# Privacy centre

P-Central, what I share with Revoke, consents per purpose and the right of access: what the app shows, where the counts come from, and how a no to AI turns every AI feature off.

## What it does [#what-it-does]

With the `privacy.centre` flag (on in dev, off in production until QA), Profile shows one **Privacy** row instead of the privacy, data region, export and delete rows. It opens **P-Central** (`/privacy-centre`, [spec §1](https://github.com/CarlosZiegler/autofolio/blob/main/docs/specs/privacy-and-people.md)):

- **Your data**: _See what we hold about you_ (`/privacy-data`) and _Export my data_ ([data export](/docs/features/data-export)).
- **Sharing**: _What I share_ (`/privacy-shared`, P-Compartilhado) and _Consents_ (`/privacy-consents`, P-Consentimentos).
- **Account**: security and devices ([sign-in and security](/docs/features/sign-in-security)), the data region (read-only; the EU says Frankfurt), delete account.
- A footer with the privacy policy, its subprocessors section and the data protection contact (`EXPO_PUBLIC_PRIVACY_EMAIL`, else the support address; hidden without either).

Each row's second line is live: the counts come from `privacy.summary`, the consents from the Account Preference.

## See what we hold [#see-what-we-hold]

The right of access (LGPD art. 18 II, DSGVO art. 15) next to the export (portability, art. 20): seven categories with a count and what each holds. `privacy.summary` reads every count in one statement, each a scalar subquery under row-level security in the Active Organization: cars; records (ledger entries, services, odometer readings); files (photos and documents); the User's AI calls; live shares (passports and showcases not revoked or expired, invite links still waiting, the household's other people); the User's live sessions. The account itself counts as one. A Member who does not manage the household sees no invite links, as the invite screen does.

## What I share [#what-i-share]

Every live passport, showcase and invite link, with what it shows (the passport's sections, the showcase's fields and live or frozen), since when and its views; then the household's people with their roles and cars. Revoke is one tap and a confirmation, through each link's own procedure (`passport.revoke`, `showcase.revoke`, `inviteLink.revoke`), so the snapshot and photo copies go as they always do. _Revoke all links_ asks once and revokes them all; people keep their access, which is changed in the [family garage](/docs/features/family-garage).

## Consents [#consents]

One switch per purpose: AI features (on until the User says no), notifications (the `remindByPush` channel; turning it on asks the system once), usage analytics and news emails (off until the User says yes; no analytics SDK or newsletter ships yet). `accountPreference.consent` writes each answer as a ★ Consent Record with `PRIVACY_POLICY_VERSION` (push changes `remindByPush`) and audits it as `account.consent_changed`, target `consent:<purpose>`, metadata `{ consent, policyVersion }`. `accountPreference.get` returns each purpose's latest answer in the same statement as the row.

A no to AI turns every `ai.*` feature off for that User: `admitAi` answers `AiUnavailable`, the AI usage row lists no quota, the assistant is `NOT_FOUND`, the insights job pushes them nothing, and the app reads every `ai.*` flag as off (`useFlags`). Nothing already saved is deleted.

## Procedures [#procedures]

| Procedure                   | Who                         | Failures                          |
| --------------------------- | --------------------------- | --------------------------------- |
| `privacy.summary`           | Members of the Organization | —                                 |
| `accountPreference.consent` | Signed-in Users             | `NOT_FOUND` before the first read |

## Key files [#key-files]

- [`packages/api/src/features/privacy/privacy.service.ts`](https://github.com/CarlosZiegler/autofolio/blob/main/packages/api/src/features/privacy/privacy.service.ts)
- [`packages/api/src/features/account-preference/account-preference.service.ts`](https://github.com/CarlosZiegler/autofolio/blob/main/packages/api/src/features/account-preference/account-preference.service.ts)
- [`apps/mobile/src/features/privacy/privacy.hooks.ts`](https://github.com/CarlosZiegler/autofolio/blob/main/apps/mobile/src/features/privacy/privacy.hooks.ts)