Privacy notice
This notice explains what happens to information when you use OBDScan on Android or iOS. The short version: the information about your vehicle and your trips stays on your device and is not transmitted to any server of the controller. There is no infrastructure to receive it.
The long text exists because app stores and the law require it, and because it is worth writing down precisely where the limits are.
1. Data controller
The controller of any personal data that may arise from the use of the OBDScan application is the company that develops and distributes it, hereinafter «the controller».
Informational contact address for anything relating to this notice: israel.alvarado.segura.dev@gmail.com.
2. What personal data the controller collects
None. OBDScan does not ask for registration, an account, an email address, a phone number, a name or any identifier. It does not send the controller your vehicle readings, your trips or your settings.
The controller operates no servers that receive data from the application, and therefore cannot access, store, query or retrieve your information even if he wanted to.
Practical consequence: if you lose your phone or uninstall the app, the controller cannot recover your trips or your readings. No copy exists outside your device other than what you have exported yourself.
3. What information is generated and stays on your device
To function, OBDScan creates and stores information exclusively in the local storage of your phone or tablet:
- Vehicle readings obtained from the OBD-II adapter: revs, speed, temperatures, pressures, consumption and any other signal your ECU exposes, with its timestamp and the ECU it came from.
- Diagnostic trouble codes (DTCs) that have been read, including ones already cleared from the ECU, and the local record of any clearing operation you authorised.
- Technical vehicle identity as reported by the ECU: OBD protocol, vehicle identification number (VIN), ECU names, calibration identifiers and CVN.
- GPS tracks of the trips you start: coordinates, speed, altitude, accuracy, acceleration and braking events, and the phone's own motion data.
- Preferences: metric or imperial units, theme, language, chosen gauges, dashboard layout, selected vehicle profile and connection parameters (IP address, port, BLE device address and UUIDs).
The VIN and GPS coordinates may count as personal data in some jurisdictions, because they can tie the vehicle or the journeys to a person. They are listed here expressly for that reason, even though they never leave the device.
This information is kept for as long as you keep it. It is removed when you delete items from within the app, when you clear the application's data from the system settings, or when you uninstall it. On Android, automatic backup is disabled, so this data is not uploaded to a backup account without you asking.
4. System permissions and what they are for
- Location. Needed to record a trip's route and show it on the map. It is only used while a trip you started is in progress, and released when it ends. On iOS, the «Always» permission is not requested automatically.
- Bluetooth and nearby devices. Needed to find and connect to the OBD-II adapter. They are not used to determine your position or to detect other devices for any other purpose.
- Local network and Wi-Fi. Needed to speak TCP to a Wi-Fi adapter, which creates its own network, and to download map tiles.
- Notifications and background activity. On Android, a foreground service with a visible notification keeps the recording alive while you drive. On iOS, the Live Activity serves the equivalent role. In both cases the indication is visible: recording never happens silently.
- Motion sensors. Used to record the phone's own acceleration during a trip.
You can revoke any permission from the system settings. The feature that depended on it will stop being available, but the app will still open and everything else will still work.
5. Third parties involved
The controller does not share your vehicle readings or your trips with third parties. There are, however, three situations in which a third party takes part, and you should know about them:
5.1 Map provider
To draw the map, the device requests image tiles from a provider: OpenStreetMap on Android and Apple Maps on iOS. That request contains the coordinates of the visible area, as in any mapping application, and includes the IP address it is made from. It does not include your readings, your history, your VIN or any identifier of yours. Only the tiles for the area you are looking at are requested, never in advance, and there is no preloading of regions.
How that provider handles the request is governed by its own privacy policy, not by this one.
5.2 App stores
Download, installation and updates happen through Google Play or the App Store, which collect their own data under their own policies. From those platforms the controller receives, like any developer, aggregated and anonymous install and crash statistics; that information does not identify individuals and contains no data about your vehicle.
5.3 Whatever you choose to share
If you export a trip, a session or an .obs file, or share a link from the system sheet, that content leaves the app by your express decision and becomes governed by the terms of the service or person receiving it. The controller is not involved and cannot reverse that transfer. You are responsible for the information you generate with the application and for what you choose to share; the controller takes no part in that decision and is not answerable for its consequences.
6. Transfers
The controller does not carry out transfers of personal data, domestic or international, because it does not collect any. Nor does it sell, assign, rent or exchange with third parties the information the application generates about your vehicle or your trips.
7. Purpose and basis of processing
The information described in section 3 is processed only on your device and for the sole purpose of delivering the functions you ask for: showing readings, diagnosing codes, recording trips and keeping your preferences. There are no secondary purposes: no marketing, no prospecting, no profiling and no automated decision-making.
No processing takes place for different purposes, so the opt-out mechanism for secondary purposes provided for under Mexican law does not apply.
8. Your rights
8.1 ARCO rights (Mexico)
Under the Federal Law on the Protection of Personal Data Held by Private Parties, you have the right to access your data, rectify it, cancel it and object to its processing, as well as to withdraw your consent.
Since the controller does not hold your data, you can exercise all of those rights directly and immediately from your own device: view the information in the app, delete trips and sessions with confirmation, clear the application's data from the system settings, revoke permissions or uninstall the app. No request, no response period and no intermediary is needed.
If you still wish to raise a query with the controller, you may write to the informational contact address given in this notice. The predictable answer is that no information about you is held, because the application does not collect any.
8.2 Users in the European Economic Area and the United Kingdom (GDPR)
If you are in the EEA or the UK, you have the rights of access, rectification, erasure, restriction, portability and objection set out in Articles 15 to 22 of the GDPR, and the right to lodge a complaint with your supervisory authority.
In practice, the controller does not act as a controller within the meaning of the GDPR in respect of the data on your device, because he neither determines nor accesses that processing: the data remains under your exclusive control. Portability is solved by design through export to CSV, JSON and .obs, which are open, readable formats.
8.3 California residents (CCPA/CPRA)
The controller does not sell personal information within the meaning of the CCPA/CPRA and does not collect, through the application, categories of personal information about you, so there is no information in its possession to know or delete. Should third-party services involving a «sale» or «sharing» within the meaning of those rules be incorporated in the future, this notice will be updated before that happens.
9. Children
OBDScan is aimed at licensed drivers and at people carrying out vehicle maintenance, and is neither designed for nor directed at children under 13. As no data is collected, no information from children is gathered.
10. Security
The information stays in the application's private storage, protected by the operating system and, where applicable, by the device's own encryption. Effective security also depends on you keeping your device up to date and screen-locked.
The connection to an OBD-II adapter — whether Wi-Fi, BLE or classic Bluetooth — is a local, direct link to an accessory you physically control, with no intermediaries on the internet.
11. Changes to this notice
This notice may be updated when the application's features or the applicable rules change. The version in force is always the one published on this page, with its effective date and version number in the header. A substantial change — in particular, any change that would mean starting to collect data — would additionally be announced inside the application before taking effect.
12. Contact
For questions about this notice you may write to the informational contact address: israel.alvarado.segura.dev@gmail.com. It is an information channel and does not replace the one formally designated together with the controller's details.
In Mexico, the competent authority for personal data protection is the federal guarantor body, with which you may file a complaint if you believe your rights have been infringed.