Privacy Policy
Codriver · effective 23 August 2026
Codriver is an Android app for reading your own car over an OBD-II adapter, keeping its records, showing your own sensor hardware, and playing music while you drive.
The app is offline-first. Everything core works with no account and no signal, and in that mode we receive no data about you or your car. If you choose to sign in, the app can back up and sync your car's records to the Codriver server — what that server stores, and what it will never store, is spelled out in "The Codriver server" below. There is no advertising, no analytics and no sale of data.
What the app stores on your phone
All of it lives in the app's private storage and is deleted when you uninstall the app. Without an account, none of it is transmitted anywhere; with an account, the items marked below are synced so a new phone can restore them.
| Data | Why |
|---|---|
| Trips — distance, duration, speeds, fuel used, idle time | The trip log |
| Fuel fill-ups and service records you enter | Consumption and service reminders |
| Fault codes read from the car | Diagnostics history |
| Vehicle model, engine, odometer, units and preferences | Setting the app up for your car |
| Recently played tracks and pinned playlist links | So you don't search for the same thing twice |
You can erase all of it at any time by uninstalling the app or clearing its storage in Android settings.
Signing in with Google (optional)
If — and only if — you choose to sign in for music, the app requests one scope: https://www.googleapis.com/auth/youtube.readonly, read-only access to your YouTube library.
What it is used for
Listing your playlists and your liked videos.
Reading the video titles inside a playlist you choose to play.
What it is never used for
Posting, commenting, subscribing, rating or editing playlists.
Changing anything at all on your account — the permission is read-only and the app makes no write requests of any kind.
Where that data goes
From Google's API to your phone, and nowhere else. Playlist names and video titles are held in memory while the app runs; the ids of playlists you explicitly pin are saved on the phone. Your access token is issued and stored by Google's own sign-in library on the device — the app never sees your password and never copies the token anywhere.
Withdrawing access
Sign out in the app, or revoke it at your Google account permissions page.
The Codriver server (optional account)
Signing in creates an account on our server (codriver.kalootech.com, also reachable at its former address mazda-copilot.kalootech.com). The account exists to do four things: back up and sync your records between phones, host the community rooms, answer AI questions without you pasting API keys into the app, and send service reminders. Every feature it powers degrades gracefully — the app keeps working offline without it.
What the server stores when you sign in
| Data | Why |
|---|---|
| Your email, name and photo from Google, and your devices | Account identity and sign-in |
| Vehicle profile — model, engine, odometer, plate number if you enter it | Sync and service reminders |
| Trips, fill-ups, service records, fault-code history, performance timings | Backup, restore and statistics |
| App settings, saved places, emergency contacts and the last parked-car position — only if those features are on | Restoring your setup on a new phone |
| Community messages you post, and reports you file | Running the community; messages are public to other members |
| AI usage metadata — timestamps, token counts, latency | Quotas and abuse prevention |
What the server will never store
The live OBD data stream from your car — it never leaves the phone.
GPS traces or route history. The map follows you; it does not record you.
Microphone audio, beyond the single utterance being transcribed, which is processed and discarded.
Your own API keys, your Google/YouTube tokens, your OBD adapter's Bluetooth address, or local network addresses.
Payment
Cloud sync and the assistant are a paid subscription after a 14-day trial, collected by mobile money through Lenco. We store the transaction reference, amount, operator and status so your subscription can be worked out and a failed payment explained. We never see or store your mobile-money PIN.
AI questions
When you use the assistant, your question — and for voice, the single utterance — passes through the server to an AI provider (Groq) and the answer returns to your phone. The server does not keep the content of questions, answers or audio.
The workshop directory
The directory of workshops in the app and on this site is public information about businesses, published with their agreement. Reading it requires no account and sends us nothing about you beyond what any web request carries: your IP address, which is used only to stop one client hammering the service and is not tied to your account or kept as a log of what you looked at.
When you tap call, WhatsApp or directions on a workshop, your phone opens your own dialler, WhatsApp or maps app. We do not place the call, and we are not told that you made it.
Your rights
In the app you can download everything the server holds about you as JSON, and delete your account, which erases your data. Community messages you posted are anonymised rather than deleted, so conversations stay readable without your name on them. Deleted records are fully purged within 90 days; AI usage metadata is kept at most 12 months.
Permissions the app asks for
Location
Used while the cockpit map is open, to centre the map on where you are and draw the road you have just driven, and — if you ask it to — to sort the workshop directory by how far away each shop is. Your position is not recorded, not saved between sessions, and not sent to us.
Map images are fetched from the OpenStreetMap tile servers. Like any request to any website, those carry your IP address and tell that server roughly which area of the map you are looking at. Not opening the map means no such requests are made.
Microphone
Used only when you turn voice control on, or press and hold the microphone button. Speech is transcribed and the audio discarded; it is never stored.
Storage / audio files
Used to find music already on your phone so it can be played. File contents are read for playback only.
Notifications
Used for the media player controls while music is playing, and for service reminders if you turn them on.
Third parties your phone contacts
- Google / YouTube — searching, listing your library and streaming audio.
- OpenStreetMap Foundation — map tiles.
- Groq — AI answers, routed through our server.
- Lenco — mobile-money payment, only if you subscribe.
There is no advertising, no analytics, no crash reporting, no tracking and no sale or sharing of personal information. There is nothing to sell.
Children
The app is not directed at children.
Changes
If this policy changes, the effective date above changes with it and the updated text replaces this page.
Contact
Questions about this policy: kalubachakanga@gmail.com