WarrantyCam Privacy Policy

Effective date: 28 October 2026 · App package: com.warrantycam

Core posture: a workshop’s warranty evidence is held in the Workshop Store — the server the developer runs for the workshop — and the store is the only copy: nothing is written into a Google Drive, a technician’s personal one or the workshop’s own. Google sign-in is the only identity: the App has no account of its own, and no Job or Capture records who added it.

1. Who we are

WarrantyCam (“the App”) is an Android application for workshop technicians to capture, organise, and share warranty evidence for a Job (keyed by WIP). This policy explains what the App handles on your device, what the Workshop Store holds, who may open the workshop, and what the developer does not collect.

Contact: [email protected] · Issues / feedback: github.com/gw1337x/Warranty-Cam-privacy/issues

2. What the App stores on your device

Depending on how you use the App, the following may be stored locally on your phone or tablet:

Job metadata — for example WIP, registration, model, Chassis Code, recalls/fault notes, and the related details you enter.
Captures — photos, videos, and imported files you attach as warranty evidence, including filenames and CaptureCategory.
App preferences — Cloud Sync and Storage Destination choices, and the device’s own copy of the workshop’s shared settings (photo and video quality, custom models, saved recalls). The shared ones belong to the workshop, and section 3 says where they live; your theme belongs to the device that set it.
A sign-in session — the token the store issued when you signed in with Google, kept in the App’s own storage on the device so a restart does not sign you out.
Optional biometric lock preference — a local on/off setting only. Biometric templates stay in the device OS; the App does not upload fingerprints, face data, or lock credentials.

You can delete Jobs and Captures in the App. Uninstalling the App removes local App data on that device; what the workshop’s store holds belongs to the workshop, and is described below.

3. Where the workshop’s evidence lives

Cloud Sync writes a Job and its Captures to the Workshop Store: one server, with a database for Job and Capture records, the workshop’s settings, the membership list and sign-in sessions, and object storage for the Capture files themselves. Evidence bytes go from the phone straight to that storage over an upload link minted for one file, and are read back through a signed link that expires shortly after it is minted — so a link copied out of the App stops working soon after. The Web Companion reads the same store, which is how a claim can be checked at a desk.

The store is the only copy of that evidence: nothing is written from it into another service, and no other copy is kept.

Local Only — evidence can stay on the device with no sign-in at all: the App captures, organises and exports with no signal and no server. Work kept on the device while signed out drains to the workshop once you sign in.
Storage Destination — Cloud Only, Local Only, or Both controls whether files remain on the device after upload (independent of files that already live on a diagnostic tablet).
Workshop settings — custom models, generation codes, disabled models, saved recalls, and photo and video quality are the workshop’s: held once in the store and shared by everyone signed in, so a new phone gets them back and two phones are not configuring two different workshops.

4. Signing in, and who may open the workshop

Google sign-in is the only door. The App sends the Google identity it receives to the store, which checks it and then checks it against the workshop’s membership list — one row per person, a Google ID and a name only the owner reads. The store holds no WarrantyCam account, no password and no email address for you. It keeps its own session instead: thirty days, sliding as you use it, with only a hash of the token stored. Signing out ends it. If the owner removes your membership, your next sign-in is refused, and the sessions that membership had opened end in the same act — so a phone already signed in is refused at its next request, not at the end of the thirty days.

If the workshop has not added you, the App is refused and shows your own Google ID. Under that refusal is one button, Ask the owner to add me: it hands the same Google sign-in back to the store and asks it to keep a Join Request — which account is asking, the name Google gives for it, and when it last asked. Asking again refreshes that one request rather than adding a second. A request is not a membership and it opens no session: the App still cannot open the workshop until the owner decides.

The owner answers the requests from the Membership page of the Web Companion, behind the same Google door. Admitting an account writes its membership row, and that row is what lets its next sign-in open the workshop. Declining removes the request and keeps no record of it, so a declined account is free to ask again.

No Job and no Capture records who added it. Membership decides who may open the workshop; it is not an audit trail, and there is no owner column to search.

5. Sharing and Warranty Hub Submission

When you use Warranty Hub Submission or another share action, the App opens the Android system share sheet with your Evidence Package and a short WIP/registration summary. You choose the destination (for example Microsoft Teams or email). The developer does not stand between you and that handoff.

6. Permissions the App may request

Camera — to take photos and video Captures.
Microphone — when recording video with audio.
Photos / media / storage — to save or import Captures when local storage is used.
Biometric / device credential — only if you enable optional local app lock.
Network — for Cloud Sync, opening links you choose, and the Google sign-in above.

The App asks for no Google Drive permission at all, so it cannot reach a technician’s personal Drive.

7. What the store holds, and what it does not

The Workshop Store holds, for the workshop it belongs to:

the Job and Capture records of the evidence the workshop captured, and the Capture files themselves — its warranty evidence;
the workshop’s shared settings — the models, recalls and quality choices section 3 lists;
the membership list: a Google ID and a name for each person, which only the owner reads;
the Join Requests waiting for the owner: for each, the Google ID the store verified, the name Google gives for that account, and when that account last asked — each held until the owner admits or declines it;
sign-in sessions, keyed on a hash of each token.

The store does not hold, beyond what the workshop put there:

payment card details — the App sells nothing and takes no payment;
advertising identifiers, usage analytics, or any profile of what you capture;
who added a Job or a Capture;
an email address — the Google sign-in carries one and the store does not keep it, for a member or for a request: the ID is what the door checks, and the name is what the owner reads;
biometric templates, which never leave the device OS;
anything from a technician’s personal Google Drive.

Nothing in the store is sold. It is held by Cloudflare, which runs the store and its storage, and sign-in is checked by Google — the two providers named in this policy — and no one else is given access to it.

Deleting evidence. Deleting a Job in the App removes its Job record and its Capture records from the store, in one transaction; deleting a single Capture removes that record. The App can no longer reach the evidence once its record is gone. A file already written into the workshop’s storage is not erased from it.

8. If you leave the workshop

The owner removes a technician from the Membership page of the Web Companion, in one act: it deletes their membership row and the sessions that membership had opened. The row stops the next sign-in, and ending the sessions closes the phones already signed in — at their next request, not at the end of the thirty days. Either way the phone keeps its queued work.

You keep the Jobs and Captures stored on your own phone, and the App keeps working in local mode: capture, organise, export, and submit through the share sheet.
You keep the Google account you signed in with. It was never a WarrantyCam account, and nothing about it changes.
You keep the Google Drive tree from before the workshop moved to the store, if it sat in your own Drive. It was left where it was, and nothing deleted it.
You lose the workshop’s Jobs and Captures, including the ones you added. They are the workshop’s claim evidence: removing you does not delete them, and access to them goes.

Work already queued on the phone is kept rather than thrown away: the workshop stops accepting it, so it waits on the phone instead of landing, and nothing is deleted. If the owner adds you back and you sign in again, it drains.

9. Children

WarrantyCam is intended for adult workshop / technician use. It is not directed at children.

10. International use

Data on your device stays on that device until it is uploaded or shared. The Workshop Store and its storage are run by Cloudflare, and sign-in goes through Google; the data they hold is processed in those providers’ locations under those providers’ own terms. Evidence you share goes to whoever you chose in the share sheet.

11. Changes

We may update this policy as the App evolves. The effective date at the top changes when we do, and a change in where evidence lives lands with the policy that says so, first: this revision describes evidence in the Workshop Store alone, and it goes live before any release that writes evidence anywhere else. It also says how a technician asks to join, what a request waiting for the owner holds, and what removing a member does to the phones already signed in — one act from the owner’s page, which is the act the page now offers. Continued use of the App after an update means you accept the revised policy.

12. Contact

Privacy questions: [email protected]