Privacy Policy

OdoKeep is a vehicle logbook app for iOS and Android, provided by Rafael Soares, based in Porto, Portugal.

This Privacy Policy explains what personal data OdoKeep processes, why, on what legal basis, who else is involved, how long it is kept, and what rights you have. It is written to meet Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR").

This policy describes what the app and the website actually do today. It does not describe features that do not exist.

---

1Who Is Responsible for Your Data

The data controller is:

Rafael Soares

Porto, Portugal

[email protected]

OdoKeep is a service provided by Rafael Soares. There is no separate company behind it and no data protection officer has been appointed, because the conditions in Article 37 GDPR are not met.

• General questions and support: [email protected]
• Data protection, privacy and legal requests: [email protected]

---

2What This Policy Covers

This policy covers the OdoKeep mobile app for iOS and Android, and the website at https://odokeep.com.

---

3Where Your Data Is Stored

OdoKeep is offline-first. Everything you record is written to your device first and works with no connection at all. The local database is encrypted with AES-256 under a key generated on your device and held in the iOS Keychain or the Android Keystore, which never leaves the device.

When you are signed in and online, your data is synced to our database at Supabase, hosted in the European Union (Stockholm region, eu-north-1). Access is restricted at database level so that an account can only read and write its own rows.

That database is backed up in two ways, and both hold the same account and garage data the live database does. Supabase takes a daily backup that stays inside its own European infrastructure. Once a week we also take a copy and store it at Cloudflare, outside Supabase, so that losing access to the platform is not the same as losing your data. That weekly copy is encrypted by us before it is uploaded, using a key Cloudflare is never given, so the file that reaches them cannot be read by them or by anyone who obtained it from them. Section 8 says how long each is kept, and section 6 lists everyone involved.

---

4What Data We Process

4.1Account Data

• Name and email address.
• Authentication credentials. Passwords are handled and hashed by Supabase Auth; we never see or store your password.
• If you use Google sign-in, we receive your email address and basic profile information from Google in order to create and identify your account.
• If you use Sign in with Apple, we receive from Apple the email address it gives us for your account - which is a private relay address if you chose to hide yours - and the name you allow it to share, for the same purpose.
• Technical account records such as the date the account was created and when it was last used.

Signing in is available with an email address and password, with Google, or with Sign in with Apple.

4.2Garage Data

This is the content you create in the app:

• Vehicles: brand, model, year, nickname, licence plate, colour, fuel type, tank capacity.
• Odometer readings: values and dates.
• Fuel and cost records: dates, amounts, currency, quantities, and any notes you write.
• Workshops and places: names you save or pick for a record.
• Tyre pressures: the reading you log for each wheel, and the date you logged it.
• Service schedules: the intervals you set for a recurring maintenance job, in kilometres and in months.
• Obligations: insurance, road tax (IUC) and roadworthiness inspection (IPO) dates and amounts.
• Tags you create to organise records.

A licence plate can identify a specific vehicle and therefore, indirectly, you. It is stored because the app is a logbook, and it is deleted with the rest of your garage when you delete your account.

4.3Vehicle Sharing

OdoKeep lets the owner of a vehicle share it with other people. This is the one part of the app where your data reaches someone else, so it is described in full.

When you invite someone, you give us their email address and we process it in order to send them the invitation and to record that the invitation exists. That address is stored in the invitation record together with the vehicle it concerns, the role you chose, who sent it and when. We use it for nothing else: it is never added to a mailing list, never used for marketing, and never disclosed to anyone but the person you addressed it to.

We are relying on you having a reason to send that email. Under Art. 6(1)(f) our legitimate interest is in operating a feature you asked for; the recipient's interest is in not being mailed by strangers, which is why an invitation can only be sent by the owner of a real vehicle, why the number an account may send is rate limited, and why anyone can switch invitations off entirely (see below).

What the other person sees. If they accept, they see that vehicle and everything attached to it: its details, its full record history, its obligations and the notes on it. They do not see anything else in your account, and they never see your other vehicles. What they may write is decided by the role you gave them, and you can change that role or withdraw access at any moment, from the app.

Your name, to them. An invitation carries the first name on your profile, so the person receiving it knows who is asking. Once they accept, that name is what identifies you as the owner of the vehicle inside their app.

Records they add belong to the vehicle, not to them. Everything logged on a shared vehicle is stored under the owner's account. That means the history stays intact when somebody leaves or is removed, and it also means a guest who deletes their own account does not take the vehicle's history with them.

Refusing invitations. In Settings, under Privacy, you can turn on "Decline invitations automatically". While it is on, any invitation addressed to you is declined the moment it is created, no email is sent to you and nothing appears in the app. The sender is simply told the invitation was declined, and is not told whether the address has an OdoKeep account.

How long the record lasts. An unanswered invitation expires by itself after 14 days. Declined, expired and withdrawn invitations are kept as a record that access once existed, because that record is what enforces the cooldown before the same address can be invited to the same vehicle again. They are deleted with the rest of your data when you delete your account.

4.4Purchases and Plan

OdoKeep has two plans: Free and OdoKeep Plus. Plus is sold as an auto-renewable subscription (monthly or annual) or as a one-off lifetime purchase.

We process whether your account has Plus, which type of purchase it came from, and when it expires or renews.

Payment itself is handled entirely by the Apple App Store or Google Play. Subscription state is managed for us by RevenueCat. We never receive your card number, bank details or billing address.

4.5App Preferences and Device Data

• Language, theme, units of distance, volume and tyre pressure, preferred currency, reminder settings.
• Whether the optional biometric lock is enabled. Face ID and Touch ID are handled by your operating system: your fingerprint or face data is never given to OdoKeep and never leaves your device.
• Local notifications for obligation, servicing and tyre pressure reminders are scheduled on your device. Sending them requires the notification permission you grant to the app.
• How you have set up the fuel prices screen: which countries you want listed, which operators you have hidden, and a tank capacity and an average consumption you can type in yourself so that the cost-to-fill figure works with no vehicle behind it. These stay on your device, are never sent to us and are never synced to your account. A tank capacity you save on a vehicle instead is garage data and is covered by section 4.2.

4.6Location (Optional, Only When You Ask)

Two optional features use your location. Neither does anything until you use it and grant the location permission; the app then asks your operating system for a location fix and uses it for one lookup:

• "Find nearby places" on record forms lists fuel stations and workshops close to you, so you do not have to type the name. Approximate coordinates leave your device in a single request to the OpenStreetMap Overpass API, which returns nearby places.
• The fuel prices screen shows the fuel stations around you and their current prices. Your location, rounded to about 100 metres, leaves your device in a single request to our own server at Supabase (European Union), which returns the stations around that point. Nothing is sent to the national price sources: our server collects their public data on a schedule and keeps its own copy, so those services never see you (see section 6).

The map itself. Where either of these screens draws a map, the map images are fetched from OpenFreeMap as you pan and zoom. Those requests carry your device's IP address and the area being drawn, which is an approximation of where you are looking. No location fix, no account identifier and nothing about your garage goes with them, and the stations on the map still come from our own server.

In both cases the coordinates are used for that one lookup. They are not stored on our servers, not written to our logs, and not linked to your account.

This is entirely optional. If you refuse the permission, or never use these features, no location data is collected, and the record form works exactly the same: you type the place name yourself. You can withdraw the permission at any time in your device settings.

4.7Crash and Error Reports

The app sends crash and error reports to Sentry so that faults can be found and fixed. A report contains the error message and stack trace, the app version, the operating system version, the device model, and a technical trail of the actions that preceded the fault.

Sentry is deliberately configured to reduce what it sees:

• Your IP address is not attached to events or sessions.
• Session replay (screen recording) is disabled entirely, because these screens can show licence plates, policy numbers, addresses and personal notes.

4.8Support Data

If you open a support ticket, we process the messages you send, our replies, and the account identifier that opened the ticket.

4.9Website Data

The website is an informational and legal site. It stores a language preference so that it can show you the right version.

It sets no analytics cookies and no advertising cookies, runs no tracking or advertising scripts, and therefore shows no cookie consent banner, because nothing beyond what is strictly necessary is stored. Standard technical logs generated by the hosting infrastructure (such as IP address, timestamp and browser user agent) may be kept for a short period to serve the site and protect it against abuse.

4.10Keeping the Service Working

Every request your device makes to our servers carries its IP address, as every request on the internet does. Two of our own defences keep a copy of it for a short while, and they are the only ones that do:

• Sign-ups. When an account is created with an email address and a password, we count how many sign-ups have come from that address in the last hour, so that one machine cannot open accounts in bulk. Sign-ups through Google or Apple are not counted. On IPv6 the count is kept against the /64 block rather than the exact address, because one machine is given a whole block.
• Blocks. An address that keeps being refused is blocked for seven days. A block is a row holding the address, when it was made and when it ends.

Neither is linked to your account, neither is used to identify you, and neither is used for anything else. Our legal basis is our legitimate interest under Art. 6(1)(f) in keeping the service available to everyone, which cannot be done without some way of telling one machine from a hundred.

Separately, and for the same purpose, we count how many rows each account writes per hour. That count is about the account, not the address, and section 12 explains what it can lead to.

---

4.11What We Do Not Collect

To be explicit, because these are common in other apps and are absent here:

• No photos, receipts, invoices or file attachments. OdoKeep has no attachment feature at all.
• No advertising identifiers, no ad networks, no cross-app or cross-site tracking.
• No product analytics and no behavioural profiling of how you use the app.
• No third-party payment processor of our own: purchases go through the App Store or Google Play, and nowhere else.
• We never sell your personal data, and we never share it for advertising purposes.

---

5Why We Process Your Data and On What Legal Basis

Where we rely on legitimate interest, we have weighed that interest against your rights and freedoms, and limited the processing accordingly. You can object at any time (see section 9).

Where we rely on consent, you can withdraw it at any time, with no effect on the lawfulness of processing carried out before you withdrew it.

---

6Who Else Processes Your Data

We use the following recipients and processors. This list is complete: there are no others.

We may also disclose data where we are legally required to, for example in response to a lawful order from a competent authority. If OdoKeep is ever transferred to another owner, your data may pass to that owner, and you will be told before it happens.

Public data sources. The fuel prices shown in the app come from official open data published by national authorities. Our server reads those feeds on a schedule and keeps a copy at Supabase; the app only ever talks to our server. These bodies are sources we read from, not recipients of anything about you: no personal data, no location and no identifier is ever sent to them, and they have no way of identifying you. They are:

• DGEG (Direção-Geral de Energia e Geologia), Portugal
• The Geoportal of the Ministry for the Ecological Transition (Ministerio para la Transición Ecológica y el Reto Demográfico), Spain
• data.economie.gouv.fr, the open data portal of the Ministry of the Economy, France
• Osservaprezzi carburanti, run by MIMIT (Ministero delle Imprese e del Made in Italy), Italy
• Spritpreisrechner, run by E-Control, the energy regulator, Austria

---

7International Transfers

Your account and garage data is stored in the European Union. Crash reports go to Sentry, a US company; where its processing region is outside the European Economic Area, the transfer rests on the safeguards described below.

Email is delivered by Hostinger, a Lithuanian company, so the message itself does not leave the European Union to be sent. Hostinger's own policy does name locations outside the EEA among the places it may process data, and where that happens the transfer rests on the same safeguards below.

The weekly off-site copy of the database contains the same account and garage data as the live database, and it is stored in the European Union: the Cloudflare bucket that holds it is set to EU jurisdiction. What does leave the EU is the making of it. The copy is produced by a scheduled job on GitHub's hosted runners, which are US-operated, so the file passes through them on its way to storage without being kept there. It is also encrypted on that runner before it goes anywhere, which means the only place it exists in readable form is the runner itself, for as long as the job takes. That transit rests on the same safeguards as the rest of this section.

Some of the providers above are companies established in the United States, and their support and engineering staff may access data from there. For those transfers we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, on the EU-US Data Privacy Framework, together with the additional safeguards those providers apply.

You can ask us for more detail about the safeguards applied to a specific transfer at [email protected].

---

8How Long We Keep Your Data

8.1Why Support Tickets Outlive the Account

We are honest about this because it is one of two exceptions to "delete the account, delete everything". The other is backups, in 8.2.

When you delete your account, your support tickets and their messages are not deleted. They stop belonging to a live account, but the ticket, its contents and the identifier of the account that opened it remain. We keep them because:

• an issue you reported may still be open and still needs to be closed;
• a billing, refund or store dispute can follow an account deletion, and we need the record to deal with it fairly;
• a defect reported eleven times is only visible as a pattern if the earlier reports still exist.

The legal basis is our legitimate interest under Art. 6(1)(f) in supporting the product and in establishing, exercising or defending legal claims. You can ask us to erase them, and we will, unless we still need a specific ticket for one of the reasons above, which is a limit the GDPR itself recognises in Art. 17(3)(e). If we refuse, we will tell you why.

8.2Deletion and Backups

Deleting your account removes your data from the live database at once. It does not reach backwards into copies that were already made, and we will not pretend otherwise.

A backup is a snapshot of the database as it was on the day it was taken. Editing individual accounts out of one would mean restoring it, changing it and writing it back, which defeats the purpose of having an untouched copy to fall back on. So a deleted account stays inside any backup taken before the deletion, and disappears when that backup expires: within 7 days for the daily backup Supabase takes, and within 90 days for the weekly copy stored at Cloudflare.

During that window the data is not used for anything. Backups exist to be restored after a failure and are read for no other purpose. In the unlikely event we ever do restore one, we re-apply the deletions made since it was taken.

This is the standard position under Art. 17 GDPR: erasure covers live systems, and backups are honoured as they rotate rather than by being rewritten. Ninety days is the outer limit for the data of a deleted account.

---

9Your Rights Under the GDPR

You have the right to:

• Access your data and get a copy of it, and to be told how it is processed (Art. 15).
• Rectification of data that is inaccurate or incomplete (Art. 16).
• Erasure of your data, the "right to be forgotten" (Art. 17).
• Restriction of processing, so we keep the data but stop using it, while a dispute about it is resolved (Art. 18).
• Portability: to receive your data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible (Art. 20).
• Object to processing based on our legitimate interests, at any time and on grounds relating to your particular situation (Art. 21). We will then stop, unless we can demonstrate compelling legitimate grounds that override your rights, or the processing is needed for legal claims.
• Withdraw consent at any time, for anything we do on the basis of consent, such as the location permission (Art. 7(3)). Withdrawing consent is easy and free, and it does not make the processing carried out before the withdrawal unlawful.
• Lodge a complaint with a supervisory authority (see section 11).

Some of these you can exercise yourself, immediately, inside the app:

• Export your data as JSON or CSV.
• Edit or delete any vehicle, record or tag.
• Import a garage.
• Delete your account, which hard-deletes your garage data.

---

10How to Exercise Your Rights

Write to [email protected] from the email address on your account, and tell us what you want.

• We reply without undue delay and within one month of receiving your request, as required by Art. 12(3).
• If your request is complex, or if you have made several, that period can be extended by up to two further months. If that happens, we will tell you within the first month and explain why.
• Exercising your rights is free of charge. Only for requests that are manifestly unfounded or excessive may we charge a reasonable fee or refuse, and we would have to justify that (Art. 12(5)).
• We may ask you to confirm your identity before we act, so that nobody else can obtain or delete your data.

---

11Complaints to a Supervisory Authority

If you believe we have handled your personal data unlawfully, we would like to hear from you first at [email protected], but you do not have to contact us before complaining.

You have the right to lodge a complaint with a supervisory authority. In Portugal, that is:

Comissão Nacional de Proteção de Dados (CNPD)

https://www.cnpd.pt

If you live or work in another EU or EEA country, you may complain to the supervisory authority there instead.

---

12Automated Decision-Making

OdoKeep does not profile you. Your data is not used to score, rank or categorise you, it is not used to train anything, and it is not used to decide what you are shown or what you pay. Statistics such as cost per kilometre and consumption are calculated for you, from your own records, and shown only to you.

There is one automated decision, and it is set out here in full because Art. 22 GDPR requires it to be.

What it does. To keep the service available and affordable, our systems count how many rows each account writes per hour. An account that writes far above any ordinary use, and keeps doing so, is temporarily suspended for six hours. That is the whole of it.

What it never does.

• It never suspends an account that has an active subscription or plan. Those are read and decided by a person.
• It never suspends permanently. The suspension ends by itself after six hours.
• It never deletes anything. Your garage and its history are untouched and are waiting for you when it lifts.
• It never acts on what you write, only on how much. The content of your records is not read, scored or classified by it.

Your rights over this decision, under Art. 22(3) GDPR. You have the right to obtain human intervention, to express your point of view and to contest the decision. The app tells you when an account is suspended and offers an appeal on that same screen, which reaches a person; you can also write to [email protected]. Every appeal is read and answered by a person, never by an algorithm.

Legal basis. Our legitimate interest in keeping the service running and protecting it from automated abuse, under Art. 6(1)(f) GDPR, and the performance of our contract with you under Art. 6(1)(b), since an unavailable service is one we cannot provide to anybody.

---

13Security

The measures in place include:

• Encryption in transit for everything the app and the website send (HTTPS, TLS).
• Encryption at rest in the Supabase database, and in both sets of backups, applied by the providers that hold them.
• The weekly off-site copy is encrypted by us as well, before it is uploaded. The key that encrypts it is public and the key that decrypts it is not: the private half is never on the machine that makes the backup and is not held by the storage provider, so the job can write a backup it cannot itself read, and stolen storage credentials yield an unreadable file rather than your garage.
• Backups held in two independent places, so a failure at one provider is survivable.
• Row-level access rules in the database, so an account can only read and write its own rows.
• AES-256 encryption of the local database on your device, keyed from the iOS Keychain or the Android Keystore. The key never leaves the device it was created on and is excluded from device backups, so a backup restored onto another phone carries the encrypted file but not the means to read it.
• An optional biometric lock (Face ID or Touch ID) for opening the app.
• Crash reporting configured without your IP address and with screen recording disabled.

No system is perfectly secure, but if a personal data breach ever puts your rights at risk, we will notify the CNPD and, where required by Art. 34 GDPR, you.

---

14Children

OdoKeep is a vehicle logbook. It is not directed at children under 16, and accounts should not be created by them.

We do not knowingly process the data of a child under 16. If you believe a child has created an account, write to [email protected] and it will be deleted.

---

15Changes to This Policy

We may update this policy, for example if a feature changes or a new processor is added.

The current version is always published here with its "Last update" date. If a change is significant, we will make it visible in the app or by email before it takes effect. Continuing to use OdoKeep after a change does not replace a legal basis where one is required: where a change needs your consent, we will ask for it.

---

16Contact

For questions, requests or concerns about this Privacy Policy:

Data protection and legal: [email protected]

General support: [email protected]

Website: https://odokeep.com

OdoKeep is a service provided by Rafael Soares, Porto, Portugal.