you gave, what you wrote and your first name.

3. Why

• To run the shop's work: estimates, repair orders, invoices, appointments, inspections, parts orders and payments.
• To send the texts and emails a shop asks us to send its customers: appointment reminders and confirmations, estimate links, invoices, payment links and receipts, and a request to rate the shop after a visit.
• To sign you in and keep the account safe.
• To answer support questions.
• To count visits to the sign-in pages and the app, as section 6 describes.

We do not use personal information for our own marketing without asking you first, and we never sell it.

4. Who handles it with us

Each company below handles information only to provide its service to us, under its own terms with us. Nobody buys, rents or trades it. Several of them handle information only when a shop turns the corresponding feature on; those are marked.

• MongoDB, Inc. holds the database, on Google Cloud servers in the United States.
• Hetzner Online GmbH hosts the servers that run the app, in the United States. Cloudflare, Inc. carries the pages to your browser.
• Amazon Web Services, Inc. stores uploaded files, such as inspection photos, shop logos and booking attachments, in its US East (Ohio) region.
• Stripe, Inc. processes card and wallet payments and pays shops out. A shop that takes payments through Wrenchy opens a Stripe account and agrees to Stripe's terms during Stripe's own onboarding. Card numbers go to Stripe and never to us.
• Twilio Inc. sends and receives the texts and tells us whether each one was delivered.
• Resend, Inc. delivers our email, in the United States.
• Zoho Corporation hosts our mailboxes, so what you write to a @wrenchy.io address is stored there.
• ipapi.co turns the network address of a sign-in into a rough location.
• Google LLC receives what you type into an address field in the app, through its Places service, and runs the measurement scripts in section 6.
• Mapbox, Inc. draws the map on the appointment page a customer opens, and receives your network address when the map loads.
• NHTSA's vPIC service, run by the U.S. government, decodes a VIN and receives only the VIN.
• Carfax, Inc., when a shop is enrolled with Carfax and looks a vehicle up by plate: the plate and state go to Carfax and the VIN comes back.
• Intuit Inc. (QuickBooks), when a shop connects it: the invoices and customer records the shop chooses to sync.
• Meta Platforms, Inc., when a shop has connected its Facebook page: the stars, words and first name of a customer who rated the shop are posted to that page.
• OpenAI, L.L.C., when a shop user asks the app to draft a reply to a customer's words: those words and the shop's name go to OpenAI's API, which does not train on them and keeps them for up to thirty days for abuse monitoring.
• hcti.io, when a shop user turns a customer's words into a picture to share: the stars, the words and the first name.

5. Cookies and what stays in your browser

• session_token is set when you sign in, can be read only by our server, and lasts seven days. Without it you cannot stay signed in.
• tutorial_accepted remembers that you closed the app's first-run tour.
• Your light-or-dark choice is kept in your browser's local storage, not in a cookie.
• On a payment page, Stripe sets its own cookies to tell a real payment from a fraudulent one; Stripe's cookie policy lists them.
• The Google cookies described in section 6.

6. Measurement scripts on the current app

The sign-in pages and the app load the scripts below. None of them is needed for the app to work. This section was read against the live pages on November 5, 2026.

• Plausible Analytics (Plausible Insights OÜ) counts page views without a cookie. It records the page, the site you came from, your browser, your device and its system, and your country, region and city. It does not store your network address, which it combines with a value that changes every day into a one-way code. Its records are held in the European Union.
• Google Analytics (property G-ZECNSJ125F) sets the cookies _ga and _ga_ZECNSJ125F, which last up to two years, to count visits and tell a returning browser from a new one. You can stop it with Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout.
• A Google Ads tag (AW-17847940141) sets the cookie _gcl_au and a local-storage entry and tells Google when a browser reaches these pages, so that Google can count a visit that followed a Google ad. Under California's law this may count as sharing personal information for cross-context behavioral advertising. You can opt out of personalized ads from Google at adssettings.google.com, and a browser that blocks third-party cookies blocks the doubleclick.net cookie this tag also sets.
• Cloudflare Web Analytics measures how fast the pages load, without a cookie, as the notice describes.

Google explains what its scripts collect at https://policies.google.com/technologies/partner-sites.

7. Text messages

The app sends texts only to a number a shop's customer gave the shop, and only about that customer's vehicle and visit: reminders, confirmations, estimate links, invoices and payment links. Replying STOP to any of them stops all of them from that shop, and replying START turns them back on. Mobile numbers, and the record of a customer's consent to texts, will not be shared with third parties or affiliates for marketing or promotional purposes; Twilio carries the messages as our subcontractor. The SMS terms give the details.

8. How long

• A shop's records, including its customers' records: as long as the shop's account is open. When a shop closes its account and asks, we delete its records within thirty days, except the payment and tax records the law requires a business to keep.
• The record of a consent given or withdrawn, for texts or email: three years after the last message, because that is how long the law lets a complaint be brought.
• Sign-in records: until the session expires or you remove it from your sessions in the app.
• A deleted record leaves the live database at once and leaves the backups as they expire.
• Measurement records: Plausible keeps its counts for as long as our account with it exists, and Google keeps its for the period set in the property; the Google cookies last up to two years.

9. Where it lives

The servers that run the app, its database and the files it stores are in the United States. Plausible's counts are in the European Union. If you are in Canada, your information crosses the border to be stored in the United States and is subject to the laws of the United States while it is there.

10. Your rights

You can ask what we hold about you, have it corrected or deleted, get a copy of it, or withdraw a consent. A shop's customer should ask the shop first; we help the shop answer, and we answer you directly if you cannot reach the shop. Write to [email protected] or [email protected]. The person in charge of the protection of personal information at Wrenchy, LLC is named in the footer of this page and answers within thirty days. We never treat you differently for asking.

If you are in Quebec, you may complain to the Commission d'accès à l'information. Anywhere else in Canada, to the Office of the Privacy Commissioner of Canada. If you are in California, the rights to know, correct and delete above are yours too; nothing here is sold, and the one thing that may count as sharing is the Google Ads tag in section 6, with its opt-out there.

11. Children

The app is for businesses. We do not knowingly collect personal information from a child under 13. If you believe we hold some, tell us and we delete it.

12. Security

Connections to the app are encrypted. Passwords are stored as one-way hashes. The sign-in cookie can be read only by our server. Card numbers never reach us. No system is perfectly safe; if a breach puts you at risk, we tell you and the authorities the law names.

13. Changes

This policy carries the date of its version at the top. We post each change here, and a change that widens what we collect or why is also emailed to the owner of every shop account.

Questions about this policy go to [email protected].