Who handles your data
CarGo is built and run by a United States company, and every company that receives your data on our behalf is a United States company too. Cloudflare does not promise that the AI model behind the help assistant runs in a United States data center. This page lists each one, what it sees, where it works, and why it is there. The Privacy Policy explains what we collect and why; this page is the vendor list behind it. We will update this page before anyone is added to it.
The list
| Company | What it handles | Where | Why it is there |
|---|---|---|---|
| Ring, part of Amazon.com, Inc. | Your cameras, their motion clips, and the account you connected. Ring is the source of everything CarGo analyzes, under your own Ring account and Ring's privacy policy. When you share a Ring video link with CarGo, we fetch that video from Ring. | United States | CarGo reads clips through Ring's official developer program. Ring's rules forbid us from giving anyone direct access to your cameras without your consent each time. |
| Cloudflare, Inc. | Hosts the CarGo website, the app, and the software that analyzes clips. Stores the small blurred pictures of vehicles your cameras saw for 7 days, to help with your vehicles faster without downloading video again. Only you see them; blurred copies may be checked by the CarGo assistant (Anthropic, below) to name a vehicle. They are deleted after 7 days or right away when you delete your account, unlink Ring or remove the camera. Stores your account, your sightings (vehicle stills and their details), your votes, your notification subscriptions, your reports, and any video you share with CarGo, which is deleted within 24 hours. Receives the email you send to support@cargohold.io. Is the back-up for CarGo's support assistant, the automatic review of your reports, and the staff tools that review reports, on its own AI service (Workers AI, with an open Qwen model): when a call to Anthropic fails or cannot be made, or when a setting makes Workers AI the main model, it receives the same information listed for Anthropic below (the messages you type, the account summary, any still you allow the assistant to see, and blurred frames for a missed sighting you report), except the pseudonymous account identifier; and, when the assistant reviews a report, possibly short titles of product problems CarGo's staff accepted from earlier reports, including other customers' reports, and of problems proposed from your own reports. If neither Anthropic nor DeepInfra can answer a vehicle check, Workers AI answers it instead, from the same blurred vehicle still. | United States company. Your sightings, their vehicle stills, and your account records (email address, votes, Ring connection, notification subscriptions) are all stored in Cloudflare's United States jurisdiction. Cloudflare's worldwide network may hold short-lived cached copies of a page or a still near wherever it is opened. Cloudflare does not promise that the support assistant's back-up model runs in a United States data center. | Cloudflare is the whole of CarGo's infrastructure. Nothing else runs our code. Cloudflare's published Workers AI terms say it does not use what it receives, from the assistant or from a vehicle check, to train any model or to improve its services. |
| DeepInfra, Inc. | Blurred pictures only: one cropped vehicle per detection, to find the license plate in it so it can be blurred again, and to answer the vehicle check (make, model, and whether the picture shows a vehicle at all) when Anthropic cannot; a blurred picture of a parking space you marked, to find the vehicle parked in it; and, for a video you share, a picture of the time stamp printed on it, to read its date and time; and, only if Anthropic cannot answer, a blurred copy of a picture kept from the last 7 days, to name the vehicle in it when you add a vehicle. It never receives your name, your address, your camera names, or your account. | United States | The second check cuts false alerts. DeepInfra's published policy says it does not store, sell, or train on data sent through its API without explicit consent, and we have given none. |
| Anthropic, PBC | Anthropic's AI model answers the support assistant, reviews your reports, and runs the staff tools that review reports, by default (Cloudflare Workers AI answers instead when a call to Anthropic fails or cannot be made, or when a setting makes Workers AI the main model). When Anthropic answers, it receives: the messages you type, with anything personal you write in them, a pseudonymous account identifier, and a summary of your account's status in words and numbers, such as whether a device is subscribed to notifications, your vehicles' and cameras' names, and the times and match strength of recent sightings. Short summaries of your own earlier reports. With your permission for that report only: the still of the sighting you report, or your recent stills of the same vehicle. For a missed sighting you report: still frames of the vehicles in the clips recorded around that time. All after blurring, so the assistant can work out what went wrong. When it reviews a report, possibly: short titles of product problems CarGo's staff accepted from earlier reports, including other customers' reports, and of problems proposed from your own reports. For the vehicle check: one blurred still of each detected vehicle, to ask its make, model, body and colour (DeepInfra, then Cloudflare Workers AI, answer instead only if Anthropic cannot); when that answer does not confirm your vehicle's model, the same still goes to a larger Anthropic model with the same question. For a video you share or upload: blurred pictures of each vehicle in it, to suggest what the vehicle is (body type, make, model, likely years and colour) before you accept it (DeepInfra, then Cloudflare Workers AI, answer instead only if Anthropic cannot). When you add a vehicle and CarGo searches the small pictures it kept from the last 7 days: a blurred copy of one picture from each of a few groups of similar vehicles, to name the vehicle in it (make, model and colour; DeepInfra, then Cloudflare Workers AI, answer instead only if Anthropic cannot). Never video files, never your email address or tokens. | United States | The assistant answers "why did I not get an alert" from your own account's status, and the second vehicle check cuts false alerts. Under Anthropic's commercial terms, data sent through its API is not used to train its models and is deleted within 30 days. |
| Resend, Inc. | Your email address and the emails we send you: sign-in links, service notices, replies to your support emails, backup emails for alerts a device did not confirm, and alert emails if you turned them on. | United States | Sending email is a specialist's job. Resend sends the messages we hand it; under its published policy it keeps email and log data for 30 days. |
| Apple, Google, Microsoft, and Mozilla push services | For notifications in your browser or the installed website app: the address your browser assigns for notifications, and the encrypted notification itself. | United States companies with worldwide networks | There is no other way to reach a phone's lock screen from a website. Each of these notifications is encrypted end to end before it leaves CarGo, so the push service carries it without being able to read it. |
| Google LLC, Firebase Cloud Messaging | For the CarGo Android app only: the app's device token and the text of each notification, which is the vehicle's name, the camera's name, the time, the match score, and a link to the alert. Never an image. These notifications are not encrypted end to end, so Google can read this text. | United States company with a worldwide network | An Android app receives notifications through Google's service. |
| Google LLC, Gmail (our support mailbox) | Email you send to support@cargohold.io, including any attachment, such as a video. Our mail service files it as a report in CarGo and forwards a copy to our support mailbox, which Google hosts. | United States company | So a person at CarGo can read and answer it. Deleting your CarGo account removes the copies CarGo stores. The forwarded copies in the mailbox are not deleted automatically; ask us and we will delete them. |
| ntfy notification relay | No customer data, and no customer alerts. CarGo's staff receive a fixed alert headline through it, such as "camera offline". | Public relay service | A second way to tell CarGo's staff that something needs attention. |
What none of them get
CarGo sends no video to its AI providers. Cloudflare, which hosts CarGo, processes video, and Google receives any attachment, such as a video, that you include in an email to our support mailbox. A motion clip is fetched from Ring, analyzed on Cloudflare, and deleted right after the analysis, within minutes. A snapshot used to check a parking space is analyzed the same way and is not stored. A video you share with CarGo is deleted within 24 hours. Every vehicle still goes through automatic plate and face blurring before it is stored or sent to any vendor. The small pictures of a parking space that CarGo keeps for parking checks are not blurred yet; only the privacy zones you set in the Ring app are masked, and they are blurred before they are sent to any vendor. That blurring is a best effort with commercially available tools and can miss a plate or a face; the Privacy Policy says so plainly and explains how to delete a still. CarGo never receives your Ring password. Cloudflare stores the access and refresh tokens that let CarGo read your cameras, CarGo sends them only to Ring, and they are deleted the moment you disconnect.
A note on the word "stored"
We say your data is stored in the United States because that is where Cloudflare keeps it durably: your stills in a United States storage bucket, your account records in a United States data store. Cloudflare is a global network, and like every such network it may briefly cache a copy of a page or a still in a data center near the person opening it. Those caches expire on their own within minutes to an hour and hold nothing that is not already yours to see. If your situation requires that no copy ever exist outside the United States, CarGo is not the right fit, and we would rather say so here than in the fine print.
Your own device
Your phone or computer holds the app, its notification subscription, and whatever stills you have opened. That is under your control, not ours. Removing the app or turning off notifications for cargohold.io ends notifications on that device; it does not stop CarGo checking your cameras or sending email. To stop those, turn email off in Alert settings, and disconnect CarGo in Ring or delete your account.