Privacy Policy
How TRUE OBD handles your data · Last updated 23 September 2026
TRUE OBD is built local-first and private by design. The short version: your drives, diagnostics and vehicle data live on your device. There is no TRUE OBD server collecting your vehicle data. The few features that use the cloud are built to process only what they need and retain only the limited metadata described below. This page explains exactly what is used, when, and why.
Local-first by design
Your information is created, processed, and stored on this device. The app works fully offline and does not require an account to use.
What stays on your device
Diagnostic data, drives and driving records, vehicle profiles, maintenance records, and scan history are stored locally on your device (in an on-device database). Data leaves the device only for a cloud action you explicitly request, such as Drive backup, VIN decode, or an AI insight, as described below.
Google Drive backup — your account, not ours
Google Drive backup happens only if you sign in with Google and authorize Drive access. When enabled, your backups are saved to your own Google Drive account (in a private app folder) — not to TRUE OBD, and not visible to us. Why: so your drives and records survive a phone change or reinstall. You can turn backup off at any time, and disconnecting your Google account stops further Drive backups.
Staying signed in on a new phone
If you sign in with Google, TRUE OBD asks Android to keep a small sign-in restore key on your device, using Google’s Block Store. Android carries that key to your next phone when you transfer your device or restore it from a backup, so TRUE OBD can sign you back in without you typing anything. Why: Google Play requires apps to restore your sign-in state on a new device.
The key is a random value with no personal information in it. We store only a one-way hash of it on our server, alongside your account ID and an expiry date — never the key itself, and never your name, email, vehicles or drives. During an interrupted restore, the server may also retain an encrypted copy of its response that only that phone's device-held, non-exportable recovery key can open; it is deleted after the phone confirms receipt or expires with the replacement key. The restore key expires after 13 months, and using it immediately replaces it with a new one, so the same key cannot be used again afterwards.
It is uploaded to your Google backup only when Android confirms that backup is end-to-end encrypted, which requires a screen lock on your phone. If it is not, the key stays on the device and travels only by a direct phone-to-phone transfer.
When your account is restored this way, TRUE OBD asks for your device screen lock before showing your vehicles, trips and diagnostics.
Signing out asks our server to remove every key for your account and to end your TRUE OBD sessions on your other devices. When that request succeeds, it does both. If we cannot reach our server, your phone keeps the key, blocks it from being used, and tries again the next time you sign in — so signing out is reliable on the device you are holding, and best-effort elsewhere. A sign-in that is already open on another device may also stay usable for up to an hour before it notices. Deleting your account permanently blocks any restore key for that account, so it can never be used to sign back in afterwards. A sign-in that our server had already issued in the minutes before you deleted the account can remain valid for up to an hour; we detect and remove any account that reappears that way.
To make that block permanent we keep one small record after you delete your account: your account’s internal ID and the date it was deleted. It holds no name, email, vehicle or driving data, and its only purpose is to stop a leftover key recreating the account. We keep it indefinitely, because putting a time limit on it would reopen exactly the problem it prevents.
Guest Mode
In Guest Mode, no Google account is connected and Google Drive backup is not used. Your records remain on this device unless you explicitly request another cloud action described in this policy.
No diagnostic archive
TRUE OBD does not maintain a server-side archive of your vehicles, drives, scans, or diagnostic readings. A cloud feature processes only the bounded data described for that feature when you explicitly request it. The only records we keep against your account are your subscription status, the hashed sign-in restore key described above, and — if you delete your account — the deletion record described above. None of them contains vehicle or driving data.
AI driving summaries
When you request an AI driving summary, TRUE OBD sends a small set of already-aggregated driving metrics, such as totals, averages and event counts. It does not send GPS locations, routes, VIN, or raw trip samples. The app backend does not persist the request or generated summary; the result is returned to your device. If AI is unavailable, the app creates a deterministic on-device summary.
Sharing a drive with your own AI assistant
"Explain this drive" prepares a written brief and the drive's recorded sensor readings, then hands them to whichever assistant app you pick from Android's share sheet — for example ChatGPT, Gemini, Claude or DeepSeek. Nothing in this feature passes through TRUE OBD's servers: the data goes directly from your device to the app you choose, and what happens to it afterwards is governed by that app's own privacy policy. The brief contains no VIN, number plate or location; vehicle mileage is included rounded to the nearest thousand. You can also copy the brief and paste it anywhere.
AI freeze-frame diagnosis
Only when you tap Get AI insight, TRUE OBD may send a bounded diagnostic payload through Firebase to Google Vertex AI Gemini: linked trouble-code strings and trusted local-library descriptions; decoded numeric freeze-frame values and canonical units; record and completeness metadata; and optional vehicle-profile make, model, year, engine size or code, fuel type, and market region. It does not send VIN, GPS location or routes, adapter address, raw ECU responses, or account profile details. To enforce a fair request limit it also sends a random identifier the app creates for that sole purpose — not an advertising or device identifier, never combined with your other data, and replaced if you reinstall or clear app storage.
Firebase automatically supplies App Check and may supply authentication and network security metadata. The app backend does not persist the diagnostic payload or generated diagnosis. For abuse prevention it stores only a one-way-hashed caller bucket, request count, and time window. That record is scheduled for automatic deletion two hours after its window opens; Google's automated deletion runs in the background and typically completes within 24 hours of that point. A successful diagnosis is treated as expired after seven days and removed when the on-device cache is next accessed.
Diagnostics & analytics
To keep TRUE OBD stable, the app uses Google Firebase Crashlytics and Analytics to collect anonymous crash reports and aggregate usage statistics. Why: to find and fix crashes and understand which features are used, so the app keeps improving. This never includes your GPS location, routes, VIN, diagnostic trouble codes, or trip details. You can limit this further from your device and Google account settings.
VIN decode
VIN decoding is optional and only happens when you tap “Decode VIN.” When you do, the app sends just that VIN over the internet to the U.S. NHTSA vPIC public vehicle database to look up details such as make, model, and year. Why: to auto-fill your vehicle profile accurately. Nothing else is sent, and the result is stored only on your device. If you never use this feature, your VIN never leaves the device.
ABS Labs & experimental features
TRUE OBD Labs features are read-only where stated: they read information from supported modules and do not send write, clear, calibration, or actuator commands to the vehicle. A Labs module profile is only offered where its addressing has a cited source and has been validated on a real vehicle — the earlier ABS profile did not meet that bar and was withdrawn.
Your data is not sold
Your personal and vehicle data is never sold or shared with third parties for advertising or marketing. TRUE OBD contains no ads and does not use an advertising ID.
Your choices & control
- Use the app entirely offline in Guest Mode — no account, no cloud.
- Turn Google Drive backup on or off at any time; disconnect your Google account to stop it.
- Deleting the app removes its on-device data; your Drive backup remains in your own Drive until you delete it.
- Limit analytics/crash reporting from your device and Google account settings.
- Request account & data deletion any time — see Delete your data.
Contact
Questions, data requests, or concerns? Email densmac06@gmail.com and we'll respond.