Privacy notice

Who is responsible

JConfig is an independent project maintained by an individual. For anything related to personal data, including the requests described below, write to contato@jconfig.app.

What this notice covers

It covers the site, including the quiz at jconfig.app/start, the installer, purchase pages, licensing API and the WhatsApp messages sent to people who asked for them. The app stores settings in the vehicle and contacts the server for updates, plan checks, to link a purchase to the vehicle and, when telemetry is enabled, to send a daily technical compatibility snapshot and automatic crash reports.

What we collect

We collect only what is needed to install the app, process a purchase, bind a license to the vehicle, learn where our customers come from and measure how our ads perform. WhatsApp contact only happens with your consent, and you can turn ad measurement off whenever you like:

• The email Mercado Pago or Stripe associates with the payment, if the processor returns it with the order. We do not receive or store card numbers, security codes, passwords or Pix keys.
• We use the country derived from the request IP address to route payment: Mercado Pago for requests from Brazil and Stripe for all others. The IP and country are not stored for this purpose; if the regional processor is unavailable, we may use the other configured processor.
• The acceptance record collected before payment: Terms version, date and time, language, and a technical hash of the IP address. The IP is not stored in plain text; this record proves acceptance of the contract and is not used for marketing.
• On the purchase pages, the optional answer to “How did you hear about JConfig?” and the visit origin (UTM parameters and ad click identifiers in the link, such as fbclid, or the site you came from), linked to the checkout session. Unless you have turned off ad measurement, we also store the Meta identifiers (the _fbp and _fbc cookies), the IP address and the browser user agent, to send Meta the checkout-started and purchase events.
• A record of each installation started: date, fixed installer source, language and offered version.
• The VIN or serial sent by the app to link the purchase. It is normalised during the request and stored in plain text in the checkout-session snapshot so you can verify the vehicle on the opaque-URL page. The QR Code and URL do not contain the identifier, it is not sent to Mercado Pago, and license binding continues to use HMAC-SHA256.
• When the telemetry setting is enabled, the app sends at most one daily compatibility snapshot: JConfig version and channel, language, Android version, normalised firmware family and revision, model code when available, and the plan calculated by the server. The VIN and serial are received only to find the licensed vehicle and are not part of the snapshot. The record is internally linked to the vehicle, is not shown individually in the admin panel, and is removed after 13 months. Turning the setting off stops new submissions.
• In the quiz at jconfig.app/start, if you choose to leave your WhatsApp number and tick the consent box, we store the phone number, your name (if you give it), your quiz answers (car model, features you are interested in, and whether you have a computer or Android phone and a USB cable), the language, the date of consent, the visit origin (UTM parameters and ad click identifiers in the link, such as fbclid, or the site you came from) and a technical hash of the IP address, without storing the IP in plain text. We use this data to send you the installation step-by-step and news on WhatsApp and, unless you have turned off ad measurement, to report the sign-up to Meta, as described under “Who we share it with”. Leaving your contact is optional: you can see the result without it.
• When the telemetry setting is enabled in Settings, the app automatically sends a technical report whenever it closes because of a crash. The report contains the crash date and time, the JConfig version, build and channel, the language, the Android version, the firmware family and revision, the app installation identifier, whether the app screen was open, the technical error trace and the most recent app log lines with sensitive data redacted. It is not designed to collect the VIN, serial, location or personal content, is used only to fix crashes and is removed after 180 days. The installation identifier is the same one the app uses for licensing, so a report can be associated with the licensed vehicle. Turning the setting off stops new reports.
• Aggregate statistics of pages visited, through our own Umami install — no cookies and no browsing profile.
• Advertising cookies, on by default: the site loads the Meta Pixel, sets the _fbp and _fbc cookies in your browser and tells Meta which pages you visit, some of your clicks and your progress through the quiz, so we can measure how our Facebook and Instagram ads perform. You can turn them off anytime under “Cookie preferences” in the footer. Details are under “Cookies” and “Who we share it with”.

On what legal basis

Brazil's LGPD requires a basis for each kind of processing. We rely on:

• Performance of a contract, to record acceptance, create the order, confirm payment and issue the Premium license linked to the vehicle.
• Compliance with legal obligations, to retain the financial and tax records required after purchase.
• Legitimate interest, for aggregate download and visit metrics, for the visit origin and the optional answer about how you heard about JConfig on the purchase pages, for technical compatibility telemetry, and to measure and improve our ads with the Meta Pixel, the events sent through the Conversions API and the identifiers, IP address and user agent linked to the checkout session. Telemetry exists to guide support and updates by model, firmware and app version; it does not record screens, commands, location, routes, consumption or performance, and it can be disabled in Settings. You can object to ad measurement at any time (LGPD art. 18, § 2): open “Cookie preferences” in the footer and click “Turn off”. Legitimate interest is also the basis for crash reports, which are used to diagnose and fix app crashes.
• Consent, to store your quiz data and send you the step-by-step and news on WhatsApp when you tick the consent box in the quiz. You can withdraw it at any time, free of charge: to stop the messages, reply “SAIR” on WhatsApp or write to contato@jconfig.app. Withdrawal applies from then on.

Cookies

From your first visit, and without asking first, the site loads the Meta Pixel (Facebook and Instagram), a third-party script, and sets the _fbp and _fbc cookies to measure how our ads perform, based on our legitimate interest. You can turn this measurement off anytime: open “Cookie preferences” in the footer and click “Turn off”; to turn it back on, click “Keep on”. When you turn it off, the site stops loading the Pixel, deletes the _fbp and _fbc cookies and, from then on, quiz sign-ups and purchases started in that browser no longer generate events for Meta. Your choice is kept for 12 months in the jc_consent cookie, which is used only for that, and applies to the browser where you made it; if that cookie expires or is deleted, ad measurement is turned back on. The purchase pages (/buy) never load the Pixel. To link a quiz sign-up or a purchase to the visit origin (UTM parameters, ad click identifiers such as fbclid, and the site you came from), your browser keeps that origin in its storage (jc_attr) for the session and between visits too; if you have turned off ad measurement, only for the session. Audience measurement remains cookie-free, through Umami on our own server, and fonts are served by us. The tutorial page shows a YouTube video; when it loads, Google may set its own cookies under its privacy policy.

Who we share it with

Mercado Pago and Stripe process payments in their own environments. The processor indicated by the country derived from the IP address receives the amount, currency, opaque order references and return URLs; the complete VIN and serial are not sent. We receive the status, amount, currency, technical references and, when available, the buyer email. The step-by-step and news messages go through WhatsApp, which handles your number under its own privacy policy. Unless you have turned off ad measurement, Meta Platforms receives data in two ways, so we can measure and optimise our ads: through the Pixel, which reports from your browser the pages you visit, some of your clicks and your progress through the quiz; and through the Conversions API, which our server uses to send the quiz sign-up, checkout-started and purchase events. Depending on the event, those sent by our server carry the email, phone number, first name, an internal identifier and country as irreversible SHA-256 hashes and, unhashed, the IP address, browser user agent and the _fbp and _fbc cookie identifiers. Events may also carry details of the event itself, such as the purchase amount and currency or the car model and features of interest given in the quiz. Meta uses this data to link each event to the ad it came from and may process it outside Brazil, as an international transfer (LGPD art. 33) under the safeguards Meta itself adopts. The site and database run under our administration and the database is not exposed to the internet. We do not sell personal data.

How long we keep it

Orders, licenses, activations, transfers and audit records are retained as needed to fulfil the purchase, provide support, prevent fraud and meet legal, financial and tax obligations. Telemetry snapshots linked to the vehicle are automatically removed after 13 months. Crash reports are removed 180 days after receipt. Quiz data and the ad-measurement data linked to checkout sessions (visit origin, _fbp and _fbc identifiers, IP address and user agent) are kept as long as they are needed for contact, support, ad measurement and fraud prevention, or until you ask for deletion or object to the processing, which you can do at any time by writing to contato@jconfig.app. The “Turn off” button under “Cookie preferences”, on the other hand, stops ad measurement from then on in the browser where you use it, without deleting what is already stored on our server. Your cookie choice stays in your browser for 12 months. Once there is no remaining purpose or retention obligation, the data is deleted or anonymised. Non-identifying metrics may be retained in aggregate.

Your rights

The LGPD guarantees you at least the following rights over your data. To exercise any of them, write to contato@jconfig.app. We may request enough information to confirm your identity and retain only what the law permits or requires us to retain.

• Know whether we process data about you and get a copy of it.
• Correct incomplete, inaccurate or outdated data.
• Ask for the deletion, anonymisation or blocking of unnecessary, excessive or unlawfully processed data.
• Know which public or private entities we share your data with.
• Request portability where applicable and under ANPD regulations.
• Request a review and explanation of an exclusively automated decision that affects your interests.

Security

The site is served over HTTPS and the database accepts no connection from the internet. No system is infallible, which is precisely why we store as little as possible: if something leaks, little leaks.

Changes to this notice

This notice describes Premium, per-vehicle licensing, technical compatibility telemetry, automatic crash reports, processing by Mercado Pago or Stripe and, as of this revision, WhatsApp contact from the quiz, which depends on your consent, and ad measurement by Meta, which is on by default and can be turned off anytime under “Cookie preferences” in the footer. The date at the top always indicates the latest revision.