The expected users of device are all consumers or for car driver or anyone need to record the driving condition and protect their assets. The expected organizations of device include individual home users, enterprises and governments, etc. Device would be mainly used in consumer's vehicle.
Privacy:Scope of personal information collection
We will handle all types of personal information, including the data clearly provided by you and your device data and personal information generated from the use of our services, specifically:
When you register or log in, we will collect your email address, password, nickname, and profile photo that you use in registration.
When you download or use the app, we may read information about your mobile device, such as information of the hardware model, IMEI number or other unique device identifier, MAC address, IP address, operating system version, and location. We may also read information about the use of your appliances through the Internet of Things (IoT) app, such as the device model, operating status, frequency of usage, and the use of cameras built into the device. We may also receive and record information about your conversations, audios, videos, pictures, etc. in voice interaction with IoT devices.
When you use bonded and controlled devices, we will collect the information of device model, IP address, location, and device status. We collect your current location information, not track your whereabouts, open the location service can directly obtain your location information to provide you with services, such as weather service, intelligent scene service, network function. The device will save Wi-Fi SSID and password when connected to a home Wi-Fi router, and such information will not be uploaded to the cloud.
When you use an Internet of Things (IoT) device, we may collect information that you communicate during the voice service interaction, including the recordings of your voice commands (such as your questions, requests, and instructions), and information that you receive from the service (such as responses, answers, and content).
When you use an IoT device, you can view the real-time and historical video footage captured by the camera through the software. You can also save the video locally. To enable the mention function, we will send all videos captured by the camera to your app in an encrypted manner. We will neither store your video footage on our server nor use it for any other purpose or share it with any third party.
When you use a product or service, we will automatically receive and record information about your browser and computer or App client, such as your IP address, browser type, language used, and access date and time, hardware and software feature information and web page records you need; when you apply for after-sales service, we may also collect your phone number and address.
To help us understand the operation of App, we will use the mobile analysis software SDK. We may record information of your frequency of usage data, corrupted data, overall usage data, performance data, etc. We will not associate information stored in the analysis software with any of your personal information.
It is important to note that separate device information or service log information cannot identify a particular natural person. If we combine such non-personal information with other information to identify a particular natural person or use it in conjunction with personal information, such non-personal information will be treated as personal information during the period combined use, and we will de-identify such information unless we have your authorization or unless otherwise stipulated.
As mentioned above, we will store your account information in the database so that you can get your personal data every time you visit our website and use our App or other services.
Your data will be stored in our server as log files and used for analysis and research. After being processed in the server, your data will be transmitted to the database.
We will back up data on a regular basis to prevent data loss due to server failure or human error and will delete them immediately at your request.
Remote engine cut-off,I/O ports to support multiple external types of equipment for various applications,
Video/audio recording and upload to the server.
Besidescontrollingdevicephysically,onlydevice’sownercanremotelycontrolthedeviceviaTracksolid PROapplication. There is an authentication mechanism in application to prevent unauthorized user to control device. All remote communications are protected using cryptographic methods to ensure only device’s owner has the permission forcontrolling. Only customers can control the device, manufacturer can manage the running status of the device and provide upgrades.
After the device is powered on, there is a certain time threshold for binding, which may have the security risks brought by the long-term opening of Bluetooth broad casting and AP hot spots. The device will turn off Bluetooth broadcast or AP hotspot after a certain period (default is 5 minutes, determined by business).
If using a publicly accessible network to connect the device with Jimi cloud, it needs to ensure that the network state is secure. OTA updates have a breakpoint continuation mechanism and the ability to roll back a previously available state.At unattended state, the IoT device is vulnerable to physical attack. But the risks of products are manageable because of their work environment is inside the car and the installation is covered.
Communication protocols follow the principles of confidentiality, integrity and availability. There is an authentication mechanism for communication between device and APP, device and cloud, and cloud and APP. The session key is obtained through TLS1.2 handshake. TLS 1.2 is used for integrity verification during data transmission. And local data is stored in encryption, such as the account and password of AP is encrypted with Root Key, which is derived from the IMEI of the chip hardware.In general, Jimi uses strong secure cryptographic algorithms and secure protocol to protect all the traffic between device and cloud, device and application.
1. The production firmware file is burned in the device, and no other configuration files need to be changed during use.
2. Only device’s owner have remote access to the device as there is relationship binding during initialization.
The debug interface has been closed, and unauthorized users cannot access it, and Wi-Fi and BLE interface can't be access without authorization.
1.Physical protection: There isn’t any external interfaces on device that allows reading / writing firmware data or configuration data.
2.Network connection protection: There is authentication mechanisms sitting in both cloud, application and device to prevent any malicious/unauthenticated connections.
The device factory setting is a secure default configuration, the DVR performs predetermined functions according to the default configuration, and the attacker cannot access the device without authorization, the secure default configuration is defined by manufacturer.
The module has a log reporting mechanism, which only supports error log reporting at present. The crash log includes the connection fail info of the router or server, etc. The mechanism is not a real-time reporting. After login on the server, upload the crash log. And the log data can be viewed through the backend.
if different storages are used, please describe the authentication and authorization procedures respectively.
Due to limited local storage capacity, the device does not store log information locally, but uploads it to cloud storage through an encrypted channel. In the cloud service, only the database management account has the authority to view log information. If the account is not authorized, access to the device log information is prohibited.