Privacy policy — SC OBD2 / SmartControl OBD2
Controller and scope
Proposed update: 19 October 2026. Data controller: Nicola Santini. Privacy and deletion contact: [email protected]. No app account is required.
On-device data and online services
Profiles, OBD readings, fault codes, trips, routes and settings are handled on your device. Without a real profile, stopwatch measurements stay in memory and do not create history. Maps, address lookup, purchases/licensing, diagnostics, analytics and support can communicate with external services. Having no account does not make these communications anonymous. OBD readings can work offline; uncached maps and online services require a network.
Location and background operation
New trip and vehicle locations are used when the in-app location setting is enabled and Android grants the necessary permissions. Your session may continue in the background through a foreground service with a visible notification. Disconnect ends the session. Turning off the in-app setting does not revoke Android permissions or remove saved locations; manage permissions separately in Android settings.
Maps and address lookup
Provider requests may disclose precise coordinates or the viewed map area and network metadata such as IP address and User-Agent. The candidate uses OpenStreetMap street tiles, Esri World Imagery satellite tiles and Nominatim with Photon/Komoot fallback for addresses. One path first uses the device Geocoder, whose provider depends on the device. Provider privacy policies also apply; map-related data does not necessarily stay on the phone.
Diagnostics, analytics and identifiers
Firebase Crashlytics receives errors, traces and technical data. Firebase Analytics collects usage events, sessions, app-instance identifiers, approximate location inferred from IP and, when available, advertising identifiers and purchase events containing product and price. These are not full payment-card details. Version 1067 has no general user switch to disable these SDKs. Collection is not described as anonymous or optional and is separate from support consent. Website cookie choices do not control SDKs in the app.
Purchases, licensing and abuse prevention
Google Play handles distribution, purchases and entitlement checks. Firebase App Check with Play Integrity verifies app and device integrity for support. Technical checks and attestations may be transmitted before a case outside the closed pilot is rejected. Firebase Cloud Messaging uses identifiers and tokens to deliver notifications; support-reply alerts are optional. Local checks of companion apps alone do not establish transmission of a list of installed apps.
Support and voluntary sharing
Support intake is restricted to a closed pilot. Reports are prepared locally, can be reviewed or saved and require specific consent before sending. Selected answers, free text and technical data are used to handle the case; sanitized logs and thread snapshots are optional. Reports do not automatically read VIN, registration plate, location, routes or email accounts. Review free text and files before sharing. Voluntarily shared logs may contain coordinates and personal data. The dedicated backend uses Cloudflare Workers and D1 with restricted staff access. Detailed support privacy notice.
Purposes, choices and rights
Requested features process data needed to provide the service. Sending a support report is based on specific consent, withdrawable without affecting your license. Security and abuse-prevention processing protects the service and its users. The current automatic analytics collection is described above; this notice does not replace consent where legally required. Contact us to exercise access, correction, deletion, restriction, portability where applicable or objection rights. You may complain to the Italian data protection authority or your competent supervisory authority.
Retention
Local data remains until you delete it or according to the app retention settings; exported files and backups are separate. The linked Analytics property is configured for 2 months of event data and 14 months of user data, with the user retention period resetting on new activity; aggregate reports follow separate rules. Provider and SDK retention periods differ. Support cases last up to 90 days, abuse counters up to 2 days; deletion is asynchronous and D1 recovery history may retain earlier records for up to 7 days. Minimal revocation information may remain until the original case expiry to prevent recreation, along with any records required by applicable obligations.
Delete your data
- On your phone: use the app trip/profile deletion functions. To remove all local data: Android → Settings → Apps → SC OBD2/SmartControl → Storage → Clear data. This removes local data and settings; first save only what you want to keep.
- Exported copies: separately delete CSV files, logs and backups from the folders and services where you stored or shared them.
- Support case: open the case in the app, choose deletion and confirm. If the private credential was lost, email us with the case reference. Do not send passwords, private credentials or your entire database.
- Online service data: email the contact below with SC OBD2, the data category, an approximate period and a case reference or technical identifier if already available. No account is needed. We verify only what is necessary, initiate deletion of identifiable records with the relevant services and explain the result, provider processing times and any retained information. An email address alone does not identify pseudonymous SDK records; we explain any identification limit. Clearing Android data or uninstalling does not guarantee retrospective deletion at providers.
Request deletion by email. We respond within statutory time limits, normally one month, explaining any permitted extension.
Providers and international transfers
Cookies and analytics on this website
The site stores a local preference for accepting or rejecting analytics. Its GA4 script loads after acceptance, with Google Signals and advertising personalization disabled. This choice applies to the website, not the app. Reopen cookie preferences using the website control. Web requests still expose IP addresses and technical metadata to hosting providers and loaded external resources.