Privacy Policy

Effective date: June 6, 2026 · Last updated: June 21, 2026

1. Who we are

OBD Pilot is an iOS app developed by Shasank Mallela ("we", "us"). The app reads diagnostic data from your vehicle via an OBD2 adapter and helps you understand it in plain language using AI.

We can be reached at hello@obdpilot.com for any privacy-related questions or requests.

2. What we collect

OBD Pilot is designed to keep your data on your device whenever possible. The categories below describe everything we can see, even briefly:

On your device only (never sent to us)

• Saved diagnostic scan records (trouble codes, freeze-frame snapshots, sensor data, vehicle make/model/VIN if your adapter reports it)
• Chat conversation IDs and any text you've typed locally before sending (the history itself is server-side; see below)
• App preferences (theme, accent colour, units, car nicknames)
• Your Garage of saved vehicles (nicknames + VINs)

Sent to our backend proxy (scanai-proxy.vercel.app) on every AI request — both Pro and free tier

• The chat or analysis request body itself: your question, any photo you attached, the relevant trouble codes, freeze-frame data, live vehicle readings, and your vehicle's identity (year/make/model and VIN if known)
• A session identifier so the AI agent can keep multi-turn context
• If you are a Pro subscriber: an Apple-signed StoreKit transaction token that proves your subscription is active. We do not receive your name, email, Apple ID, or any personally identifying account info from Apple.
• If you are on the free tier: a per-install device identifier (derived from Apple's identifierForVendor) and a fresh Apple DeviceCheck token. We use these only to enforce the monthly free quota (3 AI diagnoses per device per month) and to deter abuse. They do not identify you personally.

Sent to OpenAI (via our proxy, server-side)

• The request our proxy forwards on your behalf — the same chat / analysis content described above. Our proxy does not log request bodies. OpenAI's privacy policy governs what they then do with it (see section 4).

Sent to NHTSA vPIC (US National Highway Traffic Safety Administration), only when your adapter reports a VIN

• The VIN itself, used to decode the year/make/model so the AI can give vehicle-specific answers. No personal information accompanies the request.

Sent to Apple

• Subscription purchase events handled entirely by Apple's StoreKit. Apple's own privacy policy governs that data.

3. What we do NOT collect

• No analytics, telemetry, or crash reports sent to any third party
• No advertising identifiers
• No location data
• No contacts, calendar, or photo metadata beyond the specific photo you choose to send in a chat
• No tracking across apps or websites

This is also reflected in the app's Privacy Manifest (PrivacyInfo.xcprivacy) bundled with each release.

4. Why your data goes to OpenAI

OBD Pilot uses OpenAI's API (called server-side by our proxy) to translate cryptic diagnostic codes into useful, conversational advice. OpenAI processes the request, returns an answer, and (per OpenAI's API policy at the time of writing) does not use API content to train their models.

You can read OpenAI's current API privacy and data handling policy at openai.com/policies/api-data-usage-policies.

If you prefer not to use AI features, you can:

• Skip the chat tab and use the app for basic scan-and-display only
• Use Demo Mode, which never sends any data to our proxy or OpenAI

5. Our sub-processors

Service	Purpose	What they see
Vercel	Hosts our proxy (scanai-proxy.vercel.app) for all AI requests — Pro and free tier alike	The request body in transit (chat or analysis content, vehicle context, session id, plus your StoreKit token or DeviceCheck token depending on tier). Stateless: does not log request bodies or persist user data.
OpenAI	AI answers and image analysis	The text/photo of your question + the diagnostic context needed to answer it (forwarded from our proxy, server-side)
NHTSA vPIC	Decodes VIN → year/make/model so the AI can give vehicle-specific answers	Just the VIN, when your adapter reports one
Apple	Subscription management + free-tier abuse deterrence (DeviceCheck)	Subscription transactions and payment details per Apple's own policies; DeviceCheck tokens are issued by Apple at our request and validated server-side

6. How long data is kept

• On-device data: stays on your device until you delete the app or use the in-app delete actions (Reports → swipe to delete, New Chat to clear history, etc.).
• OpenAI: OpenAI retains API request data for up to 30 days for abuse monitoring, then deletes it. See OpenAI's policy linked above.
• Vercel proxy: stateless; nothing is logged or persisted.
• Apple subscription data: retained per Apple's own policies.

7. Your rights

You can at any time:

• Stop using the app: delete it from your device and all on-device data is removed.
• Reset your chat session in the app (Chat tab → new chat). This also signals our proxy to forget the session-side context.
• Cancel your subscription via iOS Settings → [Your Name] → Subscriptions.
• Request access, correction, or deletion of any data we hold about you by emailing hello@obdpilot.com. Note that because OBD Pilot doesn't have user accounts and our proxy doesn't persist your data, there is typically nothing on our end to delete — but we will confirm that in writing.

If you are in the EU/UK, you also have the rights afforded under the GDPR — including access, rectification, erasure, restriction, portability, and objection — and the right to lodge a complaint with your local data protection authority. If you are in California, you have the rights described under the CCPA, which we respect for all users globally.

8. Children

OBD Pilot is not directed at children under 13 (or the applicable minimum digital consent age in your jurisdiction). We do not knowingly collect data from children.

9. International data transfers

OpenAI processes requests on servers in the United States. Vercel also processes requests in the United States. By using AI features in OBD Pilot, you consent to this transfer.

10. Changes to this policy

If we materially change this policy we will update the "Last updated" date above and notify users via an in-app prompt on next launch.

11. Contact

Privacy questions or requests: hello@obdpilot.com