Privacy policy
Effective July 11, 2026. This policy covers the AutoEMate Android companion, Windows desktop app, cloud relay, and related website services.
When a phone is paired, AutoEMate processes a single-use pairing code, random device identifiers, a user-visible device label derived from the phone manufacturer and model, app version, paired desktop identifier, last-seen time, and a Firebase installation identifier used for verification-request notifications. The phone bearer token is encrypted with Android Keystore on the phone and stored only as a cryptographic hash by AutoEMate's service.
A VIN that you type or confirm after a camera scan, remote workflow commands, and live run status are relayed only between the paired phone and desktop for the requested workflow. Relay message bodies are not stored by the relay. Diagnostic reports and detailed run evidence remain on the Windows PC unless the customer deliberately shares them.
The Google Play version uses Android SMS User Consent. Android shows the selected message and asks for one-time permission before AutoEMate can read it. AutoEMate extracts a verification code on the phone and sends only that code to the paired desktop for the active, expiring request. The message and code are not stored or logged. Manual code entry remains available.
A separately distributed private Android build can, after explicit opt-in and Android permission, receive an incoming text during an active verification request. It does not read message history and does not forward unrelated messages. This private build is not distributed through Google Play.
Camera access is optional and used to scan pairing QR codes and VINs. Camera frames and recognized images are processed on the device and are not uploaded by AutoEMate. Google ML Kit may process service diagnostics such as device and app information, per-installation identifiers, performance metrics, feature events, and error codes under Google's terms; it does not receive the camera input or recognized output from these on-device APIs.
AutoEMate may process contact details, license and device records, purchase status, support requests, and information you choose to submit. Payment details are collected directly by Stripe and are not stored by AutoEMate. Website and email services may use Cloudflare and Resend to deliver the site, protect endpoints, and send requested communications.
Data is used to provide pairing, authentication, notifications, remote workflow control, licensing, security, support, and service reliability. AutoEMate does not sell personal data, serve third-party advertising, or use verification codes, VINs, or text-message content for advertising. Service providers such as Cloudflare, Google Firebase and ML Kit, Stripe, and Resend process limited data on AutoEMate's behalf to provide their respective services.
Pairing codes expire after five minutes. Verification requests and codes are held in memory only for the active request and expire within five minutes. Active phone and push records are retained while the phone remains paired. Unpairing revokes the phone credential and deletes its push token; limited device and transaction records may be retained for security, fraud prevention, accounting, dispute resolution, and legal obligations. AutoEMate uses encrypted transport, restricted relay rooms, hashed service credentials, and device-protected local storage.
You can deny camera or notification access, decline an SMS consent prompt, enter a code manually, turn off private-build SMS automation, or unpair the phone. To request access, correction, or deletion of data associated with AutoEMate, email [email protected]. We may need information sufficient to verify the request and may retain records where required for legitimate security or legal reasons.
AutoEMate is a business tool for automotive service professionals and is not directed to children. We may update this policy as the product or legal requirements change. The effective date at the top identifies the current version.