Legal

Privacy Policy

Last updated: August 14, 2026

This policy explains what information Athrun collects, how we use it, and the choices you have. Athrun is an AI-powered automotive diagnostic assistant operated by Caelus Labs ("Athrun," "we," "us"). It applies to the Athrun mobile app and the website at driveathrun.com (together, the "Service").

1. Information we collect

Information you provide

Account details. If you create an account, your email address and a password (which we store only as a securely salted hash — we never store your password in readable form).
Vehicle information. Vehicles you add to your garage, including VIN, year, make, model, trim, and engine. A VIN you save to a garage vehicle is sent to us and stored with that vehicle. Decoding a VIN is separate and is described in “Vehicle & diagnostic data” below.
Diagnostic conversations. The messages and trouble codes you submit to the diagnostic chat, and the diagnostic context we build from them.
Vehicle stats. Maintenance and ownership details you choose to track, such as mileage, oil-change timing, registration expiration, and service history.
Community content. Threads, replies, your chosen display name, and votes you post in the community forum.

Vehicle & diagnostic data

Trouble codes (DTCs) you type in, or — in the mobile app — read from your vehicle's OBD-II port over Bluetooth.
OBD-II data (mobile app). When you connect a Bluetooth adapter, the app reads diagnostic data from your vehicle, such as stored codes, the VIN, and battery voltage.
License-plate & camera VIN lookups (mobile app). If you use plate or camera-based lookup, the plate or scanned VIN is used to retrieve vehicle specifications.
VIN decoding — what we use it for. Everywhere Athrun decodes a VIN — in the mobile app, including a VIN read from your OBD-II adapter, and on the website — it is used for one purpose: determining your vehicle’s characteristics, such as year, make, model, trim, engine, and drivetrain, so that trouble codes, service bulletins, parts, and guidance are matched to the right vehicle. We do not use a VIN to identify you personally, we do not use it for advertising or ad targeting, and we do not sell it.
VIN decoding — where it happens. When you type a VIN into a vehicle form, or when the app reads one from your OBD-II adapter, the decode is performed by your own device or browser, which contacts the U.S. National Highway Traffic Safety Administration’s public vPIC service directly. In those cases the VIN is not routed through our servers to be decoded, and we do not log it as part of decoding; NHTSA receives the VIN and your device’s IP address as part of that request, and their handling of it is governed by their own policies. Three paths necessarily work differently and do reach our servers, because they cannot be performed on your device: a license-plate lookup, a photo of your VIN that we read for you, and a VIN you type into the diagnostic chat.
VINs in the diagnostic chat. If you include a VIN in a message to the diagnostic assistant, that message is handled like any other chat message: it is sent to our AI provider to generate a response (see section 3), it is read on our servers to identify your vehicle, and it is kept as part of your conversation history. If you would rather a VIN not be sent to our AI provider or stored in a conversation, add the vehicle to your garage instead — the assistant will then use that vehicle without you having to type the VIN.
How long a VIN is kept. A VIN you save to a vehicle in your garage is kept until you remove that vehicle or delete your account. A VIN in a diagnostic conversation is kept with that conversation and goes when you delete it. A license-plate lookup result, including the VIN it returned, is cached on our servers for up to seven days so that a repeat lookup does not re-run a paid query. A VIN used only to look something up and never saved — for example, narrowing the service-bulletin library to your vehicle — is discarded once your vehicle’s characteristics have been read from it; it is not stored, and it is not placed in a web address.

Location information

To find nearby auto services, the Service uses either your device's location (with your permission) or a ZIP code you enter, and sends approximate coordinates to a mapping provider to return nearby results. You can decline location access and use a ZIP code instead, or simply not use the "Near Me" feature.

Information collected automatically

A device identifier. On first use we generate an anonymous identifier so the Service works before (and without) you signing in.
Usage and technical data. Your IP address, request counts, and timestamps, which we use for rate limiting, abuse prevention, and per-user usage limits.
Crash and error diagnostics. If the app crashes or hits an unexpected error, we collect technical details — device model, OS version, app version, and a stack trace — through our crash-reporting provider, Sentry, so we can find and fix the problem. This is configured to exclude your chat messages, vehicle/VIN data, and account credentials.
Advertising identifiers. If ads are shown, our advertising partner (Google) may process advertising identifiers and related data — see "Advertising and cookies" below.

2. How we use your information

To provide the core features — answer diagnostic questions, look up codes, find parts and nearby services, and run the community forum.
To maintain your garage, sessions, and tracked stats across visits.
To keep the Service reliable and fair — rate limiting, usage caps, security, and abuse prevention.
To find and fix crashes and errors, using the crash diagnostics described above.
To moderate community content and respond to reports.
To send you service and account communications — for example, email-address verification, password resets, security notices, and important updates about the Service.
With your consent where required, to send you promotional or marketing emails about Athrun features, tips, and offers. You can opt out at any time using the unsubscribe link in any such email or by contacting us; opting out of marketing email does not stop the service and account emails above.
To improve the Service.

3. AI processing of your conversations

Your diagnostic messages are sent to Anthropic, our AI provider, to generate responses. Anthropic processes this content on our behalf to power the chat. Avoid including sensitive personal information in diagnostic messages — they aren't the place for data like government IDs, payment details, or health information. A VIN you type into a message is part of that message and is sent with it; if you would rather it not be, add the vehicle to your garage instead and the assistant will use it from there.

4. How we share your information

We do not sell your personal information. We share information only with the service providers that power Athrun's features, and only as needed for them to perform their function:

Provider	Purpose
Anthropic	AI processing of diagnostic conversations
Google	Nearby-services search (Places & Maps); advertising (see below)
eBay	Parts search and affiliate links (see below)
NHTSA vPIC	Public VIN decoding, to determine vehicle characteristics — contacted directly by your device or browser, except for the server-side paths named in section 1
Vehicle-data provider	License-plate to VIN lookup (mobile app)
Resend	Email delivery — account and service emails (verification, password reset, security notices) and, where you have opted in, promotional email
Sentry	Crash and error reporting (technical diagnostics only — configured to exclude chat content, vehicle/VIN data, and credentials)
Supabase	Database hosting (stores your account, garage, and content)
Railway	Backend application hosting
Cloudflare	Website hosting and storage

We may also disclose information if required by law, to protect rights and safety, or in connection with a business transfer.

5. Parts search and affiliate links

Parts results come from eBay's API. When you tap a listing, you may be taken to eBay through an affiliate link, and we may earn a commission on qualifying purchases at no extra cost to you. We do not store eBay listing content — listings are shown to you live and are not retained on our systems. We do record limited, non-listing engagement data (such as which result position was tapped) to understand how the feature is used.

6. Advertising and cookies

Athrun may display ads served by Google (AdMob in the mobile app, AdSense on the website). Google may use cookies, device identifiers, and similar technologies to serve and measure ads, including personalized ads where permitted.

Where required (for example, in the EEA and UK), we present a consent choice before personalized ads or non-essential cookies are used.
You can learn about and control Google's use of data at policies.google.com/technologies/partner-sites and manage ad personalization in your device or Google account settings.

7. Data retention and deletion

We keep information for as long as needed to provide the Service. When you delete diagnostic conversations, the related derived data is removed on an ongoing basis. You can delete your account and its data yourself at any time — in the app, in the web app, or from our dedicated Delete your account page, which works even without the app installed. You can also request deletion by emailing us (see "Contact"). Some records may be retained where required for legal, security, or fraud-prevention reasons. License-plate lookup results, including the VIN returned, are cached for up to seven days as described in section 1. Crash and error diagnostics sent to Sentry follow Sentry's own retention window (typically a matter of weeks) rather than our account-deletion process, since they are not tied to your account in the first place beyond the anonymous device/account identifier described above.

8. Security

We protect your information with measures including encrypted connections (HTTPS), salted password hashing, access controls on our API, and per-identity usage limits. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

9. Your choices and rights

You can review and edit your garage and stats in the app, choose whether to share location, post in the community under a display name or anonymously, opt out of promotional emails using the unsubscribe link in any marketing message, and request access to or deletion of your personal data by contacting us or using our Delete your account page.

Depending on where you live, you may have additional rights — such as to access, correct, delete, or limit the use of your personal information. To exercise any of these, email us and we'll respond as required by applicable law.

10. Children

Athrun is intended for adults aged 18 and older and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us information, contact us and we will delete it.

11. Where your information is processed

Athrun and its providers are based in the United States, and your information is processed there. If you access the Service from outside the U.S., you understand your information will be processed in the U.S.

12. Changes to this policy

We may update this policy from time to time. When we do, we'll revise the "Last updated" date above, and for material changes we'll provide a more prominent notice.

13. Contact

Questions or requests about this policy or your data:
Caelus Labs · communications@caeluslabs.com