Who handles your data
CarGo is built and run by a United States company, and every company that receives your data on our behalf is a United States company too. This page lists each one, what it sees, where it works, and why it is there. The Privacy Policy explains what we collect and why; this page is the vendor list behind it. We will update this page before anyone is added to it.
The list
| Company | What it handles | Where | Why it is there |
|---|---|---|---|
| Ring, part of Amazon.com, Inc. | Your cameras, their motion clips, and the account you connected. Ring is the source of everything CarGo analyzes, under your own Ring account and Ring's privacy policy. When you share a Ring video link with CarGo, we fetch that video from Ring. | United States | CarGo reads clips through Ring's official developer program. Ring's rules forbid us from giving anyone direct access to your cameras without your consent each time. |
| Cloudflare, Inc. | Hosts the CarGo website, the app, and the software that analyzes clips. Stores your account, your vehicle stills, your votes, your notification subscriptions, your reports, and any video you share with CarGo, which is deleted within 24 hours. Receives the email you send to [email protected]. | United States company. Your vehicle stills and your account records (email address, votes, Ring connection, notification subscriptions) are all stored in Cloudflare's United States jurisdiction. Cloudflare's worldwide network may hold short-lived cached copies of a page or a still near wherever it is opened. | Cloudflare is the whole of CarGo's infrastructure. Nothing else runs our code. |
| DeepInfra, Inc. | Blurred stills only. One cropped vehicle per detection, for a second opinion on make, model, and whether the picture shows a vehicle at all. When emergency-vehicle alerts are on, a blurred frame from the clip, to check for an emergency vehicle. It never receives your name, your address, your camera names, or your account. | United States | The second check cuts false alerts. DeepInfra's published policy says it does not store, sell, or train on data sent through its API without explicit consent, and we have given none. |
| Anthropic, PBC | In a conversation with the support assistant: the question you type and a summary of your account's status in words and numbers, such as whether a device is subscribed to notifications, your vehicles' names, and the times and match strength of recent alerts. Short summaries of your own earlier reports. With your permission for that report only: the still of the alert you report, your recent stills of the same vehicle, or still frames of the vehicles in the clips recorded around that time, all after blurring, so the assistant can work out what went wrong. For the vehicle check: when DeepInfra's answer does not confirm your vehicle's model, the same blurred vehicle still, to ask the same question about make and model. Never video files, never your email address or tokens. | United States | The assistant answers "why did I not get an alert" from your own account's status, and the second vehicle check cuts false alerts. Under Anthropic's commercial terms, data sent through its API is not used to train its models and is deleted within 30 days. |
| Resend, Inc. | Your email address and the emails we send you: sign-in links, service notices, replies to your support emails, backup emails for alerts a device did not confirm, and alert emails if you turned them on. | United States | Sending email is a specialist's job. Resend sends the messages we hand it and keeps only delivery records. |
| Apple, Google, Microsoft, and Mozilla push services | For notifications in your browser or the installed website app: the address your browser assigns for notifications, and the encrypted notification itself. | United States companies with worldwide networks | There is no other way to reach a phone's lock screen from a website. Each of these notifications is encrypted end to end before it leaves CarGo, so the push service carries it without being able to read it. |
| Google LLC, Firebase Cloud Messaging | For the CarGo Android app only: the app's device token and the text of each notification, which is the vehicle's name, the camera's name, the time, the match score, and a link to the alert. Never an image. These notifications are not encrypted end to end, so Google can read this text. | United States company with a worldwide network | An Android app receives notifications through Google's service. |
| Google LLC, Gmail (our support mailbox) | Email you send to [email protected]. Our mail service files it as a report in CarGo and forwards a copy to our support mailbox, which Google hosts. | United States company | So a person at CarGo can read and answer it. Deleting your CarGo account removes the copies CarGo stores. The forwarded copies in the mailbox are not deleted automatically; ask us and we will delete them. |
| ntfy notification relay | No customer data. CarGo's staff receive a fixed alert headline through it, such as "camera offline". | Public relay service | A second way to tell CarGo's staff that something needs attention. |
What none of them get
No vendor other than Cloudflare, which hosts CarGo, receives video. A clip is fetched from Ring, analyzed on Cloudflare, and deleted within minutes. A video you share with CarGo is deleted within 24 hours. Every still goes through automatic plate and face blurring before it is stored or sent to any vendor. That blurring is a best effort with commercially available tools and can miss a plate or a face; the Privacy Policy says so plainly and explains how to delete a still. No vendor receives your Ring credentials; the tokens that let CarGo read your cameras stay inside your CarGo account and are deleted the moment you disconnect.
A note on the word "stored"
We say your data is stored in the United States because that is where Cloudflare keeps it durably: your stills in a United States storage bucket, your account records in a United States data store. Cloudflare is a global network, and like every such network it may briefly cache a copy of a page or a still in a data center near the person opening it. Those caches expire on their own within minutes to an hour and hold nothing that is not already yours to see. If your situation requires that no copy ever exist outside the United States, CarGo is not the right fit, and we would rather say so here than in the fine print.
Your own device
Your phone or computer holds the app, its notification subscription, and whatever stills you have opened. That is under your control, not ours. Removing the app or turning off notifications for cargohold.io ends it.