Este documento solo existe en inglés, y la versión inglesa es la que se aplica: una traducción automática de un texto legal deja de decir lo mismo.
OdoKeep is a vehicle logbook app for iOS and Android, provided by Rafael Soares, based in Porto, Portugal.
This Privacy Policy explains what personal data OdoKeep processes, why, on what legal basis, who else is involved, how long it is kept, and what rights you have. It is written to meet Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR").
This policy describes what the app and the website actually do today. It does not describe features that do not exist.
1Who Is Responsible for Your Data
The data controller is:
Rafael Soares
Porto, Portugal
OdoKeep is a service provided by Rafael Soares. There is no separate company behind it and no data protection officer has been appointed, because the conditions in Article 37 GDPR are not met.
- General questions and support: info@odokeep.com
- Data protection, privacy and legal requests: rafaelsoares@odokeep.com
2What This Policy Covers
This policy covers the OdoKeep mobile app for iOS and Android, and the website at https://www.odokeep.com (se abre en una pestaña nueva).
3Where Your Data Is Stored
OdoKeep is offline-first. Everything you record is written to your device first and works with no connection at all. The local database is encrypted with AES-256 under a key generated on your device and held in the iOS Keychain or the Android Keystore, which never leaves the device.
When you are signed in and online, your data is synced to our database at Supabase, hosted in the European Union (Stockholm region, eu-north-1). Access is restricted at database level so that an account can only read and write its own rows.
That database is backed up in two ways, and both hold the same account and garage data the live database does. Supabase takes a daily backup that stays inside its own European infrastructure. Once a week we also take a copy and store it at Cloudflare, outside Supabase, so that losing access to the platform is not the same as losing your data. That weekly copy is encrypted by us before it is uploaded, using a key Cloudflare is never given, so the file that reaches them cannot be read by them or by anyone who obtained it from them. Section 8 says how long each is kept, and section 6 lists everyone involved.
4What Data We Process
4.1Account Data
- Name and email address.
- Authentication credentials. Passwords are handled and hashed by Supabase Auth; we never see or store your password.
- If you use Google sign-in, we receive your email address and basic profile information from Google in order to create and identify your account.
- If you use Sign in with Apple, we receive from Apple the email address it gives us for your account - which is a private relay address if you chose to hide yours - and the name you allow it to share, for the same purpose.
- Technical account records such as the date the account was created and when it was last used.
Signing in is available with an email address and password, with Google, or with Sign in with Apple. Sign in with Apple is offered on iOS only; on Android you can sign in with an email address and password or with Google.
4.2Garage Data
This is the content you create in the app:
- Vehicles: brand, model, year, nickname, licence plate, colour, fuel type, tank capacity.
- Odometer readings: values and dates.
- Fuel and cost records: dates, amounts, currency, quantities, and any notes you write.
- Workshops and places: names you save or pick for a record.
- Tyre pressures: the reading you log for each wheel, and the date you logged it.
- Service schedules: the intervals you set for a recurring maintenance job, in kilometres and in months.
- Obligations: insurance, road tax (IUC) and roadworthiness inspection (IPO) dates and amounts.
- Labels you create to organise records.
A licence plate can identify a specific vehicle and therefore, indirectly, you. It is stored because the app is a logbook, and it is deleted with the rest of your garage when you delete your account.
4.3Vehicle Sharing
OdoKeep lets the owner of a vehicle share it with other people. This is the one part of the app where your data reaches someone else, so it is described in full.
When you invite someone, you give us their email address and we process it in order to send them the invitation and to record that the invitation exists. That address is stored in the invitation record together with the vehicle it concerns, the role chosen, who sent it and when. We use it for nothing else: it is never added to a mailing list and never used for marketing. It is shown to nobody but the person it was addressed to and, inside the app, the vehicle's owner and its managers, who see the addresses of the people invited to that vehicle so that they can manage who has access to it.
We are relying on you having a reason to send that email. Under Art. 6(1)(f) our legitimate interest is in operating a feature you asked for; the recipient's interest is in not being mailed by strangers, which is why an invitation can only be sent for a real vehicle, by its owner or by someone the owner has made a manager of it, why the number of invitations is rate limited, and why anyone can switch invitations off entirely (see below).
What the other person sees. If they accept, they see that vehicle and everything attached to it: its details, its full record history, its obligations and the notes on it. They also see who else the vehicle is shared with, by name and role; a manager also sees those people's email addresses and any invitation still waiting for an answer. They do not see anything else in your account, and they never see your other vehicles. What they may write is decided by the role they were given, and you can change that role or withdraw access at any moment, from the app. A manager may also invite viewers and drivers, move someone between those two roles and remove them; only you can make someone a manager, change a manager's role or remove a manager.
Your name, to them. An invitation carries the name on the profile of whoever sent it, you or a manager of your vehicle, so the person receiving it knows who is asking. Once they accept, your name is what identifies you as the owner of the vehicle inside their app.
Records they add belong to the vehicle, not to them. Everything logged on a shared vehicle is stored under the owner's account. That means the history stays intact when somebody leaves or is removed, and it also means a guest who deletes their own account does not take the vehicle's history with them.
Refusing invitations. In Settings, under Security & privacy, you can turn on "Decline share invites". While it is on, any invitation addressed to you is declined the moment it is created, no email is sent to you and nothing appears in the app. The sender is simply told the invitation was declined, and is not told whether the address has an OdoKeep account.
How long the record lasts. An unanswered invitation expires by itself after 14 days. Declined, expired and withdrawn invitations are kept as a record that access once existed, because that record is what enforces the cooldown before the same address can be invited to the same vehicle again. They are deleted with the rest of your data when you delete your account.
4.4Purchases and Plan
OdoKeep has two plans: Free and OdoKeep Plus. Plus is sold as an auto-renewable subscription (monthly or annual) or as a one-off lifetime purchase.
We process whether your account has Plus, which type of purchase it came from, and when it expires or renews.
Payment itself is handled entirely by the Apple App Store or Google Play. Subscription state is managed for us by RevenueCat. We never receive your card number, bank details or billing address.
4.5App Preferences and Device Data
- Language, theme, units of distance, volume and tyre pressure, preferred currency, reminder settings.
- Whether the optional biometric lock is enabled. Face ID and Touch ID on iOS, and fingerprint or face unlock on Android, are handled by your operating system: your fingerprint or face data is never given to OdoKeep and never leaves your device.
- Local notifications for obligation, servicing and tyre pressure reminders are scheduled on your device. Sending them requires the notification permission you grant to the app.
- How you have set up the fuel prices screen: which countries you want listed, which operators you have hidden, and a tank capacity and an average consumption you can type in yourself so that the cost-to-fill figure works with no vehicle behind it. These stay on your device, are never sent to us and are never synced to your account. A tank capacity you save on a vehicle instead is garage data and is covered by section 4.2.
- Receipt scanning (optional). When you add a fuel or charging record, you can photograph the receipt, or choose a photo of it, to fill in the amounts. On iOS, taking the photo needs the camera permission. On Android, the photo is taken with Google's document scanner, which is part of Google Play services on your phone and works on the device, so the app itself does not ask for the camera. Choosing a photo instead goes through your phone's own photo picker, which hands the app only the picture you choose, so the app never asks for access to your photo library. On both systems the receipt is read on your device. Neither the photograph nor the text read from it is uploaded to us or to anyone else, and neither is added to the record. The photograph is deleted when you leave the scanning screen, and a copy left behind because the app closed in the middle of a scan is deleted automatically the next time the app starts, a day later at most. The saved record only notes that it was filled in from a receipt. On Android, the reading and the document scanner are Google's ML Kit, and ML Kit sends Google its own diagnostic data when they are used: the device's manufacturer, model and operating system version, the app's name and version, performance figures, the format and resolution of the image, and an identifier for that installation which Google says is not meant to identify you or the phone. Never the photograph and never the text read from it (see section 6).
- Home-screen widgets. OdoKeep offers widgets on iOS and Android that show your deadlines, servicing and spending at a glance. Because a widget cannot open the app's database, while you are signed in the app writes a summary of what the widgets show to a file on your device: on iOS in a container shared only with OdoKeep's own widgets, on Android in the app's own files. It is a plain file, not part of the encrypted local database. With the app lock on, it carries no odometer readings and no amounts of money. Your licence plate is never written to it. It is not sent to us, and it is deleted when you sign out or delete your account.
4.6Location (Optional, Only When You Ask)
Two optional features use your location. Neither does anything until you use it and grant the location permission; the app then asks your operating system for a location fix and uses it for one lookup:
- "Find nearby places" on record forms lists fuel stations and workshops close to you, so you do not have to type the name. Your coordinates, rounded to about 100 metres, leave your device in a single request to the OpenStreetMap Overpass API, which returns nearby places.
- The fuel prices screen shows the fuel stations around you and their current prices. Your location stays on your device. The app downloads the published price files for the area around you from our static file host at Cloudflare, and measures the distances on the phone. Those files each cover a square of half a degree (roughly 40 to 55 km across), and the requests for them carry your device's IP address and which squares were asked for, which says roughly which region you are in but not where you are. The price lists the app last fetched are kept on the device, so the screen still works offline. Nothing is sent to the national price sources (see section 6).
The map itself. Where either of these screens draws a map, the map images are fetched from OpenFreeMap as you pan and zoom. Those requests carry your device's IP address and the area being drawn, which is an approximation of where you are looking. No location fix, no account identifier and nothing about your garage goes with them, and the stations on the map come from the price files described above.
Your coordinates never reach our servers: the fuel prices screen keeps them on the phone, and "find nearby places" sends them only to the Overpass API, for that one lookup. They are not stored by us, not written to our logs, and not linked to your account.
This is entirely optional. If you refuse the permission, or never use these features, no location data is collected, and the record form works exactly the same: you type the place name yourself. You can withdraw the permission at any time in your device settings.
4.7Crash and Error Reports
The app sends crash and error reports to Sentry so that faults can be found and fixed. A report contains the error message and stack trace, the app version, the operating system version, the device model, and a technical trail of the actions that preceded the fault.
Sentry is deliberately configured to reduce what it sees:
- Your IP address is not attached to events or sessions.
- Session replay (screen recording) is disabled entirely, because these screens can show licence plates, policy numbers, addresses and personal notes.
4.8Support Data
If you open a support ticket, we process the messages you send, our replies, and the account identifier that opened the ticket.
4.9Website Data
The website is an informational and legal site. It keeps a few things in your browser, all listed in the Cookie Policy: your language, the light or dark theme if you pick one, which of the site's hidden easter eggs you have found, and the fuel stations you mark as favourites on the fuel prices pages. None of it carries an identifier, and none of it is sent to us.
The fuel prices pages. They offer an optional "Near me" search, which asks your browser for your location. That location is used in your browser to find the stations around you and is never sent to us. The page writes it, rounded to about 100 metres, into the part of its address after the "#" sign, which browsers do not send to any server, but which a link you copy from that page carries with it. The map on those pages is drawn with images fetched from OpenFreeMap as you pan and zoom, and those requests carry your IP address and the area being drawn, as they do in the app (section 4.6).
It sets no analytics cookies and no advertising cookies, runs no tracking or advertising scripts, and therefore shows no cookie consent banner, because nothing beyond what is strictly necessary is stored. Standard technical logs generated by the hosting infrastructure (such as IP address, timestamp and browser user agent) may be kept for a short period to serve the site and protect it against abuse.
4.10Keeping the Service Working
Every request your device makes to our servers carries its IP address, as every request on the internet does. Two of our own defences keep a copy of it for a short while, and they are the only ones that do:
- Sign-ups. When an account is created with an email address and a password, we count how many sign-ups have come from that address in the last hour, so that one machine cannot open accounts in bulk. Sign-ups through Google or Apple are not counted. On IPv6 the count is kept against the /64 block rather than the exact address, because one machine is given a whole block.
- Blocks. An address that keeps being refused is blocked for seven days. A block is a row holding the address, when it was made and when it ends.
Neither is linked to your account, neither is used to identify you, and neither is used for anything else. Our legal basis is our legitimate interest under Art. 6(1)(f) in keeping the service available to everyone, which cannot be done without some way of telling one machine from a hundred.
Separately, and for the same purpose, we count how many rows each account writes per hour. That count is about the account, not the address, and section 12 explains what it can lead to.
4.11What We Do Not Collect
To be explicit, because these are common in other apps and are absent here:
- No photos, receipts, invoices or file attachments are uploaded or stored. OdoKeep has no attachment feature at all, and a receipt you scan is read on your device and never uploaded (see section 4.5).
- No advertising identifiers, no ad networks, no cross-app or cross-site tracking.
- No product analytics and no behavioural profiling of how you use the app.
- No third-party payment processor of our own: purchases go through the App Store or Google Play, and nowhere else.
- We never sell your personal data, and we never share it for advertising purposes.
5Why We Process Your Data and On What Legal Basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Create your account, sign you in, keep you signed in | Account data | Performance of a contract, Art. 6(1)(b) |
| Store, sync and show your garage across your devices | Garage data | Performance of a contract, Art. 6(1)(b) |
| Share a vehicle with someone you invite, and show it in their garage | Garage data of that vehicle, your name | Performance of a contract, Art. 6(1)(b) |
| Send an invitation to the address you typed, and remember it was sent | The invited email address | Legitimate interest, Art. 6(1)(f): operating a sharing feature at your request, bounded by rate limits and by the recipient's ability to refuse all invitations |
| Give you the plan you paid for and check whether Plus is active | Purchase data, account identifier | Performance of a contract, Art. 6(1)(b) |
| Remember your settings and preferences | App preferences | Performance of a contract, Art. 6(1)(b) |
| Remind you about insurance, IUC and IPO dates, about a service that is due, and about checking your tyres | Obligation dates, service intervals, odometer readings and tyre pressure dates | Performance of a contract, Art. 6(1)(b); the notification permission itself is consent, Art. 6(1)(a) |
| List fuel stations and workshops near you, or show fuel prices around you, when you ask | Your location (rounded to about 100 metres when it leaves the device) | Consent, Art. 6(1)(a), given through the operating system permission prompt and withdrawable in device settings |
| Convert amounts between currencies | The dates and currencies of your records, used on your device; only the year of rates needed is downloaded from our static file host | Performance of a contract, Art. 6(1)(b). Nothing about your records leaves the device for this |
| Detect whether your device is online, so offline mode works | The network request itself | Legitimate interest, Art. 6(1)(f): an offline-first app has to know it is offline |
| Diagnose crashes and errors | Crash and error reports | Legitimate interest, Art. 6(1)(f): keeping the app stable and usable |
| Read a receipt on Android | The diagnostic data ML Kit sends to Google (section 4.5) | Legitimate interest, Art. 6(1)(f): the receipt reader on Android is Google's ML Kit, which reports how it runs to Google; it is used only when you scan a receipt |
| Answer your support requests | Support data | Performance of a contract, Art. 6(1)(b); after account deletion, legitimate interest, Art. 6(1)(f), see section 8 |
| Protect the service against fraud, abuse and misuse | Account identifier, IP address, technical logs | Legitimate interest, Art. 6(1)(f): keeping the service and its users safe |
| Comply with legal obligations | Whatever the obligation requires | Legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interest, we have weighed that interest against your rights and freedoms, and limited the processing accordingly. You can object at any time (see section 9).
Where we rely on consent, you can withdraw it at any time, with no effect on the lawfulness of processing carried out before you withdrew it.
6Who Else Processes Your Data
We use the following recipients and processors. This list is complete: there are no others.
| Recipient | What it does | Where it processes data |
|---|---|---|
| Supabase | Database and authentication for your account and garage, and the daily backups it takes of them | Database and its backups in the European Union (Stockholm, eu-north-1); Supabase Inc. is US-based |
| Hostinger | Delivers every email OdoKeep sends: password reset links, replies to your support tickets, and vehicle share invitations. It handles the recipient address and the contents of the message | HOSTINGER, UAB, Lithuania (European Union). Its own policy names further processing locations, and any transfer outside the EEA rests on the safeguards in section 7 |
| RevenueCat | Keeps track of whether your OdoKeep Plus purchase is valid and active | United States |
| Apple App Store | Processes your payment and manages your subscription when you buy on iOS | Ireland and the United States |
| Google Play | Processes your payment and manages your subscription when you buy on Android | Ireland and the United States |
| Google sign-in, if you choose it; and a connectivity check the app makes to a Google endpoint to tell online from offline | Ireland and the United States | |
| Google (ML Kit) | Reads receipts on Android (text recognition and the document scanner), on your device. When used, it sends Google its own diagnostic data: device and app information, performance figures, the image's format and resolution, and a per-installation identifier. Never the photograph or the text read from it. Google states it does not pass this data to third parties | Ireland and the United States |
| Apple | Sign in with Apple, if you choose it, including the private relay address it issues when you hide your own | Ireland and the United States |
| Sentry | Crash and error reporting | Sentry is a US company; where its region is outside the EEA, transfers rest on the safeguards in section 7 |
| OpenStreetMap Overpass API | Returns fuel stations and workshops near a set of coordinates, only when you use "find nearby places" | Public Overpass instance operated in Germany (European Union) |
| Frankfurter | Provides the foreign exchange rates for currency conversion. A scheduled job of ours downloads them once a day and publishes them as files on our static file host, which is where the app gets them; your device never calls Frankfurter | No personal data is sent to it |
| OpenFreeMap | Serves the map images drawn on the fuel prices map and the place picker in the app, and on the fuel prices pages of the website | A free public service that publishes no processing location of its own; where a request leaves the EEA, section 7 applies |
| Cloudflare | Three things. It serves the app's static files (the vehicle datasets, the brand logos it draws, the fuel price files, the exchange rates, and the file the app reads to check whether it needs an update), and those requests carry your IP address. It runs the endpoint a blocked account uses to appeal, which receives the address and message typed into that form together with the IP address it arrived from. And it stores the weekly off-site copy of the database described in section 8. That file holds account and garage data, and it arrives already encrypted by us, with a key Cloudflare does not hold, so what sits in their storage is unreadable to them | Global delivery network. The bucket holding the backups is set to European Union jurisdiction, so those files are stored in the EU; Cloudflare, Inc. is itself US-based |
| GitHub | Runs the scheduled jobs that keep the service working. One of them makes the weekly copy of the database. That job is where the copy is produced and where it is encrypted, so account and garage data exists in readable form on a GitHub machine for the minute it takes to write and encrypt it, and leaves in encrypted form. Nothing is kept there afterwards | GitHub, Inc. is US-based and its hosted runners are operated by Microsoft |
| Expo | Delivers over-the-air updates to the installed app. The app asks whether an update exists, which carries its IP address and the version it is running | United States |
| Vercel | Hosts odokeep.com and its technical logs. The app itself does not talk to it | Vercel Inc. is US-based; the site is served from its edge network |
We may also disclose data where we are legally required to, for example in response to a lawful order from a competent authority. If OdoKeep is ever transferred to another owner, your data may pass to that owner, and you will be told before it happens.
Public data sources. The fuel prices shown in the app and on the website come from official public price data published by national authorities. A scheduled job of ours reads those feeds once a day and publishes the prices as files on our static file host at Cloudflare. The app downloads those files and the website's fuel prices pages are built from them, so neither ever contacts the sources. These bodies are sources we read from, not recipients of anything about you: no personal data, no location and no identifier is ever sent to them, and they have no way of identifying you. They are:
- DGEG (Direção-Geral de Energia e Geologia), Portugal
- The Geoportal of the Ministry for the Ecological Transition (Ministerio para la Transición Ecológica y el Reto Demográfico), Spain
- data.economie.gouv.fr, the open data portal of the Ministry of the Economy, France
- Osservaprezzi carburanti, run by MIMIT (Ministero delle Imprese e del Made in Italy), Italy
- Spritpreisrechner, run by E-Control, the energy regulator, Austria
7International Transfers
Your account and garage data is stored in the European Union. Crash reports go to Sentry, a US company; where its processing region is outside the European Economic Area, the transfer rests on the safeguards described below.
Email is delivered by Hostinger, a Lithuanian company, so the message itself does not leave the European Union to be sent. Hostinger's own policy does name locations outside the EEA among the places it may process data, and where that happens the transfer rests on the same safeguards below.
The weekly off-site copy of the database contains the same account and garage data as the live database, and it is stored in the European Union: the Cloudflare bucket that holds it is set to EU jurisdiction. What does leave the EU is the making of it. The copy is produced by a scheduled job on GitHub's hosted runners, which are US-operated, so the file passes through them on its way to storage without being kept there. It is also encrypted on that runner before it goes anywhere, which means the only place it exists in readable form is the runner itself, for as long as the job takes. That transit rests on the same safeguards as the rest of this section.
Some of the providers above are companies established in the United States, and their support and engineering staff may access data from there. For those transfers we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, on the EU-US Data Privacy Framework, together with the additional safeguards those providers apply.
You can ask us for more detail about the safeguards applied to a specific transfer at rafaelsoares@odokeep.com.
8How Long We Keep Your Data
| Data | Retention |
|---|---|
| Data on your device | Until you delete the account, sign out and clear the app data, or uninstall the app |
| Account and garage data | Until you delete your account. Deleting your account in the app is a hard delete of your garage data, not a hidden archive. Backups are the one exception, and section 8.2 explains it |
| Backups | The daily backup Supabase takes is kept for 7 days. The weekly copy stored at Cloudflare is kept for 90 days, after which it is deleted automatically |
| Purchase and plan status | While your account exists. Apple, Google and RevenueCat keep their own transaction records under their own retention rules |
| Crash and error reports | No longer than Sentry's standard retention window (90 days for error events), after which they are deleted automatically |
| Vehicle sharing invitations | An unanswered invitation expires after 14 days. Answered, expired and withdrawn ones are kept as the record that access once existed, and are deleted when the owner deletes their account |
| Receipt reader diagnostics (Android) | Never received by us. Google keeps what ML Kit sends under its own retention rules |
| Location data | Not retained by us at all. The fuel prices screen uses your position on your device and never sends it, and the coordinates sent for "find nearby places" go to the Overpass API for that one lookup; none of it reaches our servers or our logs |
| Accounts created and never used | An account with no vehicles, no records, no purchase and no support ticket, which has not been signed in to for 30 days, is deleted automatically along with everything attached to it |
| Abuse-prevention counters | A per-account count of rows written in the current hour, and a per-IP-address count of sign-up attempts. The first is deleted 30 days after the account last wrote, the second 7 days after that address last signed up |
| Blocked addresses | An IP address blocked for repeated refusals is kept for the seven days of the block and for 30 days after it ends, so an address that comes back can be seen beside its own history. A block made by hand has no end date and is kept until it is lifted |
| Support tickets and their messages | Kept after your account is deleted. See below |
8.1Why Support Tickets Outlive the Account
We are honest about this because it is one of two exceptions to "delete the account, delete everything". The other is backups, in 8.2.
When you delete your account, your support tickets and their messages are not deleted. They stop belonging to a live account, but the ticket, its contents and the identifier of the account that opened it remain. We keep them because:
- an issue you reported may still be open and still needs to be closed;
- a billing, refund or store dispute can follow an account deletion, and we need the record to deal with it fairly;
- a defect reported eleven times is only visible as a pattern if the earlier reports still exist.
The legal basis is our legitimate interest under Art. 6(1)(f) in supporting the product and in establishing, exercising or defending legal claims. You can ask us to erase them, and we will, unless we still need a specific ticket for one of the reasons above, which is a limit the GDPR itself recognises in Art. 17(3)(e). If we refuse, we will tell you why.
8.2Deletion and Backups
Deleting your account removes your data from the live database at once. It does not reach backwards into copies that were already made, and we will not pretend otherwise.
A backup is a snapshot of the database as it was on the day it was taken. Editing individual accounts out of one would mean restoring it, changing it and writing it back, which defeats the purpose of having an untouched copy to fall back on. So a deleted account stays inside any backup taken before the deletion, and disappears when that backup expires: within 7 days for the daily backup Supabase takes, and within 90 days for the weekly copy stored at Cloudflare.
During that window the data is not used for anything. Backups exist to be restored after a failure and are read for no other purpose. In the unlikely event we ever do restore one, we re-apply the deletions made since it was taken.
This is the standard position under Art. 17 GDPR: erasure covers live systems, and backups are honoured as they rotate rather than by being rewritten. Ninety days is the outer limit for the data of a deleted account.
9Your Rights Under the GDPR
You have the right to:
- Access your data and get a copy of it, and to be told how it is processed (Art. 15).
- Rectification of data that is inaccurate or incomplete (Art. 16).
- Erasure of your data, the "right to be forgotten" (Art. 17).
- Restriction of processing, so we keep the data but stop using it, while a dispute about it is resolved (Art. 18).
- Portability: to receive your data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible (Art. 20).
- Object to processing based on our legitimate interests, at any time and on grounds relating to your particular situation (Art. 21). We will then stop, unless we can demonstrate compelling legitimate grounds that override your rights, or the processing is needed for legal claims.
- Withdraw consent at any time, for anything we do on the basis of consent, such as the location permission (Art. 7(3)). Withdrawing consent is easy and free, and it does not make the processing carried out before the withdrawal unlawful.
- Lodge a complaint with a supervisory authority (see section 11).
Some of these you can exercise yourself, immediately, inside the app:
- Export your data as JSON or CSV.
- Edit or delete any vehicle, record or label.
- Import a garage.
- Delete your account, which hard-deletes your garage data.
10How to Exercise Your Rights
Write to rafaelsoares@odokeep.com from the email address on your account, and tell us what you want.
- We reply without undue delay and within one month of receiving your request, as required by Art. 12(3).
- If your request is complex, or if you have made several, that period can be extended by up to two further months. If that happens, we will tell you within the first month and explain why.
- Exercising your rights is free of charge. Only for requests that are manifestly unfounded or excessive may we charge a reasonable fee or refuse, and we would have to justify that (Art. 12(5)).
- We may ask you to confirm your identity before we act, so that nobody else can obtain or delete your data.
11Complaints to a Supervisory Authority
If you believe we have handled your personal data unlawfully, we would like to hear from you first at rafaelsoares@odokeep.com, but you do not have to contact us before complaining.
You have the right to lodge a complaint with a supervisory authority. In Portugal, that is:
Comissão Nacional de Proteção de Dados (CNPD)
https://www.cnpd.pt (se abre en una pestaña nueva)
If you live or work in another EU or EEA country, you may complain to the supervisory authority there instead.
12Automated Decision-Making
OdoKeep does not profile you. Your data is not used to score, rank or categorise you, it is not used to train anything, and it is not used to decide what you are shown or what you pay. Statistics such as cost per kilometre and consumption are calculated for you, from your own records, and shown only to you.
There is one automated decision, and it is set out here in full because Art. 22 GDPR requires it to be.
What it does. To keep the service available and affordable, our systems count how many rows each account writes per hour. An account that writes far above any ordinary use, and keeps doing so, is temporarily suspended for six hours. That is the whole of it.
What it never does.
- It never suspends an account that has an active subscription or plan. Those are read and decided by a person.
- It never suspends permanently. The suspension ends by itself after six hours.
- It never deletes anything. Your garage and its history are untouched and are waiting for you when it lifts.
- It never acts on what you write, only on how much. The content of your records is not read, scored or classified by it.
Your rights over this decision, under Art. 22(3) GDPR. You have the right to obtain human intervention, to express your point of view and to contest the decision. The app tells you when an account is suspended and offers an appeal on that same screen, which reaches a person; you can also write to rafaelsoares@odokeep.com. Every appeal is read and answered by a person, never by an algorithm.
Legal basis. Our legitimate interest in keeping the service running and protecting it from automated abuse, under Art. 6(1)(f) GDPR, and the performance of our contract with you under Art. 6(1)(b), since an unavailable service is one we cannot provide to anybody.
13Security
The measures in place include:
- Encryption in transit for everything the app and the website send (HTTPS, TLS).
- Encryption at rest in the Supabase database, and in both sets of backups, applied by the providers that hold them.
- The weekly off-site copy is encrypted by us as well, before it is uploaded. The key that encrypts it is public and the key that decrypts it is not: the private half is never on the machine that makes the backup and is not held by the storage provider, so the job can write a backup it cannot itself read, and stolen storage credentials yield an unreadable file rather than your garage.
- Backups held in two independent places, so a failure at one provider is survivable.
- Row-level access rules in the database, so an account can only read and write its own rows.
- AES-256 encryption of the local database on your device, keyed from the iOS Keychain or the Android Keystore. The key never leaves the device it was created on and is excluded from device backups, so a backup restored onto another phone carries the encrypted file but not the means to read it.
- On Android, the app opts out of Android's cloud backup and of device-to-device transfer altogether, so nothing it keeps on the phone is copied off it that way.
- An optional biometric lock (Face ID or Touch ID on iOS, fingerprint or face unlock on Android) for opening the app.
- Crash reporting configured without your IP address and with screen recording disabled.
No system is perfectly secure, but if a personal data breach ever puts your rights at risk, we will notify the CNPD and, where required by Art. 34 GDPR, you.
14Children
OdoKeep is a vehicle logbook. It is not directed at children under 16, and accounts should not be created by them.
We do not knowingly process the data of a child under 16. If you believe a child has created an account, write to rafaelsoares@odokeep.com and it will be deleted.
15Changes to This Policy
We may update this policy, for example if a feature changes or a new processor is added.
The current version is always published here with its "Last update" date. If a change is significant, we will make it visible in the app or by email before it takes effect. Continuing to use OdoKeep after a change does not replace a legal basis where one is required: where a change needs your consent, we will ask for it.
16Contact
For questions, requests or concerns about this Privacy Policy:
Data protection and legal: rafaelsoares@odokeep.com
General support: info@odokeep.com
Website: https://www.odokeep.com (se abre en una pestaña nueva)
OdoKeep is a service provided by Rafael Soares, Porto, Portugal.