Last updated 18 October 2026
The short version: each photo you take is sent to Google to work out what the car is. If you never sign in, your photos stay on your phone. If you sign in, each car you catch — which car, when and where, its photo and the sticker cut from it — is backed up to your account, privately, so your collection survives a new phone. No advertising and no tracking of any kind.
whatmodel! is made by Yacine Rabehi, who is the data controller for the information described here. If you want anything explained, corrected or deleted, write to support@whatmodel.fun.
Your account. When you sign in with Apple or Google we receive your email address and, if the provider sends it, your name. If you use Apple's Hide My Email, we only ever see the relay address Apple invents for you — we never see your real one. You can also sign in with just your email address: we send a six-digit code to it, and typing the code in signs you in — there is no password. This is stored so that your account exists and can be signed back into. Signing in is only asked for when you add a car to your collection, and never before you buy anything.
Your purchases. whatmodel! is paid for by subscription or a one-off purchase, sold and billed by Apple. We never see your card or payment details. To know whether the app should open for you, we use RevenueCat, which receives from Apple what you bought and when it renews or ends, tied to a random identifier for your installation — or, if you are signed in, to your account, so your purchase follows you to a new phone.
Your Spotter ID. A public handle written like a number
plate, such as YAC-4821: three letters taken from your email
address and four random digits. Three letters are not enough to work out the
address from, which is the point. It exists so that other collectors can find
you when friends and leaderboards arrive.
Photographs. To identify a car, the photo you take is sent to Google's Gemini API, which replies with the make and model. Google processes the image under its own terms, on a paid tier, which means your photo is not used to train Google's models. The photo is kept on your phone, inside the app; if you are signed in, a copy is also kept with your account (see Your collection, backed up below).
Where you found it. If you allow location access, the place a car was caught is saved with it — the exact coordinates, the name of the town and the country — so the map can show where you have been and some badges can tell where you have travelled. The place name and country come from Apple's own service. If you are signed in, these are backed up with the catch (below).
Your collection, backed up. When you are signed in, a record of each car you catch is stored with your account: which card it is, when you caught it, where (as above), any note you wrote, and whether you kept it as a sticker or a photo. The photograph of the car and the sticker cut from it are stored too, in a private folder that belongs to your account, along with how you arranged your album and which of the week's quests you have already claimed. This is so that signing in on another phone brings your collection back as you left it. A photograph taken in the street can show more than the car — people, number plates, the place — so it is worth knowing that these copies exist. Nobody but you can open them: the folder has no public address, the storage refuses it to any other account, and we do not look at it, share it or use it for anything but giving it back to you. If you never sign in, nothing is backed up and your collection exists only on your phone.
Leaderboards. The app has two leaderboards: most spots this week, and highest level. If you have an account, you are on them by your Spotter ID — the number plate, such as YAC-4821, which does not say who you are — together with your level, how many cars you have spotted and collected, and the profile picture your sign-in gave your account (if it gave one). Never your full photos, and never where you were. Your name is shown only if you switch on Show my name in the app's Settings, and it is checked against a short list of words. If you are signed in, your name is kept with your account whether or not it is shown, so that a new phone — or the app put back after deleting it — shows the same name; nobody else can see it unless you switch it on. A name can be changed once a week, and to hold that rule we keep the date it last changed and a scrambled mark of it that cannot be read back as the name. The numbers are counted on our server from the catches saved to your account. Tapping a player on the leaderboards shows their card: the stickers of their rarest catch and their latest one — the car cut out of the photo, which can show its number plate — with the day of the latest (never the time or the place), how far through the collection they are, the brand they have caught most of, the badge they chose to wear, the month they joined, and where they stood the day before. To show those two stickers, any signed-in player can be sent the sticker files of anybody on the leaderboards; never the photos they were cut from. We may remove a name or a player from the leaderboards. If you do not want to be on them at all, write to support@whatmodel.fun and we will take you off; deleting your account does it straight away. If you never sign in, you are not on them.
Mistake reports. If you tap Wrong car? Report, we receive what the app said the car was, what you say it actually is, any note you add, and the version of the app. Never the photo. Reports are not linked to your account or your name — only to the installation identifier below — and are used to find and fix what the app gets wrong.
A device identifier. Each identification, and each mistake report, carries an identifier for your installation of the app, so we can count how many an installation makes in a day and stop the service being abused. It is stored with those daily counts and reports and nothing else, and it is not linked to your account or your name.
Under the UK and EU General Data Protection Regulation, the reasons are:
Our database, sign-in, purchase records and sign-in emails are handled in the United States, and Google's identification service may process a photograph outside the country you are in. Where information leaves the UK or the European Economic Area, it is transferred under the safeguards those rules require — in practice the standard contractual clauses our providers publish.
Your account details — the email address and Spotter ID — and the backed-up records of your catches are kept until you delete your account, and go the moment you do. Identification counts are stored against the day they happened, are never read again after that day, and are deleted once they are no longer any use for spotting abuse. Mistake reports are kept while they help improve identification; write to us and any you sent will be removed. The photographs and stickers backed up with your account are kept for as long as the catch they belong to: deleting a car removes its pictures from our servers, and deleting your data or your account removes all of them. On your phone they stay for as long as you keep the app.
Everything the app sends travels over an encrypted connection (HTTPS/TLS). The database will only ever hand a row to the account it belongs to, which is enforced by the database itself rather than by the app asking nicely. The Google key that pays for identification lives on our server and has never been inside the app, so it cannot be pulled out of a download.
No service can promise perfect security, and this one does not either. What it can say is that no payment details are held here at all, and that the records and pictures that are held can only be read by the account they belong to.
Settings → Account → Delete account removes your account, your Spotter ID and your email address from our servers for good. If you signed in with Apple, the app's access to your Apple ID is withdrawn at the same time, and every backed-up record of your catches, and every photograph and sticker stored with them, is deleted with the account. Settings → Delete my data removes the cars, photographs and places held on your phone, deletes the photographs and stickers backed up to your account, forgets the name kept with your account, and marks your backed-up records as deleted so that no other phone signed into your account brings them back; those records are removed from our servers entirely when the account is deleted. Deleting a single car from its own page removes its pictures from our servers too. Deleting the app removes what is on your phone, but not the backup — that is what the backup is for.
whatmodel! is not aimed at children under 13, and we do not knowingly collect anything from them. If you believe a child has given us their details, write to support@whatmodel.fun and it will be deleted.
whatmodel! is run from Algeria, so Algeria's Law 18-07 on the protection of personal data applies to everything here. Depending on where you live, the GDPR (UK and EU) or the CCPA/CPRA (California) and laws like them give you the right to ask what we hold about you, to have it corrected, to have it deleted, to receive a copy of it, and to object to how it is used. Deleting is the one you can do yourself, in the app, in about five seconds.
For everything else write to support@whatmodel.fun and we will answer within 30 days. We have never sold anyone's information and have nothing to sell, so the opt-out those laws provide is not a thing you need here.
whatmodel.fun is a handful of static pages served by Cloudflare. There are no analytics, no cookies and no trackers on it. Cloudflare keeps short-lived technical logs of requests for security and reliability, as any host does; we do not read them, and there is no account or profile behind them.
If this policy changes, the date at the top changes with it, and anything significant will be said inside the app rather than quietly published here.