Privacy Policy for Autozond

Effective 24 August 2026.

Autozond is a car diagnostics app that talks to your vehicle through an ELM327 (OBD-II) adapter. Everything the app collects, where it goes and how to delete it is listed below. If anything here is unclear, write to us — the address is at the bottom of the page.

1. In short

The app works without an account. An email address is needed only to buy Pro or to voluntarily submit a diagnostic report.
The precise location permission is used solely as a source of vehicle speed. Coordinates are never read, stored or transmitted.
Data read from your car (fault codes, odometer, sensor readings, VIN) stays on your device and is not sent to a server by default.
We do not sell or share data with third parties for advertising. The app has no ads.

2. What data is collected

2.1. Email address

Requested in two cases only: when buying Pro, and when voluntarily submitting a diagnostic report. Sign-in uses a one-time code (OTP); there is no password. The address is used to:

confirm a purchase belongs to you;
restore your access after a reinstall or a device change;
reply if you contacted support.

Authentication is handled by Supabase Auth (Supabase Inc.) on servers located in the European Union. We send no marketing email.

2.2. Precise location

The app declares the ACCESS_FINE_LOCATION permission for two reasons:

Speed source. Some cars do not report vehicle speed over OBD-II. In that case the trip computer and the acceleration test take speed from GNSS — from the Doppler shift of the satellite signal. The app reads only the speed value in km/h. Latitude and longitude are not extracted from the fix, not kept in memory, not written to any file and never transmitted to us or to anyone else. You choose the speed source in settings; if OBD-II is selected, location is not requested at all.
Finding a Bluetooth adapter on Android 11 and below. On those versions a system Bluetooth scan technically required the location permission. On Android 12 and above the app uses BLUETOOTH_SCAN with the neverForLocation flag, which means the system guarantees the app cannot derive location from scan results.

While a trip is being recorded, TripRecordingService runs in the foreground service state (types connectedDevice and location) so the recording survives the screen turning off. The same limitation applies in the background: speed only.

Before the permission is requested for the first time, the app explains separately why it is needed. Declining does not block the app — you only lose GPS speed on cars that do not report speed over OBD-II.

2.3. Vehicle data

The app reads fault codes, sensor values, odometer readings, the VIN, firmware identifiers and on-board test results from the vehicle's control units. This data:

is processed on the device;
is partly stored locally (last scan, trip log, cached connection profile);
leaves the device only when you choose so — by sharing a PDF report, or by agreeing to submit a report (see 2.5).

The app never writes to control units — it only reads and clears fault codes.

2.4. Analytics and crash reporting

Service	What it collects	Server location
AppMetrica (Yandex LLC)	De-identified usage events: which screens were opened, whether the purchase screen was shown, whether the adapter connected. Plus technical data the service collects itself: device model, OS version, app version, language, country, install identifier, Android advertising ID (AAID).	Russian Federation
Firebase Analytics (Google)	The same usage events, app instance identifier, Android advertising ID (AAID), device model, OS version, approximate country.	United States and other locations of Google infrastructure
Firebase Crashlytics (Google)	Crash and ANR reports: stack traces, app and OS version, device model, free memory, a de-identified installation identifier.	United States and other locations of Google infrastructure

None of these services receives your email, your VIN, your coordinates or the contents of your diagnostic data. Analytics exists so we can tell which features are used and on which cars the app fails to read.

The Android advertising ID (AAID) is collected by the analytics SDKs themselves and serves anonymous statistics only: the app shows no ads, we build no advertising profiles and we pass this identifier to nobody. You can reset or delete it in Android settings under "Privacy" → "Ads".

2.5. Voluntary diagnostic report submission

The "More" tab offers a "Help the project" action: you can send us the result of a scan of your car so we can improve support for that make. It is entirely voluntary and runs only after you explicitly agree in a separate dialog. What is sent:

the make, the communication protocol and how each control unit answered;
the adapter dialog log with the VIN removed — both in plain text and in the hexadecimal form of the response;
an irreversible VIN hash (HMAC-SHA256 with a secret salt). The VIN itself is not transmitted. The hash exists only so the server does not grant a reward twice for the same car; the VIN cannot be recovered from it.

2.6. Payments

Pro is paid for through YooKassa (YooMoney LLC). Card details are entered on YooKassa's side — the app does not see, receive or store them. From the payment service we receive only a payment identifier and its status. Processing of payment data is governed by YooKassa's own policy.

2.7. What is stored on the device only

the counter of free code-description views;
the server-signed Pro entitlement token;
the cached adapter connection profile (protocol, handshake recipe, device identifier);
the trip log and acceleration test results;
the dashboard layout;
the last diagnostic scan;
the adapter dialog log (for debugging only; it does not survive an app restart).

Cloud backup and device-to-device transfer are disabled for this app (allowBackup="false"), so none of this ends up in a Google cloud backup.

3. Legal bases and retention

Email and the purchase record — basis: performance of our contract with you (providing the access you paid for). Kept while the access is valid, and afterwards only to the extent required by accounting and tax law.
Analytics and crash reports — basis: our legitimate interest in keeping the app working and improving it. Retention is governed by AppMetrica and Firebase.
Voluntary diagnostic report — basis: your consent, given in a separate dialog and revocable by writing to us.
Location — not retained at all: the speed value is used in the moment and never written down.

4. Your rights

You may:

ask what data about you we hold;
have it corrected;
delete your account and the data linked to it — the procedure is on a separate page: data deletion;
withdraw consent to diagnostic report submission;
revoke the location permission in Android settings at any time;
erase all local data by clearing the app's storage in Android settings, or by uninstalling.

5. Children

The app is intended for vehicle owners and is not directed at children. We do not knowingly collect data from anyone under 18.

6. Changes to this policy

For material changes we will update the date at the top of this page and note it in the app or in the Google Play release notes.

7. Contact

For any question about your data and privacy: developer.rch@gmail.com