Privacy Policy
PDR BOX · Last updated October 22, 2026
PDR BOX is a business tool for paintless dent repair: jobs, estimates, clients, photos, expenses and mileage, for one technician or a whole company. It's run by Oleksandr Los (“we”, “us”). This policy covers the PDR BOX iPhone app, the website pdrbox.com and the web app app.pdrbox.com.
We collect users' data. PDR BOX can't work without it: your account, your company's work, and the records you keep in it are stored on our servers so you and your team can reach them from any phone or computer. This policy lists everything we collect, why, who else handles it, and how to get it deleted.
The short version: we collect what you type, photograph and record in PDR BOX, plus a few technical records needed to run it. Your own expenses, receipts and trips are visible only to you. We don't sell your information, don't show ads, don't track you across other apps and websites, and don't feed your data to AI.
1. What we collect, and why
What you give us
| Information | Why |
|---|---|
| Your account: email, name, phone (optional), and a password if you set one (stored only as a one-way hash). With Sign in with Apple or Google, the name and email they share (Apple can share a private relay address instead). | Signing you in, showing who did what in your company, and putting your details on estimates. |
| Your company: name, address, phone, email, logo, settings, the people in it, their roles and teams, and the email addresses invitations are sent to. | Running the company's shared account and deciding who sees what. |
| The work: vehicles (VIN, year, make, model, color, stock number), jobs, estimates, damage, prices, pay splits, what's owed and paid, notes, photos and walkaround videos (with their sound). | This is what the app is for. It belongs to your company. |
| Information about your customers that you enter: clients and insurers (names, contacts, phones, emails, addresses, pay terms), and on estimates the vehicle owner's name, phone and email, claim and policy numbers, deductible, date of loss and the adjuster's name, phone and email. | Writing estimates and invoices for them. Your company decides what to enter and is responsible for having the right to; we only store and process it for your company (see section 11). |
| Your private records: expenses and receipt photos, recorded drives (GPS routes, times, distances, start and end places and addresses), the places and routes the trip tracker has learned, your answers about each drive, and your mileage write-off rate. | Your own bookkeeping and mileage log. Only you can see them — not your company's owner or anyone else. |
| Hail IQ: your watch zones (their names, the area drawn on the map and whether alerts are on for them) and your map settings. | Showing the same zones and settings on every device you sign in to, and alerting you about hail in them. Only you can see them. |
| Your personal app settings: colors, the bottom bar, theme, date style, trip units and notices, hail alert distance and size, map layers, client sort order. | So a new phone or a reinstall looks the way you set it up. Only you can see them. |
| Billing (company owners and admins): the plan chosen, the number of people paid for, the dates, and your Stripe customer and subscription IDs. Cards are entered on Stripe's own page; we never see or store full card numbers. | Running your company's subscription. |
| Messages you send us, such as support emails, and what you tell us in them. | Answering you. |
What we collect automatically
| Information | Why |
|---|---|
| Technical records our providers keep for a short time when you use PDR BOX: IP address, device and browser type, app version, the page or service asked for, and when. | Keeping the service secure and working, stopping abuse, and fixing problems. |
| When each row was created and changed, and by whom. | Syncing between devices and showing “changed by someone else” instead of losing work. |
| On sign-up, a Cloudflare Turnstile check that you're a person (it looks at your browser and connection, not at what you type). | Keeping bots from making accounts with other people's emails. |
| Counts across the whole service (how many accounts, companies, jobs, photos and so on, and how much storage is used). These are totals, not your records. | Running and planning the service. |
| Crash reports and app usage numbers, only if you've allowed your iPhone to share them with app developers (iPhone Settings → Privacy & Security → Analytics & Improvements). Apple sends them to us without your name. | Fixing crashes. |
We don't use analytics or advertising tools, tracking pixels, or the advertising identifier, and the app has no crash-reporting or ad SDKs.
Cookies and browser storage
The website uses only cookies it needs to work: the sign-in cookie that keeps you signed in, and a cookie that remembers whether the side menu is open. Your browser also keeps your theme and, on the web hail map, your zones and map settings. Turnstile may set its own cookie during the sign-up check. There are no advertising or analytics cookies, so there's nothing to opt out of.
2. Hail alerts
Only if you turn on Hail Alerts, the app registers with an alert service we run (on Cloudflare) and sends: your area, rounded to about 0.7 miles (nothing at all if you choose “Nationwide”); the watch zones you turned the bell on for, also rounded to about 0.7 miles; the notification address iOS gives the app; an Apple DeviceCheck token that proves the request comes from a real iPhone; your alert settings; and the app version and time zone. None of it carries your name, email or account. It's replaced each time your settings change, removed when you turn alerts off, and dropped once the phone stops receiving alerts. We don't keep a location history.
3. Who else handles your information
Inside your company, depending on role: owners, admins and accountants see all of the company's work; managers and estimators see their team's; technicians see their own work and work assigned to them. Nobody else sees your private records (expenses, receipts, trips, mileage, hail zones, personal settings) — including the company owner, and including us, except where you ask us to look or the law makes us.
Service providers that store or process data for us
They run parts of PDR BOX for us, under contract, and may use the data only to provide that service.
| Provider | What it does | What it handles |
|---|---|---|
| Supabase (United States) | Database, file storage, sign-in, and our server functions | Everything in section 1: accounts, company work, photos, videos, receipts, private records |
| Vercel (United States) | Hosts the website and web app | Pages you open and what you send through them, IP address, request logs |
| Cloudflare | Our domain's DNS, the hail alert service, and the Turnstile sign-up check | Hail alert sign-ups (section 2), IP address, the browser check on sign-up |
| Stripe | Payments for plans, on the website only | Owner's or admin's name, email, card details, billing address, payment history |
| Resend | Sends our emails: sign-up confirmation, sign-in links, password resets, invitations | Recipient's email address and the email itself |
| Apple | Sign in with Apple, push notifications, DeviceCheck, the App Store, and Apple Maps (looking up addresses for trip starts and ends, finding places you search for, and drawing missing parts of a route) | Sign-in details, the notification address, and the map points or search text sent for a lookup. Apple Maps lookups aren't tied to your Apple Account |
| Sign in with Google | The name and email Google shares when you sign in with it |
Public data services the app asks directly
The hail map, forecasts and VIN decoding come from free public services. Your phone or browser asks them directly, so they see your IP address and the area or VIN asked about — never your account or your work — under their own policies:
- the National Weather Service, the NOAA Storm Prediction Center, NOAA's National Centers for Environmental Information and NOAA's NCEP (warnings, storm reports, radar);
- the Iowa Environmental Mesonet at Iowa State University (storm reports and radar history);
- Open-Meteo (forecasts and place search);
- OpenStreetMap's Nominatim (place search) and OpenFreeMap (map tiles);
- Esri ArcGIS Online (satellite imagery on the map);
- NHTSA vPIC (turning a VIN into year, make and model).
Population and place data on the hail map (from the U.S. Census Bureau) is built into the app; nothing is sent to the Census Bureau.
Others
- The people you send things to: estimates, invoices and exports you share (by email, text, PDF or CSV) go wherever you send them.
- The law: if we're legally required to, or to protect people's safety or our rights.
- A new owner: if PDR BOX is ever sold or merged, your information would move with it under this policy, and we'd tell you first.
We don't sell or rent personal information, and we don't share it for advertising.
4. Artificial intelligence
PDR BOX does not use generative AI or chatbots, and we don't send your information to any AI service. Your data, photos and videos are not used to train AI or machine-learning models — ours or anyone else's. Two features use automatic, non-AI processing:
- VIN scanning reads the barcode and text from the camera with Apple's text recognition, which runs on your iPhone. The camera image never leaves the phone.
- Hail IQ's forecasts and estimates (chance of hail, likely sizes, people in a storm's path) are worked out by fixed formulas from public weather data, on your device.
If we ever add an AI feature, we'll update this policy first and tell you what it uses and how to turn it off.
5. On your phone
The app keeps a copy of your company's work and your private records on the phone so it works without a signal, and sends your changes when it's back online. Signing out removes that copy. A few things stay on that phone only and never reach us: the app lock (Face ID / Touch ID), whether trip tracking is on, whether hail alerts are on, and the app's diagnostic log.
6. Permissions
Every permission is optional; without one, only the feature that needs it stops working.
- Camera — scanning VINs, and photos and videos of vehicles and receipts.
- Photo library — no permission is asked: iOS's photo picker gives the app only the photos you pick.
- Microphone — the sound on walkaround videos.
- Location — the hail map and alert area while you use the app; and, only if you turn on automatic trip tracking, “Always” access so drives are recorded with the app closed.
- Motion — telling driving from walking, for trip tracking.
- Notifications — hail alerts and trip notices.
- Face ID / Touch ID — the app lock, if you turn it on. Apple keeps the biometric data; the app never sees it.
7. How long we keep it, and deleting it
We keep your information while your account is open. You can delete your account at any time in the app (Settings → Account & Sync → Delete account) or on the website (Settings → Your account). That removes your account, every way of signing in to it, your profile, and your private records, receipts, trips, hail zones and settings. If you're the only person in your company, the company and all its work and photos are deleted too. If others remain, an owner must hand the company over first, and the work you did stays with the company — it belongs to it. Deleted items in the app are kept as hidden records so other devices learn they're gone, until the company or account is deleted. Hail alert sign-ups are dropped as described in section 2. Our providers' technical logs are kept for a short time (typically days to a few weeks). Stripe and we keep payment records as long as tax and accounting law requires.
8. Your choices and rights
You can see and correct your information in the app and on the website, and export it: in the app, estimates, jobs, expenses and trips as CSV or PDF; on the website, estimates as CSV. Depending on where you live (for example California, and other U.S. states with privacy laws), you may have the right to know what we collect, to access, correct or delete it, to receive a copy, and not to be treated differently for asking. We don't sell or “share” personal information for cross-context advertising, so there's nothing to opt out of. Write to support@pdrbox.com and we'll answer within 45 days, after checking it's really you. If you use PDR BOX through someone else's company, some requests about the company's work may need to go through the company owner.
9. Security
Everything travels over encrypted connections. Our database only lets each person reach what their role allows, uploaded files are kept in private storage that only signed-in people with access can open, and our providers encrypt stored data. On the phone, data is protected by iOS, and by Face ID or Touch ID if you turn on the app lock. No system is perfectly secure; if something goes wrong, we'll tell you as the law requires.
10. Children
PDR BOX is a professional tool for adults. It isn't meant for children under 16, and we don't knowingly collect their information. If you think a child has given us information, write to us and we'll delete it.
11. Your customers' information
When your company enters information about its own customers (vehicle owners, shops, dealers, insurers, adjusters), your company decides what is collected and why, and we handle it only on your company's behalf to run PDR BOX. If one of your customers asks us about their information, we'll point them to your company.
12. Where data is kept
PDR BOX is meant for use in the United States. Our database and files are stored in the United States, and our providers may process data in other countries under their own safeguards.
13. Changes
If we change this policy in a way that matters, we'll update the date above and tell you in the app or by email before the change takes effect.
14. Contact
Oleksandr Los
support@pdrbox.com
See also our Terms of Use, the End User License Agreement and our Copyright (DMCA) Policy.