Privacy Policy for Odometer

The Short Version

Odometer stores your logbook on your device. Free and Lifetime features require no account and do not upload your logbook for cloud storage. Usage analytics sends selected structured characteristics of your logbook and can be linked to your account when you are signed in. Analytics is on by default; you can stop it with Share analytics in Settings. This control does not stop crash reporting. We do not record session replays.

Premium adds cloud sync and AI Quick Capture through a signed-in account. Without a subscription, you can sign in from Settings, Danger zone, to delete an existing cloud account. GPS trips keep their route points on your device, and Premium backs them up with the trip. GPS trips can receive location updates in the background and while paused. Your device backups and exports are separate from Odometer cloud sync. This policy also covers analytics on odometerapp.com.

Introduction

This Privacy Policy explains how Odometer ("we," "our," or "us") collects, uses, and stores information when you use the Odometer iOS application (the "App") and odometerapp.com (the "Website").

Developer Information

Developer: Matves
App Name: Odometer
Platform: iOS
Contact: support@odometr.app

Information We Collect

Data You Create (stored on your device)

On every plan, the data you log is stored locally on your device. Free and Lifetime logbooks are not uploaded for cloud storage on those plans. Selected structured characteristics can be sent as analytics, as described below. Copies may also be included in your device backups or exports. Your logbook includes:

• Vehicle Information: Make, model, year, VIN, license plate, odometer readings, and other vehicle details
• Records: Fuel, service, repairs, expenses, costs, dates, line items, and notes
• Photos and Attachments: Images of your vehicle, receipts, documents, and other files you choose to attach. Each attachment can be up to 20 MB; the App refuses a larger file when you pick it.
• Reminders: Maintenance reminders and notification preferences
• Trips: Dates, times and time zone, vehicle, business or private type, purpose, notes, the start and destination names you type, the route points of GPS trips, distance, odometer readings, trip settings, and an optional name to print on your trip reports; and, stored locally without cloud sync, the latest location point of an unfinished GPS trip

Account Information

Free and Lifetime features require no account. An account is needed for Premium cloud sync and AI. Without a subscription, you can sign in from Settings, Danger zone, to delete an existing cloud account. When you sign in using Google Sign-In or Apple Sign-In, we receive the following account information:

• Name: Your display name from your authentication provider
• Email Address: Your email address associated with your account
• Account Identifier: A unique identifier used to link your account and sync your data

Opening the sign-in screen sends requests that carry no account data to our Apple and Google sign-in functions on Appwrite, so they are ready when you choose a provider. The current iOS sign-in flow does not send your Google profile picture to our backend. Cloud sync begins when an active subscriber signs in and completes any account-data confirmation. Analytics may be associated with your account while you are signed in, regardless of your plan.

Automatically Collected Information

• Usage Analytics: We use PostHog's EU service to collect pseudonymous usage data, including app opens, screen views, feature usage, device information, plan and purchase status, and selected structured characteristics of your logbook: vehicle make, year and engine type, record category, attachment counts, and approximate cost bands. Custom manufacturer and category text is recorded as "custom"; exact costs are grouped into bands. Events use an analytics identifier and are associated with your account identifier when you are signed in. Every app event includes an IP-derived approximate location: country and approximate coordinates, and, when available, city and postal code. IP anonymization is enabled, and no event stores your IP address. This approximate location is separate from the GPS points used to record a trip.
• Session Replay: We do not record session replays in the App or on the Website. Replay was turned off on September 29, 2026; masked replays recorded before then are deleted automatically within 30 days. Usage analytics is on by default. Turning off Share analytics in Settings stops it.
• Crash and Error Reports: We use Sentry and its features to collect and process crash reports and error logs to improve app stability. Reports may include the app version and build environment, the iOS version, the device model with its memory, battery and power state, the locale and time zone, an installation identifier and an app-device hash, operation details and technical error information. Sentry also works out an approximate location (city, region and country) from the IP address a report comes from. Our iOS crash reporting does not deliberately attach your account identity and sends reports to Sentry's EU endpoint. Error reports from our backend may include your account identifier and affected document identifiers. Share analytics does not disable crash reporting. Reports can also include diagnostics such as how long sign-in steps took, which part of a backup failed, and backup queue timings.
• Feedback: When you use Send feedback in Settings, the App sends your message to Sentry with the details the form lists before you send: the About choice, a reference, your plan, approximate counts of your cars, records and trips, the app version, the iOS version, the device model and, when available, the tab you opened Settings from and the App's navigation layout. The reply email field is filled in with your account email when you're signed in, and the email is sent unless you clear it. One screenshot is included only if you add it. Sentry adds the same technical context as to crash reports, including the approximate location it works out from your IP address. Feedback goes to Sentry's EU endpoint, where Sentry and its features process it for us. Share analytics does not affect feedback you choose to send. An unsent message is kept on your device until you send or discard it, or the account on the device changes. If Share analytics is on, analytics records that feedback was sent, its About choice, whether it included an email or a screenshot, and a message length range, not the message itself. If you choose Email us instead, your message and email address reach our support mailbox, where we keep the correspondence to answer you. To ask us to delete feedback, email support@odometr.app with its reference.
• AI Feature Data (Premium only): When you choose AI Quick Capture, selected images or PDFs, your description, and relevant app context, including available vehicle identifiers, names and odometer readings, categories, and currency, are sent through our Appwrite backend to Anthropic to extract the details and return the result. Appwrite stores extraction results or errors with your account identifier for delivery and recovery. The App attempts to remove these intermediate results when clearing a capture; failed cleanup can leave them stored. Saved records and attachments follow our normal storage rules. See Third-Party Services and Data Retention below.

Trips

If you use Trips to log drives, Odometer handles the following. None of it is used for advertising, and we don't sell it.

Location while a trip is recording. GPS trips use While Using the App location permission to measure distance. Odometer may ask for it during the introduction or when you start a GPS trip; allowing it during the introduction doesn't start a recording. Location updates may continue while Odometer is in the background or the phone is locked. Pausing stops distance accumulation and the displayed timer, but location updates currently continue until recording ends. While a GPS trip records, Odometer keeps its route points, the sequence of precise locations the trip passes through, with the trip on your device. For signed-in Premium subscribers, the route is backed up with the trip and linked to your account. Route points are kept so your trips, including past ones, can be shown on a map in a later version; this version doesn't display routes or download a backed-up route to another device. They are not used for analytics or advertising, and they are deleted when you delete the trip or your account. An unfinished GPS trip also keeps its latest location point locally for recovery until it is saved or discarded; that recovery point is excluded from device backups and cloud sync.

Places. The start and destination of a trip are plain names you type for that trip, such as "Home" or "Client office"; Odometer does not look them up from your location or keep a list of saved places. They are stored with the trip on your device, and for signed-in Premium subscribers they sync with the trip.

Odometer-only mode. You can log trips from your odometer readings instead. This mode does not request or use location for recording.

Motion & Fitness. If you allow it, Odometer reads the last seven days of your iPhone's motion activity, on your device, to suggest drives you may have forgotten to record and when an interrupted trip probably ended. Your motion history and unconfirmed suggestions stay on your device. The drives you choose to add become trips, including their motion-derived start and end times. These trips sync for signed-in Premium subscribers, as described under Trip records below. Local suggestion history includes drives shown or dismissed and any suggested distance. The App removes entries for drives that ended more than 30 days ago when its cleanup runs; entries may remain longer if the App does not run. This history is not sent to our servers. You can turn motion access off in iOS Settings under Privacy & Security, Motion & Fitness.

Odometer readings and the camera. You type odometer readings in yourself. The camera is used only when you choose it, for Quick Capture, attachments or vehicle photos.

Trip records. Each trip's date, times and time zone, vehicle identifier, name and plate, business or private type, purpose, notes, start and destination names, route points of GPS trips, distance, odometer readings and their sources, pause and recording-gap durations, how the trip ended and was recorded, linked reading identifier, and creation and update times are stored on your device. For signed-in Premium subscribers who have completed any account-data confirmation, these records and trip settings (including country, tax-year start, recording mode, saved purposes, a legacy default-vehicle value, work hours, and logbook periods and reading links) are also stored on our Appwrite servers in Frankfurt, Germany (EU), linked to your account. The recovery point of an unfinished trip, motion history and unconfirmed suggestions are not included in cloud sync.

Name on your reports. You can add a name to print on your trip reports. It is stored on your device, and for signed-in Premium subscribers it is backed up and synced with your account. It is deleted when you clear it in the App or delete your account.

Live Activities, widgets and controls. Widgets and Control Center controls use locally shared app data to show recording status and, where applicable, monthly business-distance summaries after recording ends. Shared data includes the vehicle name, trip type, month, country and monthly-limit status. Live Activities can show trip time, distance, vehicle and type on supported Apple system surfaces, including the Lock Screen, Dynamic Island and connected devices. Live Activity updates do not use an Odometer server connection.

Your device backups. Like the rest of your logbook, your trips, including their places and route points, may be included in your device backups (iCloud Backup or a computer backup) if you use them. The recovery location point is excluded. Exports can include places, vehicle plates, purposes, notes, times and readings, and PDFs can include your report name. Files you share are handled by the destination you choose.

Keeping and deleting trips. Saved trips remain until deleted. Deleting a trip removes its record and places from your device; for signed-in Premium subscribers, it also removes them from the cloud once the deletion syncs. Deleting a vehicle keeps its saved trips and their vehicle-name and plate snapshots, but removes the vehicle's associated records, readings and reminders. Later reports may lack reading and cost evidence. Export the reports you need before deleting a vehicle, and delete its trips separately if you want them removed. Account deletion and retained copies are described under Your Rights and Choices and Data Retention.

Analytics. If analytics is on, Odometer records which trip features you use, for example that a trip was started or saved, which recording mode was used, whether a suggested drive was added, that a report was exported, and how many trips you have logged when you reach a monthly limit. These events exclude route points and other GPS coordinates, places, purposes, notes and the name on your reports. Like other app events, they include IP-derived approximate location. Turning off Share analytics in Settings stops them.

Estimates. Business-use percentages and claim estimates are for your records only and are not tax, legal or financial advice.

How We Use Your Information

We use the information collected to:

• Provide and maintain the App's functionality
• Track and manage your vehicle records and maintenance history
• Measure trip distances and suggest missed drives, on your device
• Send you maintenance reminders as local notifications on your device
• Back up and sync your data across your devices (Premium only)
• Extract details from images, PDFs and descriptions when you choose AI Quick Capture (Premium only)
• Authenticate you when you sign in, including to delete an existing cloud account
• Understand how the App and Website are used so we can fix bugs and improve them
• Support account and product communications as described under Email Communications

Email Communications

Automated product and marketing email is not currently active. Our backend has a Loops integration for account and product communications. When enabled, it can send your name, email address, account identifier, plan status, vehicle and record counts, signup and first-vehicle dates, platform, signup source, and account or product event information to Loops to manage contacts and trigger emails. Signing in, rather than holding a subscription, is the account requirement for these requests.

Existing Loops contacts may remain even while automated email is inactive. Automated removal of Loops contacts during account deletion is currently unavailable, so contacts can remain after your Appwrite account has been deleted. Contact support@odometr.app about email preferences or contact deletion. See Loops' privacy policy.

Notifications

With your permission, the App shows notifications relevant to app functionality, such as maintenance reminders. They are local notifications, scheduled on your device. If you start a Premium free trial and notifications are on, the App schedules up to two local reminders at 9 a.m., two days before the trial ends and on its last day if the trial ends later than that; tapping one opens your Apple account's subscriptions. During your first week, the App may also schedule a few local prompts to add a car, record, reminder or trip you haven't added yet; they use details kept on your device, such as the selected car or record category. You can turn notifications off at any time in your device's notification settings, or pause all notifications from within the App's settings.

We do not store push-notification tokens or send remote notifications.

Website Analytics

On odometerapp.com, we use PostHog's EU service to understand visits and interactions with the Website. Website analytics runs in cookieless mode: it uses no cookies, local storage or session storage, and session replay is off. Analytics is sent only from odometerapp.com. Sign-in callback pages under /auth/ are excluded, and callback URLs appearing in analytics properties have their query strings removed. If you choose a light or dark theme on the Website, your browser saves that choice locally; it isn't sent to us.

We record page views and page leaves, App Store link clicks with the link's placement, support email link clicks, FAQ question opens, and changes between monthly and yearly pricing. Events include page addresses, referral and campaign information, event times, and browser and device information such as operating system, language, time zone, and screen and window size. In cookieless mode, PostHog counts visitors with a privacy-preserving hash calculated on its servers, and Website events currently do not include a location looked up from the IP address. IP anonymization is enabled in our PostHog project; events do not store IP addresses.

The App's Share analytics setting does not control Website analytics, and the Website has no separate analytics switch. Contact support@odometr.app to exercise applicable objection rights. The legal basis and retention criteria below also cover Website analytics.

Legal Basis for Processing

We process your information based on the following legal grounds:

• Contract Performance: We process account information to authenticate you and manage your account, and logbook and AI feature data to provide the Premium services you request.
• Legitimate Interest: We collect crash reports and pseudonymous analytics to maintain, secure and improve the App, and Website analytics to understand and improve the Website. Usage analytics in the App is on by default. You can stop it through Share analytics in Settings. This control does not disable crash reporting or Website analytics. Contact support@odometr.app to exercise applicable objection rights concerning diagnostic processing or Website analytics.

Data Storage and Security

On Your Device

On all plans, your vehicles, records, readings, reminders, photos, attachments, trips and settings are stored locally. The recovery point of an unfinished trip, motion history and unconfirmed suggestions are not part of cloud sync. Free and Lifetime logbooks are not uploaded for cloud storage on those plans, but selected structured analytics can be sent when Share analytics is on. Device backups and exports are separate, as described above.

Cloud Storage (Premium only)

When an active Premium subscriber signs in and completes any account-data confirmation, cloud sync stores a copy of their logbook (vehicles, records, reminders, readings, photos, attachments, trips with their route points and typed places, and trip settings, including the name on your reports) on Appwrite servers in Frankfurt, Germany (EU). Cloud sync also includes custom manufacturers, your custom record categories, units, currency, your choice to include archived vehicles in statistics, and, if you answered the setup questions of an earlier version, those answers. Data is encrypted in transit (HTTPS), and attachment files are encrypted at rest in storage. Account information is also stored in Appwrite and can remain after a subscription ends; account retention is separate from subscription status.

Third-Party Services

Appwrite: We use Appwrite in Frankfurt, Germany (EU), for accounts, Premium cloud sync and AI processing, and operational records. See https://appwrite.io/privacy

Google Sign-In: If you sign in with Google, authentication is processed through Google's OAuth 2.0 service. See https://policies.google.com/privacy

Apple Sign-In: If you sign in with Apple, authentication is processed through Apple's Sign in with Apple service. See https://www.apple.com/legal/privacy/

PostHog: We use PostHog's EU service for app analytics and for cookieless Website analytics. We do not use its session replay. See https://posthog.com/privacy

Sentry: We use Sentry and its features to receive and process crash reports, error reports and the feedback you send from the App, for the App and our backend. Sentry may use automated tools, including AI, to group and summarize reports. The iOS App sends reports and feedback to Sentry's EU endpoint; backend reports can contain account and document identifiers, as described above. See https://sentry.io/privacy/

Loops: Our email integration can send contact details, account properties and events to Loops for account and product communications, as described under Email Communications. Automated product and marketing email is currently inactive; existing contacts may remain. See https://loops.so/privacy

Anthropic (Premium only): When you choose AI Quick Capture, the images or PDFs, description and app context described above are sent through Appwrite to Anthropic's Claude API to extract the details and return the result. See Anthropic's privacy policy.

Apple (purchases): Purchases and subscriptions are processed by Apple through the App Store. We do not receive or store your payment details.

Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties.

We may share information only in the following circumstances:

• With Your Consent: When you explicitly authorize us to share specific information
• Service Providers: With the providers listed above (Appwrite, Google, Apple, PostHog, Sentry, Loops, and Anthropic) for the purposes described in this policy
• Legal Requirements: If required by law, court order, or governmental authority
• Safety and Security: To protect the rights, property, or safety of Odometer, our users, or others

Your Rights and Choices

You have the following rights regarding your data:

• Access: You can view your logbook in the App. Contact support@odometr.app to request access to other personal data we hold, or to exercise applicable correction, deletion, restriction, portability and objection rights.
• Export: You can export your records and trip reports as CSV and PDF, or all your data as one .zip file, for free on every plan
• Deletion: You can delete individual records in the App. Without Premium, open Settings, then Danger zone, and use Sign in to delete cloud account in the Cloud account section, then Delete cloud account. With Premium, sign in at the top of Settings, then use Delete account in Danger zone. Deleting a cloud account also deletes the data on this device. No subscription is required. Account deletion starts permanent removal with no 30-day cancellation period. When account deletion completes successfully, we remove your Appwrite account, logbook records and associated stored attachments. The App reports a failure if its deletion request fails. Deletion requests to analytics and email providers are handled separately and may take additional time or fail without blocking account deletion; contact support@odometr.app if you need help with provider erasure. Limited operational records remain as described below. Deletion does not remove copies you exported or retained in device backups, and it does not cancel an App Store subscription. Signed out, Delete account removes the logbook data on this device only; some app preferences, such as units and custom categories, stay on the device. Account deletion does not erase diagnostics or feedback already sent to Sentry; they expire under Sentry's retention period.
• Analytics Opt-Out: Turn off Share analytics in Settings to stop app usage analytics. This does not disable crash reporting or Website analytics, or delete data already collected.
• Notifications: You can pause or disable notifications in the App's settings or your device settings
• Account Management: You can sign out at any time, and revoke Odometer's access through your provider (Google: myaccount.google.com/permissions, Apple: Settings > Apple ID > Password & Security > Apps Using Apple ID)

Data Retention

Local data and copies. Saved logbook data is kept on your device until removed. The App attempts local cleanup after successful account deletion, but cleanup can fail and some local files may remain. Deleting your account or uninstalling the App does not remove copies in device backups or files you exported. Those copies are controlled separately by you and the services where you keep them.

Trip recovery. The latest usable GPS recovery point remains until the unfinished trip is successfully saved or discarded. Missed-drive history is pruned for drives older than 30 days when the App's cleanup runs.

Removed items. When you delete a car, record, reminder or trip, the App keeps a short note of it on your device: its name, or its category and date, the car it belonged to, and how and when it was removed, so a link to it can say what happened. These notes are not synced or sent. Each note is removed after 30 days when the App next runs, and Remove from This Device, switching accounts, clearing all data or deleting your account erases them all.

Accounts and cloud logbooks. Account information and previously synced logbook data remain until removed through record or account deletion; ending a subscription does not itself delete them. Successful account deletion removes the primary Appwrite account, logbook records, associated attachments and intermediate AI results. Provider cleanup and the operational records below are separate.

Analytics and error reports. App and Website event retention depends on our PostHog project settings and the need to understand usage and investigate product problems. Sentry keeps crash reports, error reports and feedback, including screenshots, for our plan's retention period, currently 30 days. Account-linked analytics erasure is a separate provider process; failed requests can require follow-up.

AI processing. Appwrite stores intermediate extraction results or errors for delivery and recovery until cleanup or account deletion succeeds. Cleanup attempts can fail, and we do not promise a fixed expiry. Function execution records are separate from saved results; their retention depends on backend configuration and operational needs for delivery, recovery and troubleshooting. Saved records and attachments follow the logbook rules above.

Email contacts. Existing Loops contact and event data may remain while email is inactive. Retention depends on contact-management needs, provider settings and successful deletion processing. Deleting the Appwrite account does not establish that the Loops contact has been erased. Emails you send us stay in our support mailbox for as long as we need them to answer you and keep a record of the request.

Operational records and backups. Anti-abuse records retain pseudonymous identity or account keys, usage counts and quota-window information so deleting and recreating an account does not reset limits. These keys can be derived from your sign-in provider identity. Older records are removed through bounded, best-effort cleanup when the relevant functions run. Backend logs, execution records and any retained service backups follow provider configuration and cleanup processes for troubleshooting, security and recovery; they are not covered by an immediate-deletion promise.

Children's Privacy

Odometer is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

International Users

Your information may be processed outside your country of residence. Our Appwrite backend is in Frankfurt, PostHog uses EU cloud, and iOS crash reports go to Sentry's EU endpoint. Other processing by the providers listed above may take place in other jurisdictions; those endpoints do not mean every provider processes all data only in the EU.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Last Updated" date above and, where appropriate, displaying a notice within the App. Your continued use of the App after any changes indicates your acceptance of the updated Privacy Policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: support@odometr.app
Developer: Matves

App Store Privacy Notes

Odometer does not track you across other companies' apps or websites, does not use the Advertising Identifier (IDFA), and shows no ads. Data collected to operate and improve the App is described above. Share analytics in Settings stops app analytics, but does not disable crash reporting or Website analytics.