Privacy policy

Effective November 5, 2026 · Last updated November 8, 2026

1. Introduction

The Wrench ("we," "us," or "our") is committed to protecting your privacy. The Wrench is operated by Marine Keeper, a Washington business. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use The Wrench iOS app or The Wrench website ("the Service").

2. Information We Collect

2.1 Information You Provide

Account information: email address, password, profile details (name, experience level, role) and birth month and year
Asset data: details of the things you track (boats, bikes, cars, homes and more), engine information, maintenance records, trip logs
Financial data: savings goals, expense records, budget information (we do not store credit card numbers, payment processing is handled by Stripe)
Documents and images: uploaded manuals, receipts, and photos
Calendar and reminder data: events, maintenance schedules, and reminders
Waitlist signups: email address and the interest category you selected when you tap a Coming Soon tile or submit a category suggestion. We use this to email you a confirmation link, send you a one-time notification when the category launches, and (if you stay subscribed) keep you on The Wrench announcement list. You can unsubscribe at any time via the link in the confirmation email.

2.2 Information Collected Automatically

Crash and performance data: in the iOS app, crash reports and a sample of performance traces (via Sentry, scrubbed of personal identifiers). On the website, an automatic report when the app hits an error, carrying the error message, its technical stack trace and the page path you were on (via PostHog).
Usage analytics: page views and feature usage. Applies to the website and the iOS app.
Session recordings: a replay of your visit, covering the pages you move through, where you click and what the site writes to your browser console. Text you type into forms is masked before it leaves your browser. Applies to the website only: the iOS app does not record your screen.
Device information: browser type, OS, screen resolution. Applies to the website only.
Log data: IP address, access times, referring URLs. Applies to the website only.

Values that can appear in a web address and would be sensitive, such as an invite code or a sign-in code, are stripped out, and an error report carries only the page path rather than the full link. We never sell or share this data with advertisers.

3. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Service
Process your subscription and payments via Stripe
Power advanced features (receipt scanning, document analysis, the in-app help assistant) via third-party processing services, not used to train models
Send transactional emails
Analyze usage patterns to improve the product
Respond to support requests
Comply with legal obligations

4. Third-Party Services

These providers receive only the data necessary to perform their specific function and are bound by their own privacy policies and data protection obligations.

Supabase: database hosting and authentication (iOS app and website)
Sentry: crash and performance monitoring, scrubbed of personal identifiers (iOS app only)
Stripe: payment processing (website only)
Anthropic: Receipt scanning, document analysis, and help assistant conversations processing (iOS app and website)
PostHog: product analytics on the website and in the iOS app (named events like account created and item added). On the website it also records your session, the clicks and form interactions you make, browser console output and automatic error reports; text you type into forms is masked. The iOS app sends named events only, with no recording.
Google Analytics: web analytics and marketing attribution (website only)
Email delivery: transactional emails (account confirmations, payment receipts, notifications) are sent through our email service provider
Hosting and infrastructure: the Service is hosted on cloud infrastructure providers that may process your data as part of delivering the application

We reserve the right to engage additional or replacement third-party service providers as reasonably necessary to operate and improve the Service. We do not sell, rent, or trade your personal information to third parties for marketing or advertising purposes.

5. Data Storage and Security

Your data is stored securely on Supabase's infrastructure with row-level security policies ensuring users can only access their own data. We use HTTPS encryption for all data in transit and follow industry-standard security practices.

If you share your account, the people you invite can see the items on it and the records you log; the owner chooses what each person can change. Each person's own login, Strava rides and settings stay theirs.

While we take reasonable measures to protect your information, no method of electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your data for as long as your account is active. If you remove an item when you lower or cancel a plan, we keep that item's data for 30 days so it can be restored, then permanently delete it. If your account is deleted, by you or by us, we keep your data for 30 days so it can be restored, then permanently delete it, except where we must keep it for legal or compliance reasons. Anonymized analytics data may be retained indefinitely.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access: Request a copy of your personal data
Correction: Request correction of inaccurate data
Deletion: Request deletion of your personal data
Export: Request data export in a portable format
Objection: Object to processing for certain purposes

8. Cookies and Tracking

On the website, we use essential cookies for authentication and session management. Our analytics tools (PostHog, Google Analytics) may use cookies or similar technologies to collect usage data. You can control cookie preferences through your browser settings. The iOS app does not use cookies.

9. Children's and Teens' Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that we have collected personal information from a child under 13, we will delete it promptly. People aged 13 to 17 may use the Service with the agreement of a parent or legal guardian. We ask for your birth month and year when you sign up so we can apply these rules, and we keep only that month and year. On iOS we also use the age range Apple provides through the App Store. In the United Kingdom and the European Union, accounts for people under 18 start with session recordings, marketing analytics and reminder nudges turned off; you can turn reminders on in your settings.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The "Last updated" date at the top indicates when the policy was last revised.

11. Contact Us

Questions? Contact us at taylor@thewrench.co.