AI ELM — Privacy Policy
Last updated: 2026-10-16
Who is responsible
The app is published by Netesa Oleksandr, who is the data controller. Contact for any privacy question: +48 453 457 668.
What stays on your phone
Diagnostic data read from the car, recordings, vehicle profiles (including the VIN) and app logs are kept on your phone. They are not sent anywhere unless you request an AI analysis, share a report yourself or sign in to an account (see below).
The app works without an internet connection. It needs Bluetooth, Wi‑Fi and, on some Android versions, location permission only to find and talk to the OBD adapter; your location is not read or stored.
What is sent to our server
Account. When you first use a paid feature, the app creates a random anonymous account. The server keeps a hash of its key, your credit balance and the history of its changes. We do not ask for your name or phone number, and ask for your e‑mail only if you sign in.
AI analysis. Only when you request it, the app sends the fault codes, engine parameters, vehicle data (VIN, make, model, year, engine) and the notes you typed. The server passes them to an AI provider (Groq or Google Gemini API) to produce the conclusion and does not store them.
Signing in (optional). Signing in lets you use your credits, subscription, vehicles and reports on all your devices. We store your e‑mail address and, if you sign in with Google or Apple, the account ID they give us. A sign-in code is sent to your e‑mail by Resend; we keep only its hash, for at most a day.
Synchronisation. While you are signed in, your vehicle profiles (including the VIN), the history of the engine control unit's software IDs and the reports you saved (fault codes, readings and AI conclusions) are stored on our server so that your other devices receive them. Recordings stay on the phone.
Promo code. If you enter a seller's code, it is stored with your account.
Purchases. Payments are handled by Google Play, the App Store or, on our website, by Stripe; we never see your card. We receive and store the purchase token or payment number, order number, product, amount and currency.
Advertising. Google AdMob shows banners on some screens of the free version (never on the gauges or while recording) and rewarded videos when you choose to watch one — for credits or to open an advanced feature. Subscribers see no ads. AdMob may collect device identifiers, including the advertising ID, and your IP address to show ads and, with your consent, to personalise them; on iPhone it asks for permission to track first. We store the fact that a video for credits was watched. You can change your consent in the app (Android: About → Ad privacy settings) and on iPhone in Settings → Privacy & Security → Tracking.
Technical logs. Our hosting provider records the IP address and time of requests for security, for a short period.
Crash reports. If the app crashes, or you press “Send to the developer” in its logs, Google Firebase Crashlytics receives the error, the app log of the last minutes, the device model, the system and app versions and a random installation ID. The log contains no VIN and no record of the exchange with the adapter.
Why we may process it
To provide what you asked for — the account, sign-in and synchronisation, the AI analysis, purchases (performance of a contract); your consent — personalised ads; our legitimate interest — security, fraud prevention and fixing crashes; a legal obligation — accounting records of payments.
Who receives it
Google (Google Play, AdMob, Gemini API, Firebase Crashlytics, Sign in with Google), Apple (App Store, Sign in with Apple), Groq (AI analysis), Stripe (payments on the website), Resend (sign-in letters), Vercel (hosting, Frankfurt) and Neon (database, Frankfurt). These providers may process data outside the European Economic Area under standard contractual clauses. We do not sell your data.
How long we keep it
Account data, your e‑mail and synchronised data — until you delete them. Sign-in codes — at most a day. Records of payments — for as long as tax and accounting law requires; after deletion they are no longer linked to your app.
Your rights and deleting your data
You may ask for access to your data, its correction, deletion, restriction or transfer, object to its processing, withdraw consent and complain to your data protection authority.
To delete what the server keeps: About → Delete my data. The balance, promo code, subscription link and watched videos are removed at once; if you are signed in, also your e‑mail, sign-in links and all synchronised data, on all your devices. This does not cancel a subscription: cancel it where you bought it. Signing out only disconnects this device. Data on the phone is removed by uninstalling the app.
Children
The app is not intended for children under 16.