Privacy Policy

ObdScan

What this app reads from your car, what leaves your phone, and what does not.

Effective 4 September 2026 Version 1.0

The short version

  • The app has no accounts. You never give us a name, an email address or a phone number.
  • Your car’s VIN is sent to the US government’s vehicle database to work out what car you have. That is the one piece of identifying data that leaves your phone automatically.
  • Sharing fault data with other drivers is off until you turn it on, and it never includes the full VIN.
  • We do not know where you are. The app never reads your location, and there is no advertising or analytics tracking of any kind.
  • Your scan history stays on your phone.

Who is responsible

This policy covers the ObdScan mobile application. The developer of the app is the data controller for the purposes of the EU and UK General Data Protection Regulation. Contact details are at the end of this page.

What leaves your device

There are six places this app can send a network request, and no others. Each one is listed below with the exact data it receives.

US vehicle database (NHTSA vPIC)

Automatic
Host
vpic.nhtsa.dot.gov
Sends
your full 17-character VIN
When
After a scan, when the app reads the VIN from your car and looks up the make, model, year, engine and fuel type.
Why
A fault code means different things on different cars. Without knowing the vehicle, the app cannot tell you which repair applies to yours.
Note
In the EU and UK a VIN is treated as personal data, because it can be linked to a registered keeper. NHTSA is a United States government agency, so this is a transfer outside the EEA. NHTSA operates this service as a public database under its own terms; we have no agreement with them and no control over their retention. If you would rather this did not happen, do not use the vehicle identification feature — reading and clearing fault codes work without it.

US safety recall database (NHTSA)

Automatic
Host
api.nhtsa.gov
Sends
make, model, model year
When
After your vehicle has been identified, to look up open safety recalls.
Note
The VIN is not sent here. There is no public VIN-level recall service, so results describe campaigns affecting some vehicles of that description, not confirmed recalls on yours.

Adapter fault reports

Only when you tap Send
Sends
adapter name and version, protocol, error type, operating system, a scrubbed communication log
When
Never on its own. Only if your adapter fails and you choose to send a report.
Note
The raw communication log does contain your VIN, because your car transmits it as part of normal diagnostics. It is removed on your phone before sending, and removed again on the server. The app shows you the entire scrubbed report on screen before anything is sent, so you can read exactly what would go and decline.

Currency rates

Automatic
Host
api.frankfurter.dev
Sends
nothing about you or your vehicle
When
Occasionally, to convert estimated repair costs into your currency.

What a sent report actually looks like

An adapter fault report is the only thing the app sends that includes raw vehicle communication, so this is what one looks like after scrubbing:

>> ATZ
<< ELM327 v1.5
>> ATSP0
<< OK
>> 0902
<< [redacted: vehicle identity]
>> 0100
<< SEARCHING... | UNABLE TO CONNECT

IP addresses

Any request over the internet reveals your IP address to whoever receives it. Our server runs on Cloudflare, which processes IP addresses to deliver and protect the service. The application’s own database has no field for an IP address, so none is stored with your data, and IP addresses are never joined to contributions. NHTSA and the currency service receive your IP address under their own policies.

What stays on your device

Your scan history never leaves your phone. It is written to the app’s own storage and is not backed up to us, because there is no “us” to back it up to — no account, no cloud copy.

Deleting the app removes all of it. Depending on your settings, your phone’s own operating system backup (iCloud or Google) may include this data; that backup is controlled by Apple or Google, not by us.

Permissions, and why the app asks

Legal basis (EU and UK users)

How long data is kept

Your rights, and how to delete your data

You can delete everything you have contributed to ObdScan from Settings → Delete my contributions. It removes your observations, your written outcomes and your votes from the server immediately. No email, no waiting period, no request form.

Under the GDPR you also have the right to access, correct, restrict or object to the processing of your personal data, to data portability, and to complain to your national data protection authority. Because the app holds no account and no contact details, we can only act on a request for data linked to your install identifier, which the app can show you.

Children

This app is a vehicle maintenance tool intended for drivers. It is not directed at children, and we do not knowingly collect data from anyone under 16.

Safety and accuracy

Repair cost estimates and severity ratings in this app are estimates, not manufacturer data. Recall results describe campaigns affecting a model, not a confirmed recall on your specific vehicle. Clearing fault codes also resets your car’s emissions readiness monitors, which can cause an emissions test to be refused until the vehicle has been driven enough for them to reset. Always confirm a diagnosis with a qualified technician.

Changes to this policy

If what the app collects changes, this page changes with it and the effective date at the top is updated. A change that would send something new off your device will be introduced as a setting that is off until you turn it on.

Contact

Questions about this policy or about your data: ongorunet@gmail.com

Effective 4 September 2026 · Version 1.0