Privacy Policy

TosbikNet ("we", "us", or "our") operates Hoodwise: OBD2 Car Scanner (the "App"), an Android and iPhone app that reads your car's diagnostic data through an OBD-II adapter you plug into the car. Hoodwise has no accounts and no sign-up. Your cars, scans, live readings, recordings and logs are stored on your phone. A scan leaves the phone only when you ask the App to explain it with AI, a report only when you tell us that a value doesn't work, and what your car did with values still being tried only if you turn on "Help support for my car". Usage statistics, which never include your car's data, go unless you turn them off, and a Hoodwise Pro purchase is checked by our payment provider. This policy explains exactly what is sent then, where it goes, and how long it is kept.

1. Data that stays on your device

The following is stored in the App's private storage on your phone. It is not sent to us or to anyone else unless you share it yourself.

• Your cars: the vehicle identification number (VIN) the car reports, the name you give it, the adapter it was read through, and, if you link it on Android, the car's own Bluetooth so the App can start when you get in.
• Scans and history: trouble codes and their descriptions, the conditions recorded when they were set (freeze frame), emissions readiness, the dates of your scans, and the AI explanations you asked for.
• Live data and what the App learns: readings such as engine speed, temperatures, fuel trims and tyre pressures, and each car's usual values, which the App learns over several drives so it can tell you when something is out of line.
• Recordings and connection logs: the live-data recordings you start (CSV files) and technical logs of the conversation between the App and the adapter. Logs contain your car's full VIN.
• Your own values and settings: manufacturer values you add yourself, units, appearance and language.

If backup is switched on for your phone, the phone includes the App's cars, scans, values and settings in it: on Android, the backup Android keeps in your Google account; on an iPhone, iCloud Backup or a backup on your computer. Recordings and logs are left out on both. That backup is held by Google or Apple under your account, or on your computer; we cannot see it.

When you share a recording, a log or an explanation, the App hands it to the app you choose (for example email or a messaging app), and from then on that app's and its recipient's privacy practices apply.

The App talks to your adapter directly, over Bluetooth or over the adapter's own Wi-Fi network; that traffic does not go to the internet. On Android 11 and older, Android only lets apps search for Bluetooth devices if they hold the location permission. The App asks for it there for that reason alone and never reads your location. On an iPhone, the App asks for Bluetooth, to find and connect to a Bluetooth LE adapter, and for the local network, to reach a Wi-Fi adapter; neither gives it your location.

2. Information that leaves your device

• Scans you ask the AI to explain: only when you tap the explain button. The App sends our server the trouble codes with their descriptions and the module that set them, whether each is failing now and whether it turned on a warning light, the freeze-frame readings, the readiness tests, the fuel trims of the drive and a few current readings, how many past records the car keeps, the adapter's protocol, and the language and units you use. With them goes the first 11 characters of the VIN, which identify the make, model, model year and factory but not the individual car (that is the serial number in the last six characters, which is never sent). Our server looks up the make, model and year for those 11 characters in the US National Highway Traffic Safety Administration's public VIN decoder, and has Anthropic's Claude models write the explanation.
• Values you report as not working: only when you report one. The App sends the car's make, the first 11 characters of the VIN, which value it was, what the car answered and from which module, the note you write if you write one, and the App version. Only write in the note what you are comfortable sharing.
• Help support for my car: only if you turn it on (when the App first asks, or under Privacy in Settings), and off until you do. For the manufacturer values the App is still trying on cars like yours, it sends after each drive: the car's make, the first 11 characters of the VIN, whether the engine is petrol or diesel, whether the car answered each value and with how many bytes (and the bytes themselves, except for distances), the lowest, highest and last value it gave (distances rounded to the thousand kilometres), how often it agreed with the standard reading it repeats, what the car's control units say they are (part and software numbers), and the App version. We use it to tell which values work on which cars, so they can be offered to every driver of such a car. Turning it off stops it and deletes what wasn't sent yet.
• Usage statistics: unless you turn them off under Privacy in Settings. The App sends Mixpanel, in its European Union data centre, which screens you open, how the onboarding and connecting to the car go (the kind of adapter, and the car's make from its VIN), how many stored and pending codes a scan found (counts only), how an explanation went, and how the Hoodwise Pro offer and purchases go, each with whether you have Pro. Never the VIN, the adapter's name or address, your location (the App tells Mixpanel not to work one out from the IP address), a value read from the car or which codes it has. On Android, Mixpanel's library adds what it adds in every app: the phone's make and model, its screen size, the Android and App versions and the mobile carrier; on an iPhone, the App adds only the iOS and App versions. Development builds send nothing.
• Hoodwise Pro purchases: Google Play takes the payment on Android, and the App Store on an iPhone; we never see your card. RevenueCat checks the purchase for us and keeps its history (the product, when it was bought and renewed, and whether it is active), under the install identifier.
• An install identifier: a random number the App makes when it is first used, sent with the requests above so our server can apply a daily limit per phone, and the identifier RevenueCat and Mixpanel know the install by. It is not derived from your phone's hardware, your Google or Apple account or anything about you, and reinstalling the App makes a new one (unless the phone restores it from a backup).
• An App Check token, on Android: before contacting our server, the App asks Google Play Integrity to confirm that it is a genuine copy of Hoodwise on a genuine device, and sends the short-lived token that proves it. The token contains no personal data. On an iPhone, the App sends none.

The App contains no advertising or crash-reporting service and does not use the advertising ID; its only analytics are the usage statistics above, which you can turn off. We do not collect your name, email address, phone number, location, contacts or photos.

3. Third-party services

Anthropic processes the scans we send it on our behalf and, under its commercial terms, does not use them to train its models.

4. How we use information

• Explaining the scans you ask about
• Making the manufacturer values the App reads work on more cars, from the values you report and the evidence you share
• Seeing how the App is used, where connecting fails and how the Pro offer does, to improve it
• Providing Hoodwise Pro to those who bought it
• Limiting each phone's daily use, to keep the service available and its cost in check
• Keeping requests that do not come from the genuine App away from our server

We do not use any of this data for advertising, we do not build profiles of you, and we do not track you across other companies' apps or websites.

5. Sharing and disclosure

We do not sell personal information and we do not share it with third parties for their own purposes. Data is shared only in these situations:

• With service providers: those listed in section 3, for the purposes given there.
• To comply with the law: where we are required to by law, or in response to a valid request from a court or public authority, and where we believe in good faith that disclosure is necessary to protect our rights or property, to investigate wrongdoing, or to protect the safety of users or the public.
• In a business transfer: if the App is sold, merged, or transferred, the limited data described in section 2 may be part of the transferred assets. We will give notice before it becomes subject to a different privacy policy.

6. Data retention and deletion

Everything in section 1 stays on your phone until you delete it: scans, recordings and logs can be deleted in the App, and uninstalling the App deletes all of it. On our server:

• An explanation is kept for 30 days, so asking again about the same scan returns it at no cost; then it is deleted automatically.
• The daily-limit counters, which carry the install identifier, are deleted automatically after 2 days.
• Value reports are kept until we delete them. They carry no name or contact detail, only a one-way hash of the install identifier.
• Evidence about values you shared is kept until we delete it, one record a car and day, the same way: no name or contact detail, only a one-way hash of the install identifier.
• Our hosting provider's request logs, which can include your IP address, are kept for up to 30 days.
• Usage statistics are kept in Mixpanel under our project's retention settings; we delete an install's on request.
• RevenueCat keeps a purchase's history for as long as we use it to provide Hoodwise Pro, and Google Play or the App Store keeps its own record of the payment.

To have server-side data deleted sooner, email us at the address below with your car's make and the approximate date. Anthropic keeps the requests it processes for a limited period under its own retention policy.

7. International transfers

Our server and database run on Google Cloud in Frankfurt, Germany. Anthropic processes explanation requests in the United States, RevenueCat processes purchases in the United States, and the NHTSA VIN decoder is in the United States; Mixpanel keeps usage statistics in its European Union data centre. For transfers out of the European Economic Area, the United Kingdom and Switzerland, our providers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

8. Data security

Your on-device data is held in the App's private storage, which other apps cannot read. Traffic between the App and our server, and between our server and the providers above, is encrypted in transit. No method of electronic transmission or storage is completely secure, so we cannot guarantee absolute security, but what the App sends is limited to what an explanation or a report needs.

9. Children

Hoodwise is made for drivers and car owners and is not directed at children. We do not knowingly collect personal information from children under 13, or under the age at which your country lets you agree to online services on your own (16 in some EU countries). If you believe a child has used the App's online features, contact us and we will help.

10. Your rights

Depending on where you live, including under the GDPR, the UK GDPR, the CCPA/CPRA and Türkiye's KVKK, you have the right to:

• Access the data we hold about you (in Hoodwise's case, very little: see section 2).
• Have it corrected or deleted.
• Object to or restrict its processing.
• Not be discriminated against for exercising these rights.
• Lodge a complaint with your data-protection authority.

What is on your phone is under your direct control in the App. For anything else, email us at the address below.

11. Changes to this policy

We may update this policy from time to time. Changes are posted on this page with a new last-updated date, and significant changes are announced in the App.

12. Contact us

TosbikNet is the controller of the data described in this policy and operates from Türkiye. Questions, concerns, or requests about your data can be sent to support@tosbik.net, and we will respond within 30 days.