MyMec Privacy Policy

Who we are

MyMec is offered by an individual doing business as Bosstudio, in the United States, who is responsible for the information described here. Contact us at help@bosstudio.org.

Information stored only on your device

Everything you enter is stored on your phone: vehicles (year, make, model, trim, nickname, VIN, and notes), odometer readings, service plans, service history, bundles (parts and work, prices, and where you got them), and app settings, including your age group, whether a parent or guardian accepted the Terms, and your choice about error reports. We never receive it, except in encrypted form if you turn on cloud backup. Backup files and device backups are described below.

MyMec Cloud (optional)

If you turn on cloud backup, the app creates a 16-digit account code on your phone. While cloud backup is on, and while it is turned off but not yet deleted (the app keeps checking the account’s status, about once a minute while it is open), our server receives and stores:

• Your encrypted garage. It is encrypted on your phone with AES-256-GCM, using a key derived from your account code. The app never sends us your code or the key, so we cannot read your garage.
• An account identifier and a hash of your login token. Both are derived from your code, and neither can feasibly be used to recover your code.
• A one-way hash of a device identifier. The app reads Android’s ANDROID_ID or iOS’s identifierForVendor, or, if neither is available, a random identifier it creates and keeps only on your phone, and hashes it on your phone. Only the hash is sent; the original value stays on your phone. The hash identifies your phone to our server, which uses it to limit how many devices can use one account and to limit and detect abusive sign-ups. The app reads the identifier only when you use cloud backup.
• Technical details: when the account was created, the size of your encrypted backup, when it was last changed, a keyed checksum used to detect changes, when each of your devices last connected, a random name for each device (such as “Amber Otter”) so you can tell them apart, and, if you turn cloud backup off, when the account is due to be deleted.
• Your IP address, which is used to protect the service (rate limits and blocking abusive traffic). It is held briefly in memory for rate limiting and abuse scoring, and stored only with records of new cloud sign-ups and, if an address is blocked for abuse, in the block list. For IPv6 we keep only the network prefix (/64). Our servers do not keep access logs.

Error reports (off until you opt in)

Error and performance reports are off. They are sent only after you (for ages 13 to 17, your parent or guardian) turn them on, with a separate unchecked box when accepting the Terms or later in Settings › Share error reports. Until then, nothing is recorded, queued, or sent. If you turn them off again, nothing more is recorded and reports waiting to be sent are deleted. When they are on, MyMec sends a report when the app hits an error or stalls badly, and now and then a summary of how smoothly its screens drew, so we can find and fix the cause. A report contains:

• What went wrong: the kind of error, a short message, and the list of code calls that led to it (a stack trace). Before a report leaves your phone, the app replaces anything that looks like a long number, a VIN, an email or web address, a file path, an account code or token, or quoted text.
• How it happened: the screen that was open and a short list of recent steps in the app, such as opening a sheet or finishing a sync. It holds the names of screens, never anything you typed or saw.
• The app and phone: the app version, the phone’s operating system and version, its manufacturer and model, its screen refresh rate and thermal state, and, for a stall, how long the frame took, plus now and then how many frames drew late on each screen.

A report has no account code, garage data, name, email address, or device identifier, and we do not link it to your cloud account or to any other report. The removal of personal details is automatic and cannot catch everything, and the phone model and screen names remain, so we handle reports as information that could relate to you and do not try to identify you from them. Our server uses your IP address only to limit how many reports it accepts, and does not store it with a report. Reports are kept apart from cloud backups, are used only to fix the app, and are deleted after 60 days.

How we use information

We use this information only to provide cloud backup and sync, keep the service secure, prevent abuse, and find and fix errors in the app. We do not use it for advertising or profiling, and we do not combine it with other data. If you are in the European Economic Area or the United Kingdom, our legal bases are the performance of our contract with you (providing the cloud service you asked for), our legitimate interest in keeping the service secure, and your consent (error reports, which are off unless you turn them on). Our automatic abuse controls can temporarily block an IP address; we make no other automated decisions about you.

Sharing

We do not sell personal information, and we do not use it for advertising. Our server runs on infrastructure rented from a hosting provider, which processes data to run the server for us. Once a week, a backup of the server’s database, without its IP-address tables, is also stored in the Google Drive of the person who operates Bosstudio, a storage service from Google: it holds your encrypted garage and the account details above, but no IP addresses. We may disclose information if the law requires it, but without your account code we have no way to decrypt your garage.

How long we keep it

Scheduled deletions run hourly, so each happens within an hour of the time shown.

Security

Data travels over encrypted HTTPS connections. Your account code and keys are kept in your phone’s secure storage, and the app never sends them to us. A lost account code cannot be recovered by anyone, including us. No method of storage or transmission is completely secure, but we design the service so that a breach of our server would not reveal your garage. This also applies to its weekly backups, which hold your garage only in encrypted form.

Device permissions

• Notifications: reminders are scheduled on your phone. Nothing is sent to us.
• Face ID, fingerprint, or passcode: if you turn on the app lock, your phone checks it. MyMec never receives biometric data.
• Files: the app opens only backup files you choose, and saves or shares backups and service history PDFs only where you choose. Before restoring a file over your garage, and before a cloud update overwrites changes not yet synced from your phone, it also keeps an automatic safety copy in its own storage on your phone.
• Internet: used for cloud backup and, only if you turn them on, error reports.

Backup files and device backups

Backup files you export (.mymec) and service history PDFs contain your garage and are not encrypted, so store and share them carefully. Your phone’s own cloud backup service may also back up MyMec’s data, according to your device settings and that provider’s privacy policy.

Your choices and rights

• Change error reports: in the app, open Settings › Share error reports. They are off unless you turned them on.
• Delete your cloud data: in the app, open Settings › Account code › Delete cloud copy. It is erased from our server immediately. This is the better way, because it never shows us your code.
• On another device: install MyMec, open Settings › Cloud backup › I have a code, enter yours, then delete the cloud copy as above. This never shows us your code.
• Without the app: email help@bosstudio.org with the subject “MyMec data deletion” and your account code. Emailing the code reveals it, so use the steps above if you can. Your cloud copy is not linked to your name or email, so the code is the only way we can find it. Anyone holding the code could decrypt the cloud copy; we use it only to find and delete your cloud copy, then delete your email, and we reply within 30 days. Without the code we cannot find your copy, but cloud copies that no device opens for a year are deleted automatically.
• Delete everything on your phone: uninstall the app, and delete any backup files you exported and any device backups that include MyMec. On iPhone, the account code stays in the Keychain after uninstalling; MyMec erases it if it is installed again.

What deleting your MyMec cloud account removes: your encrypted garage, your account identifier and login token hash, and the hashed identifiers and names of your devices and records of removed devices, all immediately from our server, and from our weekly backups as newer ones replace them (about two weeks). What is kept: sign-up records (a hashed device identifier and IP address, with no link to your account or garage) for up to one year to prevent abuse, then deleted. Data on your phone is not affected; see above to remove it.

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, or to object to or restrict how it is used. You can view, change, export (as a .mymec file), or delete your garage in the app at any time. For anything else, contact us and we will respond as required by law. We will not treat you differently for exercising these rights. If you are in the EEA or the UK, you may also complain to your local data protection authority.

Children

MyMec is not for children under 13. If you are under 13, do not use it. The first screen asks for an age group; if the answer is under 13, the app does not continue, and cloud backup and error reports never start.

People 13 to 17 may use MyMec only after a parent or legal guardian accepts the Terms of Service on the device and confirms they have read this policy. Cloud backup and error reports stay off unless that parent or guardian turns them on.

The app takes the age group, and whether a parent or guardian accepted, from the answers given on the device. We do not verify them or the identity of the parent or guardian, and ticking a box is not verified parental consent. We do not ask for a date of birth, a parent’s name or email address, or a government ID. The app keeps only the age group and whether a parent or guardian accepted, on the device; they are not part of backup files or cloud copies.

If you believe a cloud copy belongs to a child, contact help@bosstudio.org and we will delete it.

Other services

You download MyMec from an app store, which handles information under its own privacy policy. The vehicle catalog is built into the app from public U.S. government (NHTSA) data; looking up makes and models sends nothing over the internet.

Where information is processed

Our server is located in the United States. If you use MyMec Cloud, your encrypted backup and the details above are processed there, and so are error reports, if you turn them on, with the protections described in this policy. If you are outside the United States, that means your information is sent to the United States. The weekly backups of the server’s database are stored in Google Drive, a Google service that may keep them in other countries.

Changes to this policy

We will post any changes here and update the effective date. If a change is significant, we will also tell you in the app.

Contact

An individual doing business as Bosstudio, in the United States · help@bosstudio.org