Privacy policy

1. Who we are and what this covers

Park Contact is operated by Crovyx, Maksimirska cesta 114, 10000 Zagreb, Croatia. Contact info@crovyx.com for support, privacy questions or requests about your data.

This policy covers the public website, guest QR messaging and the Park Contact Android owner app. The public demonstration runs locally in your browser: demo messages are not sent to an owner or to our API. Account and real messaging features are available only in releases where the service has been enabled.

2. Information we process

Owner accounts: Firebase account identifier, email address, display name, language/country preference and account status. If you choose Google sign-in, Google/Firebase supplies basic account identity, including your name and email and, where provided, profile information. Email/password credentials are handled by Firebase Authentication; our messaging backend does not store your password.

Vehicles and stickers: the labels you enter, vehicle slots, sticker identifiers, QR token hashes, activation/revocation status and timestamps. Avoid putting unnecessary personal information in vehicle labels.

Contact requests: selected reason, optional short message, replies, language, conversation status and timestamps. Guests do not need an account. A temporary guest session credential identifies the conversation; its hash is stored by the backend.

Notifications: Firebase Cloud Messaging registration tokens, installation identifiers, platform, delivery status and timestamps. Notification payloads identify the conversation, contact reason and reminder step; the current implementation does not include the full message body in the push payload.

Security and support: hashed IP addresses used by our messaging backend for abuse controls, rate-limit records, reports, blocking records, technical/audit events and correspondence you send to support. Hosting and authentication providers also process IP addresses and ordinary connection/device information.

3. Why we use this information

To provide the requested service: authenticate owners, manage vehicles and QR stickers, deliver guest requests and owner replies, and send enabled notifications and reminders. For owner accounts, this processing is necessary to perform our service agreement (GDPR Article 6(1)(b)).

To operate guest contact and protect the service against spam, fraud and misuse, we rely on our legitimate interests in reliable, private vehicle communication and service security (Article 6(1)(f)). We limit the information used for these purposes and you may object to this processing.

To answer support and rights requests and comply with applicable obligations, we rely on the relevant service agreement, legitimate interests or legal obligation (Article 6(1)(c)), depending on the request. Where a feature requires consent, we ask separately and you can withdraw it. Allowing notifications in Android is optional and can be changed in device settings.

4. Google sign-in and limited use

Google sign-in is used only to establish and maintain your Park Contact owner identity. We request basic sign-in information (openid, email and profile), not access to Gmail, Google Drive, contacts or calendars. Enabling an API in a cloud project does not grant Park Contact access to your Google content.

We do not sell Google user data, use it for advertising, or use it to train AI models. We use and share it only to provide and secure the disclosed service, respond to your request, or meet applicable legal obligations. Our use of Google user data follows the Google API Services User Data Policy, including its Limited Use requirements.

Disconnecting Park Contact from your Google account removes its Google authorization; it does not by itself delete your Park Contact account. Use the account-deletion path below to request removal of the account and associated service data.

5. Who receives data

The vehicle owner receives the guest's selected reason and message, and the guest can receive the owner's reply. The QR page does not publish the owner's account email or phone number. Messages are private service messages, not public posts; they are not end-to-end encrypted.

Cloudflare hosts the website, API and D1 service database. Google/Firebase provides owner authentication and Android push delivery. Google Fonts supplies this website's typeface and receives the technical information associated with those font requests. When you email us, our email service processes the correspondence.

Authorized operators and service providers may access data where needed for support, security or operation. We may disclose information where legally required, to protect rights or safety, or during a business transfer with appropriate notice and safeguards. We do not sell personal data or share it for advertising.

6. Processing outside your country

Cloudflare and Google operate international infrastructure. Information may be processed outside Croatia or the European Economic Area. Provider processing is subject to their applicable data-protection terms and transfer safeguards, such as Standard Contractual Clauses or an applicable adequacy decision. You can contact us for information about the safeguards relevant to your data.

7. Retention and deletion

We retain owner account, vehicle, sticker and associated conversation data while the account is active and the records are needed to provide the service. Conversation records currently have no fixed automatic expiry. You may request earlier deletion of specific data or of the whole account.

For a verified account-deletion request, we remove the Park Contact account and associated vehicle/sticker records, messages, conversation credentials, notification tokens and reminder records, and delete the Firebase authentication account. QR stickers then stop providing contact access. Signing out, uninstalling the app or disabling notifications does not delete the account.

Support correspondence and limited security or legal records are retained only as long as necessary to resolve the request, investigate misuse or meet an applicable legal requirement. If an exception prevents immediate deletion, we explain the reason, scope and applicable retention period. Provider backups and operational records expire under the relevant provider's retention processes; they are not an active account.

We respond to data-rights requests without undue delay and normally within one month. If a lawful extension is necessary, we tell you within that month. We may ask for proportionate proof that you control the account; do not send passwords, sign-in tokens or identity documents unless we explain why a specific document is necessary.

8. Security and your choices

We use HTTPS, authenticated owner access, revocable QR credentials, hashed guest credentials and abuse limits. Keep your Google/Firebase account secure and replace or revoke a sticker if its QR code is misused. No online service can guarantee absolute security.

This website stores language and theme preferences locally in your browser. The operational sign-in flow may store authentication state through Firebase, and guest sessions use browser storage to maintain access to a conversation. These are functional features. The current website does not include advertising or analytics trackers, and the demo is kept in page memory.

You can change language/theme using the website controls, clear browser storage, disable notifications in Android, sign out, revoke a sticker and request data deletion. Your browser or operating system's camera permission for scanning a QR code is separate from the Park Contact Android owner app, which does not request camera, microphone, contacts or precise-location access.

9. Your data-protection rights

Where applicable, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent without affecting processing that was lawful before withdrawal. We do not make decisions with legal or similarly significant effects solely through automated processing.

Providing owner identity is necessary to create and operate an owner account. Guests can choose a preset reason without adding free-text personal information. You may complain to the Croatian Personal Data Protection Agency (AZOP) or your competent supervisory authority.

10. Children and policy updates

Park Contact is intended for adults and is not directed at children. If you believe a child has provided personal information, contact us so we can review and remove it where appropriate.

We update this policy when the service or our data practices change. The date at the top identifies the current version; material changes will be communicated through an appropriate service notice.