Privacy Policy

1. What we collect

• Account data: email address, name, and hashed password (if you sign up directly). If you sign in with Google or Facebook we receive your name, email, and profile photo from them.
• Order data: shipping address, items purchased, order history, and any notes you leave at checkout.
• Payment data: handled entirely by Stripe or PayPal. We never see your full card number. We store the payment processor's opaque customer/payment-method IDs so saved cards work on return visits.
• Vehicle/garage data: if you tell us what you drive (year/make/model/chassis), we use it to filter fitment and pre-fill the fitment widget next visit.
• Activity: what you viewed, what you saved to wishlist, what you put in cart, what you bought.
• Technical: IP address, user agent, referring URL, basic device info. Standard server logs.
• Newsletter: if you opt in, your email and the source of the sign-up (footer, restock widget, etc.).

2. Why we collect it

• Ship orders, process refunds, send receipts.
• Show you fitment-relevant parts and price you fairly (no price-by-IP nonsense — same prices for everyone).
• Email order updates, restock notifications you asked for, abandoned-cart reminders (1h and 24h), and — only if you opted in — marketing.
• Fraud prevention and basic site security.
• Aggregate analytics: which parts move, which categories trend, where we're losing checkouts. Internal only.

3. Third parties we share with

We share the minimum required for each service to do its job:

• Stripe and PayPal — payment processing. They handle the card data; we hold the IDs.
• Resend — transactional and marketing email delivery (order confirmation, tracking, restock, etc.).
• Suppliers / distributors — for drop-shipped orders, we forward your shipping address and item to the supplier so they can ship it. They are bound by their own privacy terms.
• Shipping carriers (USPS, UPS, FedEx, etc.) — name, address, phone for delivery.
• Vercel and Neon — our hosting and database providers. Data is stored in the United States.

We do not sell your data. We do not share it with ad networks for behavioral retargeting.

4. Cookies and local storage

• Required: session cookie (sign-in), cart contents in your browser's localStorage so your cart survives reloads.
• Functional: your last-used vehicle for fitment pre-fill, recently-viewed parts.

We don't run third-party ad cookies. We do not load Facebook Pixel, Google Ads tags, or similar. We do load basic first-party analytics for understanding traffic.

5. How long we keep it

• Account & order data: as long as your account is active, plus seven years after the last order (tax / chargeback window).
• Wishlist, recently-viewed, fitment preferences: until you delete them or close your account.
• Server logs: rolling 30 days.

6. Your rights

Regardless of where you live, you can email privacy@kodo.app and we will:

• Send you a copy of what we have on file.
• Correct anything that is wrong.
• Delete your account and associated data (except records we are legally required to retain — completed orders, tax records).
• Stop marketing emails.

California residents have additional rights under the CCPA (right to know, right to delete, right to opt out of sale — note: we do not sell personal data). EU/UK residents have rights under GDPR (access, rectification, erasure, portability, objection). Same email handles all of it.

7. Children

Kodo is not directed at children under 13 and we don't knowingly collect their data. If you believe a child has created an account, email us and we will remove it.

8. Security

Passwords are hashed with bcrypt. Payment data never touches our servers. Database access is restricted to a small number of operators and protected by per-environment credentials. We still recommend a unique password for your Kodo account.

9. Changes

If we make a material change we'll update the effective date and, for significant changes, email account holders. For important context on data handling tied to specific purchases, see also our Terms of Service.

10. Contact

Privacy questions: privacy@kodo.app. General support: support@kodo.app.