Privacy Policy

1. Introduction

Garage Scan ("we," "our," or "us") provides a smart garage monitoring and shipment tracking platform. This Privacy Policy explains what data we collect, how we use it, and your rights. It applies to the Garage Scan website, web application, and connected hardware devices (collectively, the "Service").

2. Google Sign-In & Authentication

When you sign in with Google, we receive and store:

• Email address — to create and identify your account
• Display name — to personalize your dashboard
• Profile photo URL — to display your avatar

Scopes used for authentication: openid, email, profile

3. Gmail Access & Shipment Tracking

To provide shipment tracking features, Garage Scan requests access to your Gmail account using the following Google API scopes:

• gmail.readonly — to read email content for extracting tracking IDs
• gmail.metadata — to scan email subject lines and sender addresses to identify shipping-related emails

What we do:

• We scan email subject lines and sender addresses using gmail.metadata to identify shipping-related emails only
• We read only emails confirmed as shipping confirmations from carriers (FedEx, UPS, DHL, Amazon, USPS, etc.)
• We extract only the tracking ID and carrier name from matching emails
• We display extracted tracking information on your Garage Scan dashboard
• gmail.metadata is used first to filter — only confirmed shipping emails are then read via gmail.readonly

What we strictly do NOT do:

• We do not read, store, or process any email content beyond shipping confirmation emails
• We do not store raw email bodies, attachments, or full email content on our servers
• We do not use Gmail data for advertising, retargeting, or profiling
• We do not use Gmail data to train AI or machine learning models
• We do not share or sell Gmail data to any third parties
• We do not allow humans to read your emails except when required for security investigation with your explicit consent
• We do not process Gmail data for any purpose other than displaying your shipment tracking information

Revoking Gmail access:

You may disconnect Gmail access at any time from your dashboard settings or directly at myaccount.google.com/permissions. Upon revocation, no further Gmail data will be accessed.

Gmail data retention:

• Extracted tracking IDs are retained for 30 days after delivery confirmation, then permanently deleted
• Raw email content is never written to our servers
• Upon account deletion, all Gmail-derived data is permanently removed within 30 days

4. Other Data We Collect

• Device information: Device name, serial number, firmware version, connection status
• QR scan data: Device-to-account pairing information
• Usage data: Pages visited, features used, timestamps
• Order & shipment data: Tracking IDs and carrier information for dashboard display

5. How We Use Your Data

• Authentication: To verify your identity and provide secure account access
• Device management: To link your Garage Scan devices and display their status
• Live streaming: To enable viewing of your live garage video feed
• Shipment tracking: To display package delivery status using Gmail-extracted tracking IDs only
• Service improvement: To understand usage and improve features
• Support: To respond to support tickets and resolve issues

6. Data Retention

• Account data: retained while account is active
• Device data: retained while device is linked
• Shipment tracking data: deleted 30 days after delivery
• Gmail-extracted data: deleted 30 days after delivery or on account deletion
• Usage logs: retained 90 days then deleted
• Account deletion: all data permanently removed within 30 days
• Session records: deleted after 30 days of inactivity
• Audit logs: retained for 24 months for security and compliance purposes

7. Third-Party Services

• Google OAuth 2.0 — Authentication and Gmail API: policies.google.com/privacy
• Amazon Web Services (AWS) — Cloud infrastructure including Cognito (authentication), API Gateway, Lambda, DynamoDB (sessions, credentials, events), RDS (admin data), S3 (recordings and media), IoT Core (device communication), SQS and SNS (messaging and notifications): aws.amazon.com/privacy
• Supabase — PostgreSQL database hosting (used as database only; Supabase Auth is disabled): supabase.com/privacy
• Firebase (FCM) — Mobile push notifications: firebase.google.com/support/privacy

We do not share personal data with third parties for marketing or advertising.

8. Security Measures

• All data encrypted in transit via TLS/HTTPS
• Authentication is handled exclusively by AWS Cognito — passwords and credentials are never stored in our application database
• Role-based access control (RBAC) is enforced at the API layer — no client application has direct database access
• OAuth tokens are managed server-side and never transmitted to or stored in client applications
• Access logs maintained to detect unauthorized access attempts

9. Your Rights

• Access: Request a copy of your personal data
• Correction: Update inaccurate data via profile settings
• Deletion: Request permanent account and data deletion
• Revoke Gmail access: Via dashboard or myaccount.google.com/permissions
• Data portability: Request data export in machine-readable format

Contact: support@garagescan.com — we respond within 30 days.

9A. California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

1. Know what personal information we collect and how it is used
2. Delete your personal information, subject to certain exceptions
3. Correct inaccurate personal information
4. Opt-out of the sale of personal information — we do not sell personal information
5. Non-discrimination for exercising your privacy rights

To exercise these rights, contact us at support@garagescan.com. We will respond within 45 days.

9B. Children's Privacy

GarageScan is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us at support@garagescan.com and we will delete it promptly.

10. Google API Services Compliance

Garage Scan's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used solely to provide shipment tracking features directly to the authenticated user and for no other purpose.

11. Changes to This Policy

We update the "Last updated" date when this policy changes. For material changes we notify you via email. Continued use after changes constitutes acceptance.

12. Contact Us

Garage Scan

Email: support@garagescan.com

We respond to all privacy-related requests within 30 days.