Privacy & data

Car by paaaack turns your Google spreadsheet into a private car expense report.

Google account access

We request your basic Google identity and the drive.file permission. Google Picker lets you choose which spreadsheets to share with Car. This permission can read, edit, create, and delete files selected for this Google app. Car reads expense records, adds new expenses, and updates fields you edit in the expenses tab. It does not delete spreadsheet files or other tabs, and does not grant access to all of your spreadsheets.

What we store

Your identity, selected spreadsheet ID, and Google refresh token are kept in an encrypted HTTP-only session cookie for up to seven days. Refresh tokens are decrypted and used only on the server. A short-lived access token is sent to the browser only when opening Google Picker, held in memory, and never saved in browser storage. Expense rows are read on demand and not saved to an application database. Google data is not sold, used for advertising, or used to train AI models.

Private reports & offline use

Your spreadsheet does not need to be public. Private reports are not cached for offline use. The installed app can display a public offline screen, and needs an internet connection to retrieve your reports. The public demo contains fictional records.

Disconnecting

Use “Disconnect Google & sign out” in your dashboard to remove the local session and request revocation of the Google grant. You can also remove access directly from your Google Account connections. Disconnecting never deletes or changes your spreadsheet. Car reuses paaaack’s existing Google OAuth client, so revocation may also require reconnecting Google in other paaaack features. A disconnected or expired session requires sign-in again.

Questions

Contact the operator through yeslee.me for questions about your data. This early version is an expense reporting tool; you keep the source records in Google Sheets.