Security

Gard handles work that hasn't shipped yet — unreleased packaging designs, marketing images, client artwork. This page explains how your images and data are stored and who can see them.

Where your work goes

Gard's back-end runs on Firebase, a Google Cloud service designed for web and mobile apps. It includes the security foundation that allows us to focus on building Gard and its features. Gard uses large language models accessed via our Google Workspace account, which prevents your images from being used in LLM training data according to Google's privacy policy. Your account, your scan history, and your images are processed and stored in Google Cloud data centers. Everything travels over encrypted HTTPS connections, and your data is encrypted at rest.

When you scan an image, the app sends it to Firebase for secure storage and to Google's Gemini models for analysis. Corrections are stored in Firebase and are only accessible from your account.

Payments are handled entirely by Stripe. Card details go to Stripe directly and never pass through Gard's servers.

Signing in

You sign in with a one-time link sent to your email, or with your Google account. Both are handled by Firebase Authentication. A sign-in link works once and only for the address it was sent to, so opening it also confirms that you own that address. Accounts created before sign-in links can still use their password; those passwords are stored and checked by Firebase, so neither Gard nor anyone else ever sees them. Signing in with Google opens Google's standard sign-in page in your browser, so your Google password is never typed into Gard. Accounts must verify their email address before they can run scans.

Every request Gard makes is checked twice: once to confirm who you are, and once to confirm the request came from a genuine copy of Gard rather than something impersonating it.

Where files are stored

Your images and results live in a storage location tied to your account, or to your team if you're working in a team workspace. Only our server code can write files there. The app on your computer can read and delete your own files but cannot add, replace, or overwrite them.

Images you drop on trygard.com to open in the Gard app are handled differently. They're uploaded to a temporary location behind an unguessable link that stops working after 20 minutes, and expired uploads are deleted automatically.

Who can see your scans

Your scans are yours. Access rules on the database and file storage only allow the signed-in owner of an account to read their own scans and images. Everyone else is refused by the database itself. In a team workspace, the same rules limit access to active members of that team.

Shared scan reports are the one exception, and only when you create one. Sharing publishes a copy at an unguessable address. Anyone with the link can open it, but it can't be found by browsing or guessing. Deleting the share takes the copy down.

Deleting scans and your account

You can delete a scan from the app. That removes the image, its results, and any shared copy. You can also delete your account from the app. This cannot be undone.

The desktop app

The part of the app that shows your images runs in a sandbox with no direct access to your computer. It reaches the rest of the app only through a narrow, controlled bridge.

Mac builds are signed and notarized with Apple. Updates are downloaded over HTTPS from Gard's own download server, and each download is checked against its published checksum before it's installed. If the app crashes, a technical error report is sent to Sentry. It describes the failure, not your images.