BaseDesk: Firebase Support Privacy Policy

Contents

01 Introduction 02 Google Account Access We Request 03 What Stays On Your Device 04 What The App Accesses In Your Google Account 05 Your Users' Data In Tickets 06 Google API Services And Limited Use 07 No Advertising, Analytics Or Tracking 08 Your Choices And Controls 09 Data Security 10 Children's Privacy 11 Data Retention And Deletion 12 Changes To This Policy 13 Contact Us

Introduction

SCB Tech Solution ("we", "our", or "us") operates the BaseDesk: Firebase Support application ("the App"). The App lets developers see their Firebase projects and run a support inbox for their own apps, using their own Google account. This Privacy Policy explains what the App accesses, what it does not, and the choices you have.

By downloading or using the App, you agree to the practices described in this policy. If you do not agree, please do not use the App.

In short: BaseDesk has no server of its own. After you sign in with Google, the App talks directly from your device to Google's APIs, and everything it reads or writes stays in your own Google Cloud and Firebase projects. We never receive your projects, your tickets, your account details or your access tokens. The App has no ads, no analytics and no crash reporting.

Google Account Access We Request

When you sign in, Google asks you to grant the App the access below. Each is used only on your device, only for the purpose described, and only on projects your Google account can already reach.

• Your name and email address: To show which Google account is connected. Provided by Google Sign-In and kept on your device only.
• View your Firebase projects firebase.readonly: To list your Firebase projects and show their name, project ID, region and storage bucket. Read only; the App never changes a project's settings.
• View your Google Cloud data cloud-platform.read-only: To read project details and the names of the Firestore collections in each project, so the App can show collection counts and let you choose where tickets are kept. Read only.
• View and manage your Firestore data datastore: To read and write support tickets in the single collection you choose as your ticket store: loading tickets, sending replies, and changing status or priority. The App does not write to any other collection.
• Manage your Cloud Storage data devstorage.read_write: To upload files you attach to a ticket, into the storage bucket of your ticket-store project. The App uploads only files you pick yourself.

On your device, the App uses the internet to reach Google's APIs. It opens your device's file picker only when you choose to attach a file, and reads only the file you select. It does not request access to your contacts, location, camera or microphone.

What Stays On Your Device

The following is stored in the App's local storage on your device, and never reaches us:

• Your sign-in session. Held by Google Sign-In on your device. Access tokens are used only to call Google's APIs and are never sent to us.
• Your ticket store choice. Which project holds your tickets, and, if you link an existing collection, which collection it is and how its fields are mapped.
• Starred projects. The projects you have starred for quick access.
• Canned replies. The saved reply templates you use in conversations.

What The App Accesses In Your Google Account

This is everything the App reads from or writes to your Google account. All of it moves only between your device and Google, and stays inside your own projects. None of it is sent to us or to any third party.

• Firebase project details: Read from the Firebase Management API to show your project list. Displayed in the App only.
• Firestore collection names: Read to show how many collections each project has, and to let you pick a collection as your ticket store. The App does not read the documents in these collections.
• Support tickets: Read from, and written to, only the ticket collection you choose. Includes each ticket's subject, status, priority, requester details, messages and internal notes.
• Attachments: Files you attach are uploaded to your ticket-store project's Cloud Storage bucket, under a basedesk/ folder.

We do not collect, store, sell or share any of this information, and we do not use it to build a profile of you.

Your Users' Data In Tickets

Tickets may contain personal information about the people who contact your support: for example their email address, user ID, device details, and what they wrote to you.

That information lives in your own Firebase project. You are responsible for it, as the controller of your users' data, and for telling your users how you handle it. BaseDesk is only a tool for viewing and answering it, and we never receive a copy.

If you use the optional ticket ingestion function included with BaseDesk, it is deployed into and runs in your own Firebase project. It sends nothing to us.

Google API Services And Limited Use

BaseDesk's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, information obtained through Google APIs is:

• used only to provide the features described in this policy, which you can see in the App;
• not transferred to anyone, except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with your consent;
• not used or transferred for advertising, including retargeting and personalised or interest-based ads;
• not read by any person, except with your express permission for a specific support request, for security purposes, or to comply with the law.

No Advertising, Analytics Or Tracking

The App shows no advertising and contains no advertising, analytics or crash reporting software. It does not use an advertising identifier, and does not track you across other apps or websites.

The only service the App communicates with is Google, to sign you in and to reach your projects. Google processes that information under its own Privacy Policy and the terms of your Google Cloud and Firebase account.

Your Choices And Controls

• Choose what the App can reach. The App only sees projects that your Google account already has permission to access. You control that with the roles you grant in Google Cloud.
• Choose where tickets live. In Settings you pick the one project and collection used as your ticket store, and you can change or clear it at any time.
• Disconnect. Settings, Disconnect signs you out of the App on this device.
• Revoke access completely. To remove the App's access to your Google account, visit myaccount.google.com/permissions, choose BaseDesk and remove access.

Data Security

Everything the App sends and receives travels directly between your device and Google's APIs, and is encrypted in transit with HTTPS.

Access to your data is enforced by Google: each request is checked against the permissions of your Google account, so the App can never reach more than you can. Your access tokens are held by Google Sign-In on your device and are never sent to us.

Keep your device locked, and disconnect the App on shared devices, since anyone using your unlocked device could open your ticket inbox.

Children's Privacy

The App is a tool for developers and businesses, and is not directed at children under 13. We do not knowingly collect personal information from children, and the App collects no personal information for us from anyone.

Data Retention And Deletion

Anything held on your device stays under your control:

• Clear your ticket store choice at any time from the Settings tab.
• Uninstalling the App permanently deletes all of its local data, including your ticket store choice, collection mapping, starred projects and canned replies.

Data in your Google account is kept for as long as you keep it there:

• Deleting a ticket in the App deletes it, and its messages, from your Firestore collection.
• Attachments stay in your project's Cloud Storage bucket until you delete them from the Firebase or Google Cloud console.

Because we never receive any of your data, there is nothing for us to retain or delete on our side.

Changes To This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.