Privacy Policy
CarGo tells you when your own vehicles arrive at or leave your property, using motion clips from your Ring camera. This policy explains what we collect, why we collect it, who else handles it, and how you can have it deleted. We have written it to be read, not skimmed past.
1. What we collect
The table below lists every kind of data CarGo keeps, the reason it is kept, and how long it stays.
| Data | Why we keep it | How long |
|---|---|---|
| Your email address | We use it to send sign-in links, service notices, and replies to your support emails. If an alert is not confirmed on a device, we email it to you. Turn off in Alert settings. An email for every alert goes out only if you turn it on. | It stays for as long as your account exists. |
| Your Ring connection, meaning an access token and a refresh token for your Ring account together with the identifiers and names of your cameras | These let CarGo read your cameras' motion clips. We never receive or store your Ring password. | They stay until you disconnect CarGo, either in the Ring app (Ring My Apps) or by asking us, or until you delete your account. |
| Motion clips from your camera | Each clip is analyzed on our servers to find vehicles. | A clip is deleted within minutes, as soon as it has been analyzed. We do not keep motion clips. |
| Videos you share with CarGo, from the Ring app or by upload | CarGo looks through the video for the vehicle you want it to learn. | Shared videos are deleted within 24 hours. |
| Vehicle stills, meaning a small cropped image of each detected vehicle, with a best-effort blur applied to license plates and faces before it is stored (the blur is automatic and can miss; it is not guaranteed), along with the time, the direction of travel, a match score, and the vehicle CarGo believes it saw | These are what you see in an alert, and they let you confirm or correct it. | They are purged automatically 90 days after the event, or sooner if you delete the alert. We keep no separate backup copies of stills. |
| Your votes ("mine" or "not mine") and the appearance signature of each vehicle you confirmed | They teach CarGo what your vehicles look like. The signature is a list of numbers describing a vehicle's overall appearance; it is not an image, it cannot be turned back into one, and it is used only within your own account. | They stay for as long as your account exists, or until you remove that vehicle. |
| Your notification subscription, meaning the push address your browser or the CarGo Android app gives us | It is how alerts reach your phone. | It stays until you turn notifications off or the subscription expires. |
| Support email you send to [email protected] | Our mail service files it as a report in CarGo and forwards a copy to our support mailbox at Google (Gmail), so a person can read and answer it. | Reports are kept while your account exists. Deleting your account removes the copies CarGo stores. Forwarded copies in the support mailbox are not deleted automatically; ask us and we will delete them. |
| Operational logs, meaning request times, error messages, and the IP addresses handled by our hosting provider | They keep the service running and secure. | They are short-lived, and they are never used to profile you. |
2. What we do not do
We do not sell or rent your data, and we do not show advertising. We do not identify, track, or build profiles of other people or their vehicles; other cars that appear in your clips are used only as "not yours" examples inside your own account, and faces we detect are blurred. We do not read license plates, because CarGo recognizes vehicles by their overall appearance, and we blur the plates we detect in the stills we keep. We do not use your images to train models for other customers.
Everything stays inside your own account. A vehicle's appearance signature is compared only against clips from your own cameras. It is never compared with any other customer's data, never matched against vehicle registries, license-plate databases, or any outside source, and never used to follow a vehicle or a person from one place to another. CarGo creates no biometric identifiers of any kind: face blurring runs before a still is stored, and nothing in the service measures or recognizes people. Blurring is a best effort, not a guarantee. It is done automatically with commercially available detection tools, and those tools have practical limits: a plate at a steep angle, a face in profile or under a hat, a distant or dark subject, or an unusual plate design can be missed. The stills come from your own camera and are shown only inside your own account. If a still shows something you would rather not keep, you can delete it at any time from its menu, and deleting it removes it from our storage; you can also report it so that we can improve the blurring.
Nobody at CarGo watches your stills. Support works from the metadata, such as times, camera names, and match scores. A still is looked at only when you have allowed it for that one picture: by ticking the box when you report a problem, or by tapping Allow when we ask inside a report, or when the law requires it. In practice it is CarGo's support assistant that looks, and it describes the problem in words; a person at CarGo looks at a still only when the assistant's description is not enough. Each look is written into that report, where you can read it under My reports. Reports, replies, and your conversations with the assistant are kept inside CarGo, in the same United States storage as the rest of your account. Email you send to support is the one exception: a copy also goes to our support mailbox at Google (Gmail).
3. Who else handles your data
Only the following companies handle your data, each for the purposes given here. Ring and Amazon are the source of your motion clips, under your own Ring account and Ring's privacy policy. Cloudflare, a United States company, hosts CarGo and stores your account data; your vehicle stills and your account records are stored in Cloudflare's United States jurisdiction, and Cloudflare's worldwide network may hold short-lived cached copies near wherever a page is opened. DeepInfra runs a second AI check of a detected vehicle's make and model; it receives only the blurred still, never your identity or your location. When emergency-vehicle alerts are on, it also receives a blurred frame from the clip to check for an emergency vehicle. Apple, Google, Microsoft, and Mozilla carry notifications to your browser or the installed website app; these are encrypted end to end, so they cannot read them. Notifications to the CarGo Android app travel through Google's Firebase Cloud Messaging and are not encrypted end to end: Google receives the vehicle's name, the camera's name, the time, the match score, and a link to the alert, but never an image. Resend sends our emails: sign-in links, service notices, replies to your support emails, backup emails for alerts a device did not confirm, and alert emails if you turned them on. Google also hosts our support mailbox (Gmail), which receives a copy of email you send to support. ntfy, a public notification relay, carries fixed service alerts to CarGo's staff and receives no customer data. Anthropic powers CarGo's support assistant. In a conversation it receives the messages you type, a summary of your account's status in words and numbers, and short summaries of your own earlier reports. It looks at a picture only with your permission for that report: the still of the alert you report (when you tick its box or tap Allow), your recent stills of the same vehicle, or still frames of the vehicles in the clips your cameras recorded around that time, each only when you tap Allow when the assistant asks. Every picture has been through the blurring described above, and each look is written into that report. The assistant never receives video files.
DeepInfra processes the blurred still in the United States to answer one question about the vehicle; under its published privacy policy it does not store, sell, or train on data sent through its API without explicit consent, and we have given none. When DeepInfra's answer does not confirm your vehicle's model, Anthropic answers the same question from the same blurred still; under its published policy it does not train on data sent through its API and deletes it within 30 days. Every company on this list that receives your data is a United States company, and CarGo's own processing runs on their United States services. The full list, with what each company sees and why, is on Who handles your data.
We will update this list before we add anyone to it. We do not share your data with anyone else unless the law requires us to. Requests from law enforcement or courts are honored only when they arrive as a valid, binding subpoena, court order, or search warrant, or when there is an imminent threat to someone's life, and we will tell you about such a request unless the law forbids it. Ring's own rules also prohibit us from giving law enforcement direct access to anything from your cameras without your consent in each instance.
4. Your choices and rights
You can stop alerts at any time by turning off notifications on your phone or in the app. You can disconnect Ring by removing CarGo's access in your Ring account or by asking us; the moment the connection ends, CarGo stops reading your cameras, and we delete your Ring tokens. You can delete any still or alert whenever you like, in the app or by asking us. To delete everything, open the app, tap Menu, then Delete my account: your account and its data are deleted at once and we confirm it by email. You can also email [email protected] from your account address; we then delete your account and its data within 30 days and confirm that we have done so. If you would like to see what we hold about you, ask, and we will send you a copy within 30 days.
If you live in California or in another US state with a privacy law, the rights above cover what that law gives you, and we do not sell or share personal information for advertising. If you live in the EU or the UK, the same rights apply under the GDPR, and our legal basis for processing is performing the service you asked for.
5. Security
Everything travels over HTTPS. Access is granted by a signed-in session or by a private key that you control. Credentials and Ring tokens are stored with our hosting provider, encrypted at rest, and we keep as little data as the service needs. No system is perfectly secure; if we learn of a breach that affects you, we will assess it within 24 hours and tell you within 72 hours, along with any regulator the law requires us to notify.
6. Children
CarGo is intended for adults managing their own household or business cameras, and it is not directed to children. We do not knowingly collect data from anyone under 18. If a child happens to be in a clip, that clip is handled exactly like every other one: it is deleted within minutes, and the same best-effort face blurring is applied to any still.
7. Changes
If we change this policy in a way that matters, we will note the change here with a new date, and for significant changes we will email you first. If CarGo ever gains a new kind of detection, we will tell you before it is turned on for your account.
8. Contact
Granite Peak Engineering LLC · San Marcos, California · [email protected]