Oto NinjaTechnical and legal review is required before publication. The mobile app source code and complete data flows have not been reviewed. Except for the current local storage of trips and related driving data described in section 4, the collection, storage, sharing, and deletion details below are not verified claims about app behavior; complete every TODO using the actual implementation and the responsible-party details required by applicable law.
1. Data controller and contact
Data controller: [TODO: verified legal name of the person or entity that must be identified as the data controller under applicable law]
Privacy contact: PRIVACY_EMAIL_PLACEHOLDER
Address or other required information: [TODO: verified contact details required by applicable law]
2. What information is processed?
[TODO: Technically review the app inventory and list which categories are processed: device/account details, app preferences, OBD2 data, trip telemetry, location, diagnostics, and any other data. Also verify which categories are not collected.]
3. Location and trip records
GPS route recording requires device location permission. Verify when location is processed, how often it is accessed during recording, whether it is used in the background, and how route data is stored: [TODO: verified location processing and permission behavior]
4. Local storage, servers, and service providers
Recorded trips and related driving data are currently stored in the app's local database on the device and are accessible within the app. Optional server synchronization is planned for a future release but is not currently available. This statement applies only to trips and related driving data; it does not mean all app data is stored exclusively on the device.
[TODO: Technically verify whether other data categories stay on the device or are transmitted to a server. Document backend/API endpoints, hosting location, providers, transfer purposes, and any international transfers.]
[TODO: Verify any authentication providers, analytics, crash reporting, map/tile services, and other third-party SDKs by name and data flow. Do not assume they are integrated.]
5. Purposes and legal bases
[TODO: For each data category, describe the purpose, applicable legal basis, required and optional permissions, and how permissions can be withdrawn under applicable law.]
6. Retention and deletion
[TODO: Technically verify retention periods or criteria for each data type; in-app deletion, app removal, account deletion requests, and backup deletion timing.]
Contact for data or account deletion requests: PRIVACY_EMAIL_PLACEHOLDER [TODO: verify the address and describe the request process]
7. User rights and children’s privacy
[TODO: Add applicable rights of access, correction, deletion, objection, and other rights; how to submit requests; and relevant supervisory authority based on the correct jurisdiction and laws. Verify the age limit and practices regarding children.]
8. Security and policy updates
[TODO: Verify actual security measures and incident handling; do not promise measures that are not implemented.] Add the update date and how significant changes will be announced: [TODO: notification method]
9. Privacy contact
For privacy questions and requests: PRIVACY_EMAIL_PLACEHOLDER. [TODO: Add a verified privacy contact address and the responsible-party details required by law.] Project profile: GitHub (not a verified privacy-request channel).