Security & privacy

Little to steal. Nothing to hide.

Reachy connects you with strangers on the street and knows where you park. So we built it to collect as little as possible and to lock down the rest. This page explains what that means for you, in plain words.

people who scan your badge

They never see who you are.

No name, no phone number, no plate. They can only send "please move your car" — and you answer with a button.

where you go

We don't keep a history of your trips.

Your phone uses your location to help you park. We don't build a map of where you've been.

your data

We never sell it. To anyone.

Not to advertisers, not to tow companies, not to data brokers. We make money from Premium and the Reachy Store.

our promises

What Reachy never keeps

These aren't settings you have to find. Reachy simply has no place to store them.

✕Who scanned your badgeThe person who scans needs no account, and we don't record their name or number.
✕Your tripsNo record of where you drove or every place you parked.
✕Messages from strangersStrangers can't type to you. They pick a ready-made request; you answer with a button.
✕Your card numberPayments go straight to a certified payment company. We never see your card.
✕Other people's platesOnly your own plate, used only to find tickets on your car.
✕Your details in error reportsWhen something breaks, our reports never include your number, email or location.
✕Anything to sellYour data isn't our product. It's never sold or shared for ads.
✕Keys hidden in the appEven if someone takes the app apart, there are no passwords inside to steal.
short-lived

Free spots you leave

When you pull out, the spot shows on the map without your name or account — and it's deleted after 15 minutes.

only if you send it

Map problems you report

The spot and a picture of the map, kept for 30 days so we can tell you when it's fixed.

you're in control

Your permission, on record

We only message you because you agreed to it — and we keep proof of that. Turn your badge off or delete your account any time.

how we protect it

Three locks on everything that's yours.

We assume someone will one day try to break in. So even if they get past one lock, two more are waiting.

youThe Reachy appno passwords or keys inside
→
lock 1Reachy's front doorchecks every single request
→
locks 2 + 3Your informationlocked away · only you can open it
01Every request is checked at the doorReachy only answers requests it recognizes. Anything else is turned away before it gets anywhere near your data.
02Your data can't be browsedNobody can look through our records directly. Information can only be reached through a short list of approved actions.
03Only you can open what's yoursEvery time, Reachy checks that the car, badge or ticket really belongs to you before showing or changing anything.
on the way

Encrypted, like online banking

Everything between your phone and Reachy travels encrypted. Nobody on the same Wi-Fi can read it.

signing in

Codes that expire fast

Sign-in codes last 5 minutes, and too many wrong tries are blocked. Sign in with Apple or Google works too.

our own keys

Locked in a vault

The passwords that run Reachy are kept in an encrypted vault only the founders can open, and changed regularly.

your lock screen

Alerts that give nothing away

"You got a new violation." "Someone needs to get out." Never your plate, the amount or a stranger's details.

your badge

A random code, not your ID

The code on your badge means nothing on its own. Lose it? Switch it off in one tap and get a new one.

when you need help

Help without snooping

Our team finds problems using a reference number, not by looking through your personal information.

your car

Plugged into your car. Never in control of it.

We know "plug this into your car" is a big ask. Here's exactly what the Reachy dongle can and can't do.

Tell when the engine turns on or offThat's how Reachy knows you parked or left.
Yes
Read the check-engine codesSo you know what the warning light means.
Yes
Unlock, start, drive or change settings on your carNever. Reachy only reads. Our own dongle is being built so it physically can't do these things.
Never
Send your data anywhere by itselfNever. Information only reaches us through your own signed-in Reachy app.
Never
Explain codes for a car that isn't yoursScan a friend's car and you only see the codes. Explanations need the car on your account.
Never
Link your car maker's account (coming later)Your login will stay on our secure servers, never on your phone. It starts read-only, and any remote action will need your Face ID or passcode.
Planned

how we ship

No update reaches you untested.

Safety rules are checked automatically

Before any update goes out, automatic tests make sure our safety rules still hold. If one fails, the update doesn't ship.

Tested on real phones

Every release runs on small and large iPhones and Android phones before anyone gets it.

Apple and Google review every version

No secret updates. Every public version of the app passes Apple and Google review first.

Nothing changed by hand

Our security settings are written down and reviewed, so nothing gets switched off by accident.

Changes tried on a copy first

Changes to how information is stored are tested on a copy before they touch the real thing.

Only the access that's needed

Every part of Reachy — and every person on our team — gets only the access their job needs.

what's next

Getting stronger before launch.

What's already done, and what we're adding.

Everything described on this pageThe front door, the three locks, encrypted traffic and the privacy promises.
Done
Face ID lock, passkeys, genuine-app proof for Live ParkingYour phone checks your face; we keep only a public key; freed spots come only from the real app.
Done
Our own address for the appEvery app call goes to one Reachy address with its own name for every door — nothing else is reachable.
Building
Closing the last back way inSo our data can only ever be reached through Reachy's front door.
Building
Proof it's really the Reachy appApple and Google will confirm each request comes from the genuine app on a real phone.
Building
Open code, signed releases, "Verify this app"Public source and signed deploys, plus a code in the app you can type on this site to confirm your phone runs the build we published. So anyone can check we keep no locations.
Next
Outside experts try to break inA professional security team tests Reachy the way an attacker would.
Planned
An independent auditAn outside firm reviews how we handle location and personal data.
Planned
For security researchers: the technical details+
  • All clients call our own API gateway at the edge; no backend address or key ships in any app or page.
  • Gateway allow-list → database grants (row-level security, no table access, explicit function allow-list) → per-function ownership checks.
  • Rate limits per visitor, stricter on sign-in and code endpoints; request size limits.
  • HTTPS only, TLS 1.2+ (1.3 on), HSTS, nosniff and no framing on every response. No certificate pinning by design.
  • Logs carry route, status, timing and a request ID — never bodies, IPs, phone numbers, emails or locations.
  • Secrets in an encrypted vault, injected at deploy, rotated at least yearly. Infrastructure as code, reviewed.
  • Planned: App Attest / Play Integrity, durable audit log, CSP, dependency and secret scanning, external penetration test, SOC 2 Type I.

Responsible disclosure

Found a problem? Tell us first.

If you think you've found a security issue, email us the details. We read every report, answer quickly, and won't take action against honest research that respects our users' privacy.

Report a security issuePrivacy policy