What it does
With the privacy.centre flag (on in dev, off in production until QA), Profile shows one Privacy row instead of the privacy, data region, export and delete rows. It opens P-Central (/privacy-centre, spec §1):
- Your data: See what we hold about you (
/privacy-data) and Export my data (data export). - Sharing: What I share (
/privacy-shared, P-Compartilhado) and Consents (/privacy-consents, P-Consentimentos). - Account: security and devices (sign-in and security), the data region (read-only; the EU says Frankfurt), delete account.
- A footer with the privacy policy, its subprocessors section and the data protection contact (
EXPO_PUBLIC_PRIVACY_EMAIL, else the support address; hidden without either).
Each row's second line is live: the counts come from privacy.summary, the consents from the Account Preference.
See what we hold
The right of access (LGPD art. 18 II, DSGVO art. 15) next to the export (portability, art. 20): seven categories with a count and what each holds. privacy.summary reads every count in one statement, each a scalar subquery under row-level security in the Active Organization: cars; records (ledger entries, services, odometer readings); files (photos and documents); the User's AI calls; live shares (passports and showcases not revoked or expired, invite links still waiting, the household's other people); the User's live sessions. The account itself counts as one. A Member who does not manage the household sees no invite links, as the invite screen does.
What I share
Every live passport, showcase and invite link, with what it shows (the passport's sections, the showcase's fields and live or frozen), since when and its views; then the household's people with their roles and cars. Revoke is one tap and a confirmation, through each link's own procedure (passport.revoke, showcase.revoke, inviteLink.revoke), so the snapshot and photo copies go as they always do. Revoke all links asks once and revokes them all; people keep their access, which is changed in the family garage.
Consents
One switch per purpose: AI features (on until the User says no), notifications (the remindByPush channel; turning it on asks the system once), usage analytics and news emails (off until the User says yes; no analytics SDK or newsletter ships yet). accountPreference.consent writes each answer as a ★ Consent Record with PRIVACY_POLICY_VERSION (push changes remindByPush) and audits it as account.consent_changed, target consent:<purpose>, metadata { consent, policyVersion }. accountPreference.get returns each purpose's latest answer in the same statement as the row.
A no to AI turns every ai.* feature off for that User: admitAi answers AiUnavailable, the AI usage row lists no quota, the assistant is NOT_FOUND, the insights job pushes them nothing, and the app reads every ai.* flag as off (useFlags). Nothing already saved is deleted.
Procedures
| Procedure | Who | Failures |
|---|---|---|
privacy.summary | Members of the Organization | — |
accountPreference.consent | Signed-in Users | NOT_FOUND before the first read |