Privacy and connected cloud data.

What the Google Cloud connection accesses.

After you approve the connection, Garrett reads accessible project identifiers and names so you can choose up to five of your own projects. It collects resource metadata such as resource names, types and locations, and timestamped snapshots of supported VPC firewall rules only in your selected projects. It uses this information to display resource inventory, check supported network exposure and explain unavailable coverage. Scheduled collection can continue after you close the app.

Google requests the cloud-platform scope required by Cloud Asset Inventory SearchAllResources and assets.list. This scope follows your Google Cloud IAM roles and can include write permissions. Garrett's inventory collector uses read operations. Use an identity with Browser and Cloud Asset Viewer roles on the projects you intend to monitor to limit the grant.

Cloud Asset Inventory snapshots are eventually consistent. Missing APIs, denied permissions and collection limits appear as unknown or incomplete coverage. These checks do not assess hierarchical or network firewall policies or establish effective network safety. Garrett does not activate APIs, enable billing or create cloud resources for this collection.

What Azure and AWS connections access.

Azure collection reads accessible subscription identifiers, resource names, types and locations, and supported network security group allow rules through Azure Resource Manager. Delegated Service Management and offline access follow your Azure RBAC permissions and can include write permissions. Garrett's collector only reads. Use an identity with Reader access to the subscriptions you intend to monitor. The collector does not query Microsoft Graph, Microsoft 365, mail or contact APIs.

AWS collection assumes the role you approve, using a separate external ID for each connection. The prepared role permits EC2 DescribeInstances and DescribeSecurityGroups. Garrett's collector reads the regions you select and uses these results for resource inventory and supported network exposure checks. Your customer role configuration, including its external ID, is encrypted before database storage. Missing subscriptions, denied permissions and collection limits remain explicit coverage gaps.

How data is stored and shared.

Cloudflare runs Garrett's collection service and database. Requests to connected providers use HTTPS. OAuth grants and full saved inventory payloads are encrypted with a service encryption key before database storage. Garrett also stores operational metadata, including connection labels, resource counts, collection times, coverage summaries and findings, to show status and coordinate notifications.

The collector sends authorized API requests to your selected providers and uses Cloudflare to process and store their results. Reports are available in the owning Garrett workspace. The cloud inventory collector does not send OAuth tokens, AWS session credentials or role external IDs to AI models, train AI models with connected cloud inventory, or sell that data or use it for advertising.

Google API data is handled under the Google API Services User Data Policy, including its Limited Use requirements. Human review is limited to your authorization, necessary security investigations such as a bug or abuse, applicable legal requirements, or permitted aggregated internal operations.

Pause, disconnect and retention.

Use Pause in Environments to stop collection until you resume. Disconnect stops collection and removes Garrett's locally saved OAuth grant or customer role configuration. A saved report, connection history and findings can remain available for review after disconnect.

Disconnecting in Garrett does not remove the separate permission recorded by Google. You can remove that permission in your Google Account connections. Contact us to request removal of retained connection data; we will verify ownership before handling account-data requests.

Microsoft application permissions can be reviewed in Microsoft My Apps or by your tenant administrator. AWS access can be withdrawn by removing the approved role or its trust in AWS IAM Roles. Disconnecting in Garrett does not itself remove those separate provider permissions or delete your AWS role.

Optional conversion measurement.

We use first-party measurement to understand where visitors leave the signup process and improve the service page. A random browser cookie lasts up to 30 days. We retain broad traffic-source and device categories, the funnel version, selected service and plan, and the first time a journey reaches a signup or payment step. We do not put email addresses, form contents, case details, full URLs, IP addresses or payment details in these measurement tables.

After email confirmation, a keyed account hash connects that journey to checkout and the first confirmed paid invoice. Trial starts are counted separately. Administrators see aggregate counts; retained journeys and their account links are deleted after 90 days. Measurement stays with Garrett's Cloudflare service and is not sent to advertising analytics providers.

Browser Global Privacy Control and Do Not Track signals turn measurement off. You can also turn it off here; this deletes the retained journey associated with this browser cookie and stops future measurement in this browser. Other browsers have their own preference. Operational security and billing records are separate and continue to support the service.

Owner and test activity is excluded separately. Opening the funnel in test mode marks this browser for one year, including after sign-out. Accounts you sign in to or create in that browser are marked as excluded from conversion measurement, so later background checkout and payment events stay out of the report. The account preference remains with the account. Contact us if an ordinary account was marked for testing by mistake.

A new browser, private window or cleared cookies needs the testing link or an owner sign-in again. We do not identify signed-out owners by fingerprinting their devices or blocking everyone on a shared network.

Detected bots, crawlers and automated checks are excluded from conversion reports. We use request and browser automation signals, including Cloudflare bot signals when available, without storing raw user agents or bot scores in the measurement tables. A separate browser exclusion cookie lasts up to 30 days. Detection removes the linked measurement journey and signup/payment attribution; account access and billing continue normally. Reports describe filtered journeys because undetected automation can remain.

Checking your measurement preference…

Privacy questions and data requests.

Contact garystimpson03@gmail.com with the Garrett account email and the connection concerned. Keep access tokens, passwords and other secrets out of your message. The current version of this privacy notice is published on this page.