YardWave Privacy Policy
Version 1.3, effective October 10, 2026.
Summary
- YardWave helps people search the vehicles and parts at participating self-service auto salvage yards ("Yards").
- We do not sell your personal information. We do not use it for targeted advertising. We do not use advertising cookies or third-party trackers in our Service, and we do not track you across other websites.
- When you join a Yard, that Yard receives your name and contact details, and may keep them.
- If you close your account, we delete your information within 30 days, apart from the few records listed in Section 10. Accounts unused for 12 months are closed after notice.
- You can access, correct, delete or get a copy of your information wherever you live.
- If you sign in with Google, we receive only your basic profile, and we use it only to run your account. See Google user data in Section 3.
1. Who we are
YardWave is operated by Eduardo R. Salinas, an individual doing business as SiteWave Creative ("we", "us", "our"). For privacy questions or requests, contact us at hello@yardwaveapp.com or 20711 Wilderness Oak, Suite 107 PMB 3039, San Antonio, TX 78258.
2. What this policy covers
This policy covers personal information we handle when you use our websites at yardwaveapp.com, our patron accounts and alerts, the search tool that Yards place on their own websites (the "Widget"), and the dashboards Yard staff use (together, the "Service").
It does not cover how a Yard handles information, including information it receives from us under Section 6.1 or collects itself at its premises, on its own website, or in its own waiver. Each Yard is an independent business with its own privacy practices.
3. Information we collect
| What | Examples | Where it comes from | Why we use it | Shared with | Kept |
|---|---|---|---|---|---|
| Account details | Name, email address, and, if you choose, mobile number | You, or Google if you sign in with it | Run your account, verify it, send what you ask for | Yards you join (name and contact details only); service providers | Until you close your account, then 30 days |
| Sign-in information | That you signed in with Google, and the basic profile Google shares (see Google user data below); whether two-step verification is on | You, or Google at your direction | Sign you in and keep your account secure | Service providers | As account details |
| Yards you join | Which Yards you joined, and when | You | Show you row and space, send that Yard's alerts, share your details with it | That Yard | As account details |
| Saved searches and alerts | The vehicles or parts you watch for, the Yards, how to tell you | You | Send your alerts | Service providers | As account details |
| Search activity | Searches and filters, vehicles and parts viewed | Your use of the Service | Operate and improve the Service; protect it from abuse | Service providers; never Yards | 90 days in logs, then aggregated |
| Device and log information | IP address, browser and device type, pages requested, the website the Widget was used on, dates and times | Your browser | Security, fraud and abuse prevention, troubleshooting | Service providers | 90 days |
| Acceptance and consent records | Which Terms version you accepted, when, how, from which IP address and browser; text-message consent with the wording you agreed to | You | Prove what was agreed | Service providers; courts or authorities if needed | 5 years after account closure |
| Messages to us | What you send support | You | Answer you | Service providers | 2 years |
| Yard staff details | Name, work email, role | The staff member or the Yard's account holder | Run the Yard's account | That Yard; service providers | Until the Yard leaves, then 30 days |
| Yard business details | Business name, address, billing contact | The Yard | Provide the Service and bill for it | Stripe (billing) | As the law requires for billing records |
What we do not collect. We do not ask for or collect your precise location, government identification numbers, payment card numbers, or sensitive information such as health, biometric, financial account, racial or religious information. We do not use facial recognition.
Vehicles, VINs, photos and videos. Yards publish information about their vehicles: year, make, model, vehicle identification number (VIN), color, parts, prices, photos and short videos of up to 15 seconds. This is information about vehicles, not about patrons. Yards take the photos and videos and are required not to show identifiable people, readable license plates, or personal documents left in vehicles. Videos may carry sound, such as an engine running, and must not record people or their conversations. Location data is removed from photos and videos before they are uploaded. If a photo or video shows you or your information, tell us and we will remove it or blur it.
The barcode scanner. Yard staff can scan a vehicle's VIN barcode with their phone's camera. The image is read on the phone and is not sent to us; only the VIN is.
Payments. Yards pay subscription fees through our payment processor, Stripe. We do not receive or store full card numbers. Patrons do not pay us anything.
Google user data
You can sign in to YardWave with your Google account. This part explains what we receive from Google and what we do with it.
What we access. Only when you choose "Continue with Google", and only with your permission on Google's screen, Google shares with us your Google account identifier, name, email address, whether Google has verified that email address, and a link to your Google profile picture. We ask Google for basic sign-in information only (the "openid", "email" and "profile" permissions). We do not access your Gmail, contacts, calendar, files, location or any other Google service or data.
How we use it. Only to create your YardWave account, sign you in, fill in your name when you finish your profile, and contact you about your account. We do not use it for anything else.
How we store and protect it. It is stored with your account in our database provider (Supabase) in the United States, encrypted in transit and at rest, with access limited to the systems and people who operate the Service. Our personnel look at it only to run the Service and support you, to keep the Service secure, or to comply with the law.
How we share it. We do not sell it. We share it only with the service providers that run the Service for us (Section 6.2), as needed to provide it. If you join a Yard, that Yard receives your name and contact details as Section 6.1 describes, and those may be the ones Google shared with us. We may disclose it where the law requires (Section 6.4).
How long we keep it, and deleting it. We keep it while your account is open, and delete it within 30 days after you close your account (Section 10). You can ask us to delete it at any time by emailing hello@yardwaveapp.com (Section 11). You can also remove YardWave's access in your Google Account at myaccount.google.com/permissions; that stops Google sharing anything new with us, and you can ask us to delete what we already hold.
Limited Use. YardWave's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for targeted or personalized advertising; we do not sell it or transfer it to data brokers or information resellers; we do not use it to determine credit-worthiness or for lending; and we do not use it to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models.
4. How we use information
We use personal information to:
- provide and operate the Service, including patron accounts, search, and the Widget;
- verify accounts, and show vehicle locations to people who joined a Yard;
- send the alerts you ask for, and service messages about your account;
- share your details with Yards you join (Section 6.1);
- provide support;
- protect the Service and its users, including detecting and preventing fraud, abuse, scraping and security incidents, and enforcing our terms;
- keep records of what was agreed, and establish, exercise or defend legal claims;
- comply with law and respond to lawful requests; and
- understand and improve the Service, using de-identified and aggregated information wherever possible.
We do not sell personal information. We do not use or share it for targeted advertising or cross-context behavioral advertising, and we do not use it for profiling that produces legal or similarly significant effects. We do not use your information to train artificial intelligence models.
5. Automated decisions
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
6. How we share information
6.1 With Yards you join. When you join a Yard through the Service, we share with that Yard your name and contact details and the fact that you joined it. We ask for your agreement each time. We do not share your search history, or anything about your activity at other Yards. The Yard uses that information under its own privacy practices, and may keep it after it stops using the Service. To stop hearing from a Yard, contact that Yard directly.
6.2 With service providers. We use companies that process information for us under contracts that limit their use of it to providing services to us:
| Service | Provider | Location |
|---|---|---|
| Database, sign-in and file storage | Supabase | United States (California) |
| Web hosting | Hostinger | United States (Arizona) |
| Email delivery | Resend | United States |
| Text message delivery | [to be chosen] | United States |
| Payment processing for Yard subscriptions | Stripe | United States |
| Sign-in with Google | United States | |
| Checking that a person is signing in, after repeated failed attempts | Cloudflare (Turnstile) | United States |
Sign-in protection. After several failed attempts to sign in to an account, the sign-in page asks Cloudflare's Turnstile to confirm that a person, not an automated program, is signing in; it loads only then. Cloudflare receives your IP address and information about your browser and device for that check, and does not use it for advertising.
Password checks. When you choose a password, our server checks it against Have I Been Pwned's list of passwords exposed in data breaches. Only the first five characters of a one-way hash of the password are sent, never the password, your email address or anything else about you, so the service cannot learn the password or who chose it.
6.3 VIN decoding. When Yard staff add a vehicle, its VIN is sent to the National Highway Traffic Safety Administration's public vehicle database to look up the vehicle's details. Only the VIN is sent, never information about you.
6.4 For legal and safety reasons. We may disclose information when we believe in good faith it is required by law or legal process, or needed to protect the rights, property or safety of our users, Yards, the public, or us.
6.5 Business transfers. Information may be transferred as part of a merger, acquisition, sale of assets, or transfer to a business entity we form to operate the Service. We will tell you, and this policy will continue to protect it.
6.6 With your consent, or at your direction.
6.7 De-identified and aggregated information that cannot reasonably be used to identify you may be shared or published, for example to report how many vehicles are searched each month.
6.8 Text-message information. We never share your mobile number or your text-message consent with anyone for their marketing.
7. The Widget on Yard websites
The Widget runs inside a Yard's own website. The information you enter into the Widget is sent to us and handled under this policy. The rest of the Yard's website, including any analytics or advertising tools the Yard runs on it, is governed by the Yard's own privacy notice, and we do not control it.
8. Cookies, tracking and Do Not Track
We use only cookies and similar storage that are strictly necessary to sign you in, keep the Service secure, and remember your preferences, such as a light or dark display, which is stored only on your device. We do not use advertising cookies, and we do not allow third parties to collect information about your activity in our Service over time or across other websites. Cloudflare's sign-in check (Section 6.2) is the only code from another company that runs on our pages, and only after repeated failed sign-ins.
Do Not Track and Global Privacy Control. Because we do not track you across websites, a browser's "Do Not Track" signal does not change anything we do. We treat a Global Privacy Control signal as a request to opt out of any sale or targeted advertising, which we do not do anyway.
9. Your choices about communications
- Alerts: turn them off in your account settings or from the unsubscribe link in any alert. We act on it within 10 business days.
- Text messages: reply STOP to any message to stop them, or HELP for help. Telling us any other reasonable way works too.
- Service messages about your account and legal notices are part of the Service and cannot be turned off while you have an account.
10. How long we keep information
The table in Section 3 lists how long we keep each kind of information. In general:
| Information | How long |
|---|---|
| Patron account and related information | While your account is open. After you close it, deleted within 30 days. |
| Inactive patron accounts | Closed after 12 months without a sign-in, after we email you, then deleted within 30 days. |
| Yard data and Yard staff accounts | Deleted 30 days after the Yard's subscription ends, or 30 days after the Yard's account holder confirms a deletion request (a Yard deactivated for 90 days is treated as such a request). |
| Security and access logs | 90 days, unless needed to investigate an incident. |
| Terms acceptance and text-message consent records | 5 years after the account is closed, so that we can show what was agreed. |
We keep information longer only where the law requires it (such as billing and tax records), where it is subject to a legal hold, or where it is a record of fraud or abuse, and only for as long as that purpose requires. Deleted information may remain in our secure backups for up to 7 days until they are overwritten. Information a Yard has already received under Section 6.1 is kept by that Yard under its own practices.
11. Your privacy rights
Wherever you live, you may ask us to:
- confirm whether we process your personal information, and access it;
- correct inaccurate information, which you can also do in your account settings;
- delete your information;
- give you a copy of your information in a portable format; and
- opt out of the sale of personal information, targeted advertising, or profiling. We do not do any of these, but you may still make the request, including, for Nevada residents, at hello@yardwaveapp.com.
How to ask. Use your account settings, or email hello@yardwaveapp.com. We will verify your identity, usually through your verified email address, before acting. You may use an authorized agent, who must provide proof of authority.
When we respond. Within 45 days. If we need more time, we will tell you, and may extend once by up to 45 more days where reasonably necessary.
Appeals. If we decline your request, you may appeal by replying to our decision or emailing hello@yardwaveapp.com with the subject "Privacy appeal". We will respond within 60 days. If we deny your appeal, we will tell you how to contact your state attorney general, including, for Texas residents, the Office of the Texas Attorney General.
No discrimination. We will not deny you the Service or treat you differently for exercising these rights.
Information held by Yards. Requests about information a Yard has received must also be made to that Yard. We may forward your request to the Yard, but cannot act on its records.
12. Security
We protect information with measures including encryption in transit and at rest, access controls, optional two-step verification for accounts, and separation of each Yard's data at the database level, and we record every instance of our personnel accessing a Yard's account. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you and the authorities as the law requires.
13. Children
The Service is not directed to children, and patron accounts are available only to adults 18 and older. We do not knowingly collect personal information from children under 13. If we learn that we have, or that an account belongs to someone under 18, we will delete the information.
14. Where information is stored
We operate in the United States, and personal information is stored and processed in the United States.
15. Changes to this policy
We may update this policy. If we make a material change, we will notify you by email or through the Service at least 30 days before it takes effect, and we will update the effective date above. We do not apply a material change to information collected before it without your consent where the law requires it.
16. Contact
Eduardo R. Salinas, doing business as SiteWave Creative, 20711 Wilderness Oak, Suite 107 PMB 3039, San Antonio, TX 78258. Privacy requests and questions: hello@yardwaveapp.com. General questions: hello@yardwaveapp.com.