Privacy Policy

Location Data

Odo accesses your device's GPS to measure your current speed, distance traveled, and route in real-time. This data is processed on your device and is not transmitted to our servers. There are three exceptions, all started by you: while you are in a Convoy, your current position is shared with its members (section 5); while an Emergency SOS you started is running, it is shared with the people you alert (section 6); and when you ask for directions, the start and end of the route are sent to the service that plans it (section 7). You may choose "While Using the App" or "Precise Location" based on your preference. Background access is what lets a trip keep recording with the screen locked, what lets the app start one for you automatically, and what keeps your position current for a convoy or an SOS while your phone is in your pocket.

• · Real-time GPS speed and heading
• · Distance traveled during a session
• · Maximum and average speed
• · Route data and elevation
• · Trip, fuel, and maintenance records you create in the app

Turning a coordinate into a street or a place name, searching for a place and planning a route are things the phone cannot do by itself. Section 7 explains where those requests go.

Permissions the App Asks For

Each one is requested only when you first use the feature that needs it, each can be refused, and each can be revoked later in iOS Settings. Refusing one disables that feature and nothing else.

Odo never asks for and never reads the contacts on your phone, your health or fitness records, your messages, your call history or your files. There is no code in the app that can. The separate list of Friends you add inside the app is described in section 4.

No Account, No Personal Information

Odo asks for no email, no account and no sign-up. The one exception is Friends, the optional feature described in section 4, which needs a sign-in so your profile can follow you to a new phone. Convoy and Emergency SOS, in sections 5 and 6, are built on the same profile. Unless you choose to join Friends, we do not know who you are, and we do not want to.

Local Device Storage

Your speed data, routes, trip history, fuel logs, maintenance records and OBD readings are stored on your device using Apple's secure iOS storage. Odo does not transmit any of this data to our servers.

iCloud Sync (Optional)

If you are signed in to iCloud, your data is synchronized privately across your own Apple devices through Apple's iCloud infrastructure, tied to your personal Apple Account. That includes your trips and logs, the photos and documents you attach, your saved places, the spots you ask navigation to avoid, the nicknames you give friends, and a record of the convoys you took part in. We never see, access, or receive this data. To stop syncing, turn the app off under Settings > [your name] > iCloud.

Friends Data (Optional)

If you create a Friends profile, the small amount of data that feature needs is stored on our servers rather than in your iCloud, because other people have to be able to see part of it. Section 4 lists exactly what that is, who can see it, and how to remove it.

Convoy Data (Optional)

While you are in a convoy, your latest position and the convoy's details are held on our servers so the other members can see them. Section 5 lists exactly what that is and when it is deleted. Nothing is kept once the convoy ends.

Emergency SOS Data (Optional)

While an alert you started is running, your latest position and the alert's details are held on our servers so the people you alerted can see them. Section 6 lists exactly what that is and when it is deleted. Nothing is kept beyond a day after the alert ends.

Device Security

Your data is protected by Apple's built-in iOS device encryption and is secured by your device passcode and Face ID / Touch ID. iCloud data is protected by Apple's end-to-end security. Data we hold for Friends, Convoy and Emergency SOS is encrypted in transit and at rest.

What We Upload

Your display name, your username, your profile photo if you add one, and the date you joined. Then, for each day you drive: distance, time moving, total time including stops, number of trips, your longest trip distance and duration, elevation climbed, and your top speed. We also store an all-time rollup of those same totals, your friend list, your block list, and a notification token for each device you sign in on, together with that device's language so notifications arrive in the right one.

Who Can See It

Your display name, username and photo are visible to anyone signed in to Odo, because that is what makes it possible to find you by username. Your driving numbers are visible only to people you have added and who have added you back. Sending or receiving a friend request on its own reveals no numbers to anyone.

What We Never Upload

Friends uploads totals, not journeys. None of the following ever reaches our servers, whether or not you use Friends. The exceptions are your live position during a convoy you join, described in section 5, and during an Emergency SOS you start, described in section 6.

• · Routes, GPS coordinates and elevation traces
• · Addresses, place names and saved places, other than a meeting point you choose for a convoy
• · Individual trips, or the times of day you drove
• · Vehicles, VIN numbers and OBD data
• · Fuel, maintenance and expense records
• · Trips imported from GPX or CSV files, which never count towards Friends totals
• · The private nicknames you give friends, which stay on your device

Sign in with Apple

Friends uses Sign in with Apple, so your profile survives a new phone. We ask Apple for nothing beyond a sign-in token, so we never receive your name or your email address, not even a private relay address. Your display name is whatever you type when you create your profile.

Where It Is Stored

Friends data is stored with Google Firebase (Authentication, Firestore, Cloud Storage, Cloud Messaging and Cloud Functions) on servers in the United States. Google processes it on our instructions and does not use it for its own purposes. If you are in the United Kingdom, the European Economic Area or Switzerland, this means your Friends data is transferred to the United States, which Google covers through its Standard Contractual Clauses.

Proving the App Is Genuine

Requests to our Friends servers carry an App Attest token issued by Apple, which proves the request comes from a real copy of Odo on real Apple hardware. Without it, anyone with a single account could script their way through a dictionary of usernames and scrape the names and photos attached to them. The token identifies the app and the device, never you, and it says nothing about your driving. Google verifies it on our behalf as part of Firebase App Check.

Profile Photos

A photo you choose is cropped and re-encoded on your device before anything is uploaded, which strips the original file's metadata, including any location the camera recorded. Only the small square version reaches our servers. It is visible to anyone signed in to the app, so choose accordingly. Removing your photo removes it from our servers.

Notifications

We send a notification when someone sends you a friend request and when someone accepts yours, for the convoy events described in section 5, and for the Emergency SOS alerts described in section 6. Delivery goes through Firebase Cloud Messaging and Apple's Push Notification service. Turning notifications off in iOS Settings stops them, and signing out removes that device's registration.

Invite Links

An invite link looks like invite.speedometerproapp.com/friends?u=yourname. Opening one creates an ordinary web server log entry containing an IP address, a timestamp and the username in the link. This applies to anyone who opens an invite, including people who do not have the app.

How Long We Keep It

Your app publishes daily totals for every month you have driven, so the charts your friends see can go back as far as your history does, plus an all-time rollup. They are kept for as long as your profile exists, and we do not delete them on any other schedule. Pausing sharing removes your published totals straight away, and deleting your account removes everything.

Pausing

Pause sharing, in the Friends profile screen, deletes the totals already published from our servers and stops uploading new ones. Your profile, your friend list and your own history in the app are left alone, and you can unpause whenever you like.

Signing Out

Signing out removes that device's notification registration. It does not delete your profile or your published totals, which is what lets you sign back in on a new phone and pick up where you left off.

Deleting Your Friends Account

Open the Friends tab, tap your profile picture, choose Edit profile, then Delete account. We ask you to confirm with Apple first. We then delete your profile, your photo, both sides of every friendship, all published totals, your device registrations and your block list, remove you from every convoy and withdraw your invitations, delete any Emergency SOS alert you started, and we release your username. A background job finishes any remainder within 24 hours. Your trips and everything else in the app stay on your device and are not touched.

Usernames

A username cannot be changed once chosen. When an account is deleted, its username returns to the pool, so somebody else may later take a name you used to have.

Blocking and Reporting

You can block anyone from their profile. A blocked person cannot send you a request, cannot see your numbers, and is not told they were blocked. If a display name, username or photo is offensive, use Report on the same menu, or on a friend request before you accept it. Report opens an email to support with the reported username, the reason you picked and your own username already filled in, so all you do is send it. Because it arrives as an email we see the address you send from, and we use it only to deal with that report. We read reports within 24 hours and remove profiles that break the rules. The person reported is never told, and never learns who reported them.

Age Requirement

You must be at least 16 years old to create a Friends profile. The rest of the app has no age requirement. If we learn that a profile belongs to someone under 16, we delete it.

What We Upload

While a convoy you belong to is running, your app sends your current position, how accurate it is, the direction you are heading, and whether you are driving, stopped or have arrived. Your speed is included only if the person who created the convoy turned speed sharing on. The convoy itself holds its name, start time and length, the members and people invited, an optional meeting point chosen by its creator, and each member's notification choices.

When It Is Sent

Only from 30 minutes before the convoy's start time until it ends. While you are moving, the app sends an update about every 10 seconds once you have travelled at least 50 metres, plus one whenever you stop, start or arrive. While you are parked it checks in about once a minute so the others can tell you are still connected. If you have allowed location access "Always", the app can wake itself when you start moving so your position stays current with your phone locked. Outside a convoy, none of this happens.

Who Can See It

Only the people who have joined that convoy. Someone who has been invited but has not joined can see the convoy's name, time, meeting point and who is in it, but not where anyone is. Your position is never shown to friends outside the convoy, and never to anyone in Friends generally.

No Trail Is Kept

Each update replaces the one before it, so our servers only ever hold your latest position, never the path you drove. Leaving a convoy deletes your position immediately.

When It Is Deleted

Everything about a convoy, including every member's last position, is deleted when it ends: when its creator ends it, when its time runs out (24 hours at most), when nobody has moved for 3 hours, or when nobody has joined within an hour of its start. Two small things outlive a convoy. To stop abuse we keep a daily count of how many convoy actions your account performed, with no locations in it, until you delete your Friends account. Our server logs record your account ID and the convoy's ID, not your position, and Google keeps them for 30 days.

Your Convoy History

The app keeps a record of each convoy you took part in, with its name, the members' display names and when it ran, but no locations. It is stored on your device and in your own iCloud, like your trips, and you can delete it in the app.

Notifications

Convoys send notifications for an invitation, when someone joins, shortly before a scheduled convoy starts, shortly before it ends, and, if the creator asks for them, when members arrive. Invitations and joins include the other person's display name. Delivery uses Firebase Cloud Messaging and Apple's Push Notification service, as in section 4.

Walkie-Talkie Messages (Beta)

The walkie-talkie is off unless the convoy's creator turns it on. When it is on, you can hold the talk button to record a voice message of up to 30 seconds. The microphone records only while you hold the button, in the app or in the system's walkie-talkie controls. The message is uploaded to our servers and sent only to the other members of that convoy, who hear it on their phones. Nobody outside the convoy can receive it. We do not listen to, transcribe or analyse messages. Each one is deleted when the convoy ends, and an automatic rule deletes any that remain after two days.

How Messages Are Delivered

Each device that turns the walkie-talkie on registers an Apple Push to Talk address with the convoy, so messages reach it even when the app is closed, along with a flag that tells the other members whether you can currently hear messages. Delivery goes through Apple's Push to Talk service. The address and the flag are deleted when you turn the walkie-talkie off, leave the convoy, sign out, or the convoy ends. Our server logs record the convoy's ID, the message's ID and how many devices it was sent to, never what was said.

Where It Is Stored

Convoy data is held in Google Firebase (Realtime Database, Cloud Storage for walkie-talkie messages, and Cloud Functions) on servers in the United States, under the same terms as Friends data in section 4.

When It Applies

You turn on the SOS button in Settings, and it then appears on the speedometer, the live map and the convoy screen. You start an alert by holding it, with a few seconds to cancel. The alert runs until you mark yourself safe, or for 6 hours at most.

What We Upload

When you start an alert, your app sends your current position and how accurate it is, your phone's battery level, and which of your friends you chose as emergency contacts. Our server adds your display name and, if your Friends profile has one, the link to your profile photo. While the alert runs your phone keeps sending your latest position and battery level, every 3 to 5 seconds while you are moving and about every 20 seconds while you are still, and tells our server whether it is connected, so the page can say when updates have paused. Each update replaces the one before it, so our servers hold only your latest position, never the path you took.

Who Is Alerted

Up to ten emergency contacts you choose. Friends in the app receive a notification with your display name and the link, as long as you are still friends and neither of you has blocked the other. If you are in a convoy whose creator turned on Convoy SOS, everyone in that convoy is alerted too, except anyone either of you has blocked, and sees you marked on the convoy map. The people you alert in the app also see your SOS there, as a banner and a mark on your name, until it ends, even if they missed the notification; to show it, our server keeps the list of who was alerted for as long as the alert runs. You can send the notification again, up to 5 times per alert, and a reminder skips anyone who has since stopped being your friend or blocked you. Contacts from your phone are never contacted by us: the app opens Messages with your message and the link already written, and you send it yourself. Their names and phone numbers, and your message, stay on your device.

Who Can See the Link

The link opens a web page that shows your display name, your profile photo (or your initial, if you have no photo), your position on a map, how accurate it is, your battery level, when it was last updated and whether your phone is currently connected. Anyone who has the link can open it without signing in, so a contact can forward it to someone who can help. The link contains a random 128-bit code that cannot be guessed, and it is not listed or searchable anywhere. The page draws its map with Mapbox in the viewer's browser, so Mapbox receives the map area being viewed, not who you are.

When It Ends and Is Deleted

When you mark yourself safe, your position is deleted at once, the people alerted are told, and the link then says only that you checked in as safe. If the 6 hours run out first, your last position is kept, because that is where anyone looking for you would start: the people alerted are told, and the page shows it as where you were last seen. Either way, the list of who was alerted is removed when the alert ends, and everything else about it is deleted a day later. Deleting your Friends account deletes it all at once.

Limits and Logs

To prevent misuse, an account can start 3 alerts an hour, so we keep the times of your recent alerts, with no location, until you delete your Friends account. Our server logs record your account ID and how many people were alerted, never your position or your message, and Google keeps them for 30 days.

On Your Phone

Your emergency contacts and your message are stored only on your device. While an alert runs, and after it ends, the phone that sent it shows nothing about it on its Lock Screen, in case the phone is lost or taken. So that the alert can carry on if the app is closed, your phone asks iOS to watch a small area, about 100 metres, around your last position; iOS wakes the app when you leave it. That happens on your device through Apple's location services and sends nothing to us.

Where It Is Stored

SOS data is held in Google Firebase (Realtime Database and Cloud Functions) on servers in the United States, under the same terms as Friends data in section 4. The page and its data are served through Firebase Hosting, whose network may keep a copy of the page's data for up to 30 seconds so that several people watching share one request.

Starting a Live Activity for an Automatic Trip

When a trip starts by itself while the app is in the background, iOS refuses to let the app create its own Live Activity. To show one anyway, the app asks a small relay we run to send the request through Apple's push service instead. The relay receives your device's push-to-start token and the opening values of the Live Activity: your speed, distance and time so far, your chosen units, and any engine readings or next turn you have set the card to show. It never receives your coordinates or your route. It forwards the request straight to Apple and keeps no record of your trips. Its host, Cloudflare, keeps ordinary short-lived request logs.

Turn-by-Turn Navigation

When you ask for directions, the app sends your starting point (normally where you are), your destination, and your route options to Apple, which plans most routes. Where Apple has no directions, where you prefer OpenStreetMap routes, or where a route must avoid a spot you marked, the request goes to Mapbox instead, with your heading and the spots to avoid. Rerouting during a drive sends a new request from where you are. Mapbox receives no account, name or ID of yours, only the app's shared public key, and handles the request under its own privacy policy. We never see these requests and we do not store the routes. Navigation does not record a trip, and the spots you avoid sync only through your own iCloud.

Place Names, Search and Maps

Naming the start and end of a trip, naming roads during navigation, searching for a destination or a saved place, finding the fuel station you are standing at when you log a fill-up, and drawing the maps in the app all use Apple's own Core Location and MapKit services. Those requests send the coordinate, the map area or the search term to Apple, which handles it under Apple's privacy policy rather than ours. We never see them, and the app caches the answers on your device so the same place is not looked up twice.

Voice Search

When you tap the microphone button to say a destination, the app listens until you stop talking, for 15 seconds at most, and passes the audio to Apple's speech recognition, which returns the words. To help it spell your places correctly, the app also passes the names of your saved places and recent destinations. Depending on your language and device, Apple transcribes the audio on your iPhone or on its servers, under Apple's privacy policy rather than ours. The words then become a place search as described above. The audio never reaches our servers, the app does not save it, and the microphone is off at all other times.

Decoding a VIN

If you enter a VIN, or the app reads one from your OBD adapter, it looks it up in vPIC, the free public vehicle database run by the United States National Highway Traffic Safety Administration, to fill in year, make and model. Only the VIN is sent. There is no account, no key and nothing identifying you or your location, and if the lookup fails the app simply leaves the fields alone.

Checking for an App Update

The app asks Apple's public iTunes lookup endpoint which version is currently on the App Store, so it can tell you an update is available. Only the app's own App Store ID is sent.

Purchases

Premium is sold by Apple through the App Store. Apple handles the payment and tells the app only whether a subscription is currently active. We never see your card details, your Apple ID or your billing address, and we operate no payment server of our own.

Links That Open Elsewhere

Some buttons deliberately leave the app: looking up a diagnostic trouble code opens a web search, opening a fuel station, an address or where you parked hands it to Apple Maps or Google Maps, and the support, Reddit and Instagram links open those sites. Following one is the same as typing it yourself, and what happens next is governed by that site's own policy.

Files You Export or Share

Sharing a trip, an image, a video, a document or an export sends it to the app you pick, and nowhere else. If you turn on automatic trip export, the app saves each new trip as a file in the folder you chose, which may be in iCloud Drive or another storage service you use. Shared trip images, videos and route files can hide where you started and ended if you turn that on. Sending a support email or an OBD diagnostic report from the app includes your app version, iOS version and device model, and the diagnostic report also includes your adapter's details, your VIN and its connection log.

Done on Your Device

AI trip insights use the language model built into iOS and run entirely on your iPhone. Reading a fuel pump display and Picture in Picture also run on your device. None of them sends anything anywhere.

Fully Offline

Speed, distance, route recording, trip logging, fuel and maintenance records and OBD readings all work with no network at all. If you never connect, none of the connections above ever happens, and the app still does its job.

What It Is

Odo uses Google Analytics for Firebase to count how many people install the app, open it, and reach each screen. It exists so we know which features are worth building on and which updates broke something, and that is the whole of its purpose.

What It Sees

A random app instance ID that Google generates on your device, the fact that a screen was opened, your device model, your iOS version, your language, and an approximate country or city that Google derives from your IP address and then discards. If a walkie-talkie message fails to send or play, it also receives a short error report: a code, the step that failed, the kind of error, and whether CarPlay was in use. Never the message itself or anything about who sent it. Deleting the app resets the random ID.

What It Never Sees

Your GPS location, your speed, your routes, your trips, your vehicles, your OBD readings, your fuel or maintenance logs, your photos, and your Friends profile. Nothing you type into the app is sent to it, and its random ID is not linked to your Friends account.

No Advertising Identifier

The app does not use Apple's advertising identifier, does not ask for App Tracking Transparency permission, and does not carry an ad network. Nothing it collects is used to follow you into another app or website, which is why the App Store lists no data as used to track you.

Why the Label Also Says Marketing

We pay to advertise Odo, and the same anonymous counts tell us whether one of our own campaigns actually led to installs. Apple's label form calls that purpose "Developer's Advertising or Marketing", which is why it appears on our listing next to "Analytics" for the same four items. It means we measure our own advertising. It does not mean we show you ads inside the app, build a profile of you, or pass anything to an ad network or a data broker.

We Never Sell Your Data

We do not sell or rent your data, and we do not share it for advertising of any kind. We do not transmit your speed, routes or trip history to any third party. Your location leaves your device only to plan a route you asked for (section 7) to show your position to a convoy you joined (section 5), and to show it to the people you alert during an Emergency SOS (section 6).

Service Providers

Apple provides Sign in with Apple, iCloud sync, maps and address lookups, push delivery including Push to Talk, App Attest and App Store purchases. Google provides Firebase, which stores Friends data and, separately, counts anonymous installs and usage. Firebase also holds convoy and Emergency SOS data. Mapbox plans routes where Apple cannot, as described in section 7, and draws the map on the Emergency SOS page (section 6). Cloudflare hosts the small relay described in section 7. The United States National Highway Traffic Safety Administration runs the public VIN database. Each acts on our instructions or, in Apple's, Mapbox's and NHTSA's case, under their own published terms. Nobody else receives anything.

Other Users

If you use Friends, the parts of your profile and totals described in section 4 are visible to other people using the app. If you join a convoy, your position, and any walkie-talkie message you send, reach its members while it runs, as described in section 5. If you start an Emergency SOS, your position reaches the people you alert, and anyone they share the link with, until it ends, as described in section 6. That is the purpose of these features, they are opt-in, and pausing, leaving, marking yourself safe or deleting your account withdraws them.

Legal Requests

We would disclose data only if we were legally required to. In practice the only data we hold is what a Friends profile contains, plus the details of any convoy that is running right now, including walkie-talkie messages not yet deleted, and any Emergency SOS alert from the last day, and we hold nothing at all about anyone who has not created a profile.

Control Your Data

You have complete control over what data Odo can access. You can grant or revoke location permissions at any time in Settings > Privacy & Security > Location Services, and every other permission listed in section 1 in the same place. You can leave a convoy at any time, which stops sharing your position and deletes it from our servers. Marking yourself safe ends an Emergency SOS at once and deletes your position from our servers.

Delete Your Data

To delete all Odo data from your device, simply delete the app. To also remove synced data from iCloud, go to Settings > [your name] > iCloud > Manage Account Storage > Odo and delete the data there. Inside the app, Settings > Data & Sync > Data Management can also delete everything, or just a chosen date range through Delete Trips & Data, without removing the app.

Delete Your Friends Account

If you created a Friends profile, deleting the app does not delete it, because it lives on our servers rather than on your device. Deleting it also removes you from any convoy. Delete it from inside the app first: Friends tab, your profile picture, Edit profile, Delete account. If the app is already gone, email [email protected] with your username and we will delete it for you.

Access, Correction and Portability

If you have a Friends profile you can ask for a copy of what we hold, ask us to correct it, or ask us to delete it, by emailing [email protected] with your username. Because we never collect an email address, we may ask you to confirm the request from inside the app so that nobody else can make it on your behalf. If you are in the EEA, the UK or Switzerland these are your rights under the GDPR, and you may also complain to your local supervisory authority. If you are in California, we do not sell or share personal information as those terms are defined by the CCPA.

Opting Out of Analytics

We would rather be straight with you than point you at a setting that does nothing. The usage counts in section 8 carry nothing that identifies you, and there is currently no switch in the app to turn them off. iOS tracking controls do not affect them either, because they are not tracking in the sense those controls govern. If you would like an in-app switch, email us and say so; enough requests and we will build one.