Privacy Policy
Application: OBDY
Effective Date: May 28, 2026
Controller: OBDY
Contact: go@obdy.app
1. Introduction
OBDY ("we," "us," or "our") operates the OBDY mobile application (the "Application"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have regarding your personal data.
This Policy applies to all users of the OBDY mobile application on iOS and Android platforms and complies with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and applicable Lithuanian data protection law.
By creating an account or using the Application, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the Application.
2. Data Controller
The data controller responsible for your personal data is:
OBDY
Email: go@obdy.app
3. Information We Collect
We collect the following categories of personal data:
3.1 Account Information
When you create an account, we collect:
- Full name
- Email address
- Password (stored in hashed form; we never store your plain-text password)
- Authentication provider information, if you use social login (Google, Apple, or Facebook)
- Authentication session tokens
3.2 Vehicle Information
When you add a vehicle to your profile, we collect:
- Vehicle Identification Number (VIN)
- Vehicle manufacturer, model, and model year
- Fuel type (Diesel, Petrol, Electric, LPG, or other)
- Engine power output (kilowatts)
VIN data is transmitted to the AutoRef vehicle catalog service solely for the purpose of resolving your vehicle's specifications. See Section 6 (Data Sharing) for details.
3.3 Vehicle Diagnostic Data
When the Application is connected to your vehicle via an OBD2 Bluetooth dongle, we collect and store:
- Diagnostic Trouble Codes (DTCs): fault code identifiers, source protocol (OBD-II or UDS), severity level, active/resolved status, and timestamps (first detected, last detected, resolved)
- Maintenance records: most recent oil change odometer reading (kilometres)
- Selected vehicle data summaries derived from live readings, such as recent or average values for supported parameters where available. These may include RPM, speed, fuel level, coolant temperature, throttle position, and similar read-only values reported by the vehicle and dongle.
Real-time engine parameters are used to display live data in the Application. We may also store selected snapshots, averages, summaries, or diagnostic context from those readings to support vehicle history, engine health views, AI-generated suggestions, and AI Co-pilot responses. We do not use this data to control, modify, repair, tune, clear faults, or otherwise change your vehicle.
3.4 Bluetooth Device Information
When you pair an OBD2 dongle with the Application, we store:
- The Bluetooth device identifier (MAC address)
- A user-defined display name for the device
3.5 Location Data
The Application requests access to your device's location (foreground only) to provide the following nearby services:
- Fuel station prices and locations (within 30 km)
- Electric vehicle (EV) charging station locations and availability (within 30 km)
- Road weather and traffic conditions (within 30 km)
Your location coordinates are not persistently stored on our servers. Location data is used in real-time to query nearby information and is discarded from our systems within two (2) minutes. You may deny or revoke location permission at any time in your device settings; doing so will disable location-based features.
3.6 AI Co-pilot Data
The Application includes an AI Co-pilot feature powered by Google Gemini. When you use AI Co-pilot, we collect and process:
- Text messages: The full content of your conversations with the AI, including both your messages and AI responses. Message history is persistently stored to allow you to continue past conversations.
- Images: Photographs you choose to send within the AI Co-pilot (JPEG format, maximum 600 KB per image, maximum 2 images per message, maximum 8 images per conversation). Images are stored in our secure cloud storage.
- Voice recordings: When you use the voice dictation feature, your device microphone records an audio clip. This audio is transmitted securely to Google Gemini for transcription into text. The resulting transcript is stored as a text message in the conversation. The audio recording itself is discarded immediately after transcription and is not retained by us.
- Conversation metadata: Conversation titles (automatically generated by AI), date and time of last message, and the vehicle context associated with the conversation (if any).
- Vehicle context used for AI: When you use AI Co-pilot or AI suggestion features, we may use stored vehicle profile data, DTCs, maintenance records, selected live-data summaries, scan history, and related diagnostic context to make responses more relevant to your vehicle.
Use of the AI Co-pilot and its associated camera, microphone, and photo library access is optional. You can use the core vehicle diagnostics features of the Application without enabling AI Co-pilot. If you use AI Co-pilot or AI suggestions, relevant vehicle and diagnostic context may be included in prompts sent to the AI provider so the AI can generate vehicle-specific guidance.
3.7 Technical and Log Data
The Application generates internal diagnostic logs to support debugging and error resolution. These logs contain event types, timestamps, and technical status codes. Logs do not contain the content of your messages, vehicle location, or personally identifiable information. Log data is stored locally on your device and is not systematically transmitted to our servers.
4. How and Why We Use Your Data
We use your personal data for the following purposes, each with its corresponding legal basis under GDPR Article 6:
| Purpose | Legal Basis |
|---|---|
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Displaying vehicle diagnostics and maintenance data | Performance of a contract (Art. 6(1)(b)) |
| Pairing and communicating with your OBD2 dongle | Performance of a contract (Art. 6(1)(b)) |
| Resolving your VIN to vehicle specifications | Performance of a contract (Art. 6(1)(b)) |
| Storing selected vehicle data summaries and diagnostic history for vehicle history, engine health, and AI suggestions | Performance of a contract (Art. 6(1)(b)) and consent for AI-related use (Art. 6(1)(a)) |
| Providing nearby fuel, EV, weather, and road data using location | Legitimate interest (Art. 6(1)(f)) |
| Operating the AI Co-pilot (processing text, images, and voice) | Consent (Art. 6(1)(a)) |
| Ensuring the security and integrity of the service | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
Where we process your data on the basis of consent (AI Co-pilot features), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. You may withdraw consent by disabling AI Co-pilot in the Application settings or by contacting us at go@obdy.app.
5. AI Co-pilot and Automated Processing
5.1 AI Provider
The AI Co-pilot feature is powered by Google Gemini, a generative AI service provided by Google LLC. Your text messages, images, and voice transcriptions submitted to AI Co-pilot are processed by Google's infrastructure in accordance with Google's terms and privacy policies.
5.2 Nature of AI Processing
- Text messages and images you send to AI Co-pilot are transmitted to the Google Gemini API to generate responses.
- Voice recordings are transmitted to the Google Gemini API for speech-to-text transcription only. The audio file is deleted immediately after transcription is complete.
- Stored vehicle profile data, DTCs, maintenance records, selected live-data summaries, scan history, and related diagnostic context may be included in AI Co-pilot prompts or AI suggestion prompts when needed to provide vehicle-specific responses.
- AI-generated conversation titles are created automatically based on the content of the initial message.
5.3 No Automated Decision-Making with Legal Effects
We do not use your personal data for automated decision-making that produces legal effects or similarly significantly affects you, as described in GDPR Article 22.
5.4 Accuracy of AI Outputs
AI Co-pilot responses are informational in nature and may be inaccurate, incomplete, or inapplicable to your specific vehicle. Do not rely on AI Co-pilot outputs as a substitute for professional mechanical inspection or diagnosis.
6. Data Sharing and Sub-Processors
We do not sell your personal data to third parties. We share data only with the following categories of recipients, each acting as a data processor under our instructions:
| Processor | Role | Data Shared |
|---|---|---|
| Supabase, Inc. | Database, authentication, file storage, and backend functions | Account data, vehicle data, diagnostic data, AI conversations, AI image attachments |
| Google LLC (Gemini API) | AI text, image, voice, and suggestion processing | AI Co-pilot messages, images, voice audio for transcription, vehicle profile context, DTCs, maintenance records, selected live-data summaries, scan history, and related diagnostic context when needed for AI responses |
AutoRef (api-gateway.autoref.eu) |
Vehicle catalog lookup | VIN (for vehicle resolution only) |
| OpenWeather | Weather data fallback | No personal data; location coordinates sent as API query parameters |
| Google LLC (OAuth) | Social login (if selected) | Authentication tokens |
| Apple Inc. (OAuth) | Social login (if selected) | Authentication tokens |
| Meta Platforms (Facebook OAuth) | Social login (if selected) | Authentication tokens |
We require all processors to handle your data in accordance with GDPR and to implement appropriate technical and organisational security measures.
7. International Data Transfers
Some of our processors, including Supabase, Inc. and Google LLC, may process your personal data outside the European Economic Area (EEA). Where such transfers occur, we ensure they are protected by one or more of the following safeguards:
- Adequacy decisions issued by the European Commission; or
- Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Article 46(2)(c).
You may obtain further information about the safeguards in place for international transfers by contacting us at go@obdy.app.
8. Data Retention
We retain personal data for as long as necessary to fulfil the purposes described in this Policy, subject to the following specific retention periods:
| Data Category | Retention Period |
|---|---|
| Account information (name, email) | Until account deletion |
| Vehicle profiles and specifications | Until account deletion or manual vehicle removal |
| Diagnostic trouble codes | Until resolved by the vehicle system or account deletion |
| Maintenance records | Until account deletion |
| Selected vehicle data summaries and diagnostic context used for AI suggestions | Until account deletion, manual vehicle removal, or replacement by newer summaries |
| Bluetooth device identifiers | Until removed by user or account deletion |
| Location data | Not retained; discarded within 2 minutes of use |
| AI Co-pilot conversation history | Until user deletes the conversation or account deletion |
| AI Co-pilot image attachments | Until conversation deletion or account deletion |
| Voice audio recordings | Not retained; discarded immediately after transcription |
Upon account deletion (available in the Application under Settings), all personal data associated with your account is permanently and irreversibly deleted from our systems.
9. Your Rights Under GDPR
As a data subject under the GDPR, you have the following rights:
9.1 Right of Access (Art. 15)
You have the right to obtain confirmation of whether we process personal data about you and, if so, to receive a copy of that data.
9.2 Right to Rectification (Art. 16)
You have the right to request the correction of inaccurate or incomplete personal data.
9.3 Right to Erasure (Art. 17)
You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where processing is unlawful. You may delete your account directly within the Application (Settings → Account → Delete Account), which permanently erases all your data.
9.4 Right to Restriction of Processing (Art. 18)
You have the right to request that we restrict the processing of your personal data in certain circumstances (e.g., while contesting accuracy or pending an objection).
9.5 Right to Data Portability (Art. 20)
You have the right to receive personal data you have provided to us in a structured, commonly used, machine-readable format, and to transmit it to another controller, where technically feasible.
9.6 Right to Object (Art. 21)
You have the right to object to processing of your personal data carried out on the basis of legitimate interest. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
9.7 Right to Withdraw Consent (Art. 7(3))
Where processing is based on your consent (AI Co-pilot features), you may withdraw consent at any time without affecting the lawfulness of prior processing.
9.8 Right to Lodge a Complaint
You have the right to lodge a complaint with the data protection supervisory authority in your Member State.
To exercise any of the above rights, please contact us at go@obdy.app. We will respond within 30 days of receipt of your request.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure, including:
- All data transmitted between the Application and our servers is encrypted using Transport Layer Security (TLS/HTTPS).
- User passwords are stored exclusively in hashed form using industry-standard algorithms; we never store plain-text passwords.
- Authentication credentials and session tokens on your device are stored in the device's secure enclave (hardware-backed secure storage).
- All database tables implement row-level security policies, ensuring each user can only access their own data.
- AI image attachments are stored with access controls that restrict retrieval to the authenticated account owner.
While we take every reasonable precaution, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.
11. Children's Privacy
The Application is not directed at children under the age of 16. We do not knowingly collect personal data from persons under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at go@obdy.app and we will take prompt steps to delete such data.
12. Device Permissions
The Application requests the following device permissions. You may grant or revoke these permissions at any time through your device's operating system settings.
| Permission | Purpose | Effect of Denial |
|---|---|---|
| Bluetooth | Communicate with your OBD2 dongle | Core diagnostics features unavailable |
| Location (foreground) | Display nearby fuel stations, EV chargers, road/weather data | Location-based features unavailable |
| Camera | Send diagnostic photos to AI Co-pilot | Image capture in AI Co-pilot unavailable |
| Microphone | Voice dictation for AI Co-pilot messages | Voice input in AI Co-pilot unavailable |
| Photo Library | Attach existing photos to AI Co-pilot messages | Gallery attachment in AI Co-pilot unavailable |
13. Third-Party Links and Services
The Application may display information sourced from third-party open data providers (road authorities, weather services, fuel price registries). We are not responsible for the privacy practices of those third-party sources. Their data is accessed server-side by our backend; your device does not connect directly to those sources.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Application's features. When we make material changes, we will update the "Effective Date" at the top of this Policy. Continued use of the Application after the updated Effective Date constitutes your acknowledgement of the revised Policy.
For significant changes affecting your rights or how we use your data, we will notify you through the Application or by email.
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:
Email: go@obdy.app
We are committed to resolving complaints promptly and will respond within 30 days.