Effective date: April 21, 2026
App: Glovebox (package com.glovebox.app)
Publisher: ClearFlow Content · outreach@clearflowcontent.com
All of the following is stored locally on your phone and is never sent to us or anyone else:
Uninstalling the app removes all of this from your device.
Glovebox contacts four external services, each for a specific feature. If you don't use the feature, the request isn't made.
Service: National Highway Traffic Safety Administration
(vpic.nhtsa.dot.gov, api.nhtsa.gov).
When: When you add a vehicle (VIN decode) or view safety recalls.
What is sent: VIN, or year/make/model.
Purpose: Decode your VIN; look up open safety recalls.
Privacy: NHTSA is a US federal agency and does not track users. See nhtsa.gov/privacy-policy.
Service: Google Gemini 2.5 Flash, accessed through a Cloudflare Worker we operate.
When: Each time you send a message in the in-app AI chat, or when the app generates a summary of an owner's manual.
What is sent:
Not sent: your VIN, your photos, your name, your email, or any other identifier that ties this request back to you.
Our Worker: Relays the request to Google and returns the reply. The Worker does not store the chat text after responding. Standard server logs may retain IP addresses for up to 30 days for abuse prevention.
Google's handling: Google processes prompts to produce a response. See Google's AI processing terms at ai.google.dev/gemini-api/terms.
Service: Cloudflare Worker we operate, which in turn uses the Brave Search API.
When: When you open an owner's manual for a vehicle whose manual isn't already cached on the server.
What is sent: Year, make, and model of the vehicle.
Not sent: VIN, your location, or any personal identifier.
Stored: The structured manual content is cached on our Cloudflare D1 database, keyed by year/make/model, so other users with the same vehicle can reuse it. This cache does not contain any user-specific data.
Service: Firebase Crashlytics and Firebase Analytics (Google).
When: Automatically, while the app is running — unless you opt out (see below).
What is sent:
Purpose: Understand which features are used and fix crashes.
Retention: Default Firebase retention windows apply (14 months for most event data).
Opting out: The first time you open Glovebox you are shown a "Help improve Glovebox" dialog that explains what is collected and asks you to choose either Allow or Opt out. You can change your mind at any time from Settings → Share anonymous usage data. When the toggle is off, Glovebox calls Firebase's analytics and crash-reporting opt-out APIs so no further analytics or crash data is sent from your device.
Google's handling: Firebase is subject to Google's privacy policy at policies.google.com/privacy.
Service: Google Play Billing.
When: Only if you choose to buy an optional in-app unlock (for example, the AI assistant or OBD-II diagnostics). The core app — vehicle records, service history, reminders, mileage logs, receipt photos, recalls, manual viewer — is free.
What is sent: Nothing goes from Glovebox to Google that identifies you. Your purchase is handled entirely by the Google Play Store. Glovebox receives only a signed confirmation that you own the entitlement; we never see your card number, billing address, or Google account email.
Google's handling: Purchases are processed under the Google Payments Privacy Notice at payments.google.com.
Glovebox only requests permissions needed for specific features:
| Permission | Why it's needed |
|---|---|
| Internet | Contact NHTSA, the AI chat backend, and Firebase |
| Camera | Take photos of receipts and documents (stays on device) |
| Read photos / media | Pick existing receipt photos from your gallery |
| Post notifications | Deliver maintenance reminder notifications |
| Bluetooth (scan / connect) | Connect to OBD-II diagnostic adapters. Scan is marked neverForLocation — we do not derive location from Bluetooth. |
| Access network state | Required so Wi-Fi OBD-II adapters can be reached even when they don't provide internet |
| Receive boot completed | Re-schedule your maintenance reminders after a phone restart |
We never request contacts, precise location, SMS, call logs, calendar, or health data.
Glovebox is not directed at children under 13 and we do not knowingly collect personal information from children. If you believe a child has used the app in a way that provided us personal data, email outreach@clearflowcontent.com and we will act promptly.
No system is perfectly secure. If you discover a vulnerability, please report it to outreach@clearflowcontent.com.
If the policy changes in a material way, the in-app Settings screen will link to the updated policy. The "Effective date" at the top will be updated. We recommend re-reading the policy after any major app update.
Questions, data-access requests, or privacy concerns:
Email: outreach@clearflowcontent.com