Privacy Policy

1. The short version

• The app works without an account, and your car's data stays on your phone unless you turn on a sharing switch. Every sharing switch is off until you turn it on, except "Record other cars for their owners", which still asks you once for each car before it records anything (3.19).
• An account is optional. It has three separate switches, each off until you turn it on: back up and sync your cars, sync your drives, and include your photos and recordings. Synced data lets you see your car's history from any device, keeps a record for the car itself across its owners (3.17), and, in aggregate, helps us learn how cars like yours age and fail (3.18).
• Shared cars. If you drive someone else's car and say yes when the app asks, its drives go to that car's owners: engine data only, never your route. A car's owners can share its history with people they choose, and those members see each other's drives in that car (3.19).
• The waitlists collect your email and a few details about your car or fleet. We only send you news about Tachwise if you tick the box that asks for it.
• Our own database is in Canada. Some of the companies that host our site, count page visits or send our email are in the United States, so some information passes through or is kept there.
• We don't sell your information, and we don't use it for advertising.
• You can ask us to see, correct, export or delete your information at privacy@tachwise.com.

2. Who we are and how to reach us

Tachwise ("Tachwise", "we", "us") makes a phone app and a planned device that read a car's OBD-II port and explain what they find in plain language. Tachwise is based in British Columbia, Canada, and runs the websites tachwise.com and tachwise.ca and the app at app.tachwise.com.

Legal name and mailing address: [to be added before this policy takes effect].

Our privacy contact is responsible for how we handle personal information and for answering your questions and requests: privacy@tachwise.com.

The privacy@tachwise.com mailbox is planned; confirm it exists and is read before this policy takes effect (see the setup checklist in the reviewer notes).

3. What we collect, and why

What we collect depends on which part of Tachwise you use. Each part is described below with the purpose we use it for. We don't use information for a new purpose without telling you first and, where the law requires it, asking again.

3.1 The device waitlist (home page)

• What: your email address; your car's year, make and model; the OBD device you use now (if any); optionally your country and province, territory or state; whether you ticked the "Email me about Tachwise launches and the beta" box, the version of that wording, and when you ticked it; which of our sites you signed up on; and, if you arrived from a link that carries them, the campaign tags in that link (for example utm_source).
• Why: to know who wants the Tachwise device and which cars to support first; to tell you when it launches if you asked us to; and to know which of our links and sites bring people in.
• Signing up again with the same email updates your car and device details. It never switches your email consent off, and never switches it on unless you tick the box.

3.2 The fleet waitlist (/fleets)

• What: your work email address; optionally your company name; the size band of your fleet (1–4, 5–19, 20–99, 100+); the kinds of vehicles; what you use today to track them (for example "spreadsheet or paper", or a named product); your country and optionally province, territory or state; the same email-consent record, site and campaign tags as the device waitlist.
• Why: to decide whether and how to build fleet features, and to contact you about them if you asked us to.

3.3 Website analytics

• What: we count a small, fixed set of events on our websites: a page view, starting or submitting a waitlist form, clicking a link to the app beta or from a Learn article, using one of the free tools, and the 3D view of the device on the home page showing or being turned, opened or flipped. Each event carries only which site you're on (tachwise.ca or tachwise.com), and for some events which Learn article, which link, the OBD device and car make you chose, the fleet size band and vehicle types, which tool and the rough band its answer fell in (such as "12.4–12.6 V"; never the numbers you typed into the tool), or which control of the 3D view you used. Never your email, your name, your company or your car model.
• How: we use PostHog, configured so it sets no cookies and stores nothing on your device. Each page view gets a new random identifier held only in memory, so we can't tell that two visits came from the same person. Automatic click tracking and session recording are off. The requests go through our own website address and are forwarded to PostHog. As with any request on the internet, PostHog may receive the network (IP) address the request comes from; see Service providers.
• Why: to know which pages are useful and whether the waitlist forms work.

3.4 Hosting and server logs

Our websites and the app are served by Vercel. Like any web host, Vercel handles your IP address and basic request details (such as the page requested, time and browser type) to deliver pages, protect against abuse and keep short-lived logs. The waitlist forms are processed by small programs ("functions") that run on Vercel and save your entry to our database in Canada. When a save fails, we log only an error code, never your email.

3.5 The app, on your phone

The Tachwise app runs in your phone's browser (or as an app you add to your home screen). Without an account and with the sharing switches off, what it records stays on your phone, in your browser's storage (IndexedDB and localStorage). That can include:

• readings from your car while connected: the full recording of each drive (engine and battery readings about once a second), trouble codes and their history, parked battery samples, and your trips;
• your vehicle: the VIN if you enter it or the car reports it, and the make, model and year decoded from it;
• your logbook and maintenance: fuel, service and note entries, odometer readings, service intervals, tire and brake measurements, and EV charging sessions;
• your settings, including the consent switches below;
• inspection photos and sound recordings, only if you take them (see 3.9);
• your route, only if you turn on route recording (see 3.10).

We can't see any of this. Clearing your browser's data for app.tachwise.com, or uninstalling the home-screen app and clearing its storage, deletes it, and we can't recover it for you.

Bluetooth OBD adapters. If you connect an ELM327 Bluetooth adapter, the app talks to it directly from your phone. The app only sends read requests to your car; it refuses commands that would clear trouble codes or change the car's settings.

3.6 VIN look-up (optional)

In Settings you can choose to look up your VIN online with NHTSA vPIC, a free vehicle-decoding service run by the United States government's National Highway Traffic Safety Administration. If you choose it, the app sends your VIN from your phone directly to NHTSA to get the make, model and year. We don't receive it. The default is an on-device decode that sends nothing.

3.7 An optional account (beta)

An account is optional, and the app keeps working fully without one. Accounts are in beta: sign-in, export and deletion work today, and the sync switches below are being turned on in the beta. If you create an account:

• Sign-in: we collect your email address and send you a one-time sign-in link or code. There is no password. A sign-in session token is kept in your browser on that device until you sign out.
• Account records: when you created the account, your unit preference, and each consent you gave with the time and the wording version.
• Our sign-in provider, like most, keeps security logs of sign-in activity, including IP address and time.

Nothing syncs until you turn a switch on. There are three switches, each for one purpose, each off until you turn it on, and each covering only what it names:

• "Back up and sync my cars": your vehicles (nickname, year, make, model, engine, powertrain, battery size, when you added the car, the VIN, and whether the car reported the VIN or you typed it; a synced car must have a VIN, a car without one stays on your phone); your logbook (fuel, service, note, inspection and sound-tool entries and records you imported, including the fill-ups the app noticed and, for those noticed while route recording was on, their station and location (3.10), each with its revision history and the seal that shows it was not changed afterwards, and the time our server received it); maintenance settings and per-car maintenance preferences; odometer readings; the due dates the app estimates; EV charging sessions; your fuel plan preferences; and a list of your photos and recordings (name, type, size and a fingerprint of each file, not the file itself).
• "Sync my drives": each drive session (when it started and ended, and why the device woke); each trip's summary (distance, duration, fuel or energy used, economy, fuel level, cold start); trouble-code events (the code, which module reported it, when it was first and last seen, whether it is active, and whether a freeze frame exists, not the frame itself); parked battery samples (voltage, tilt, temperature); and the full recording of each drive, the engine and battery readings about once a second, stored as a compressed file once the drive has ended. Your GPS route is included only if you have also turned on route recording (3.10); with route recording off, no location is recorded at all.
• "Include photos and recordings": the inspection photo and sound recording files themselves (3.9). Without this switch, only the list of files syncs.

Work mode records have a fourth switch of their own, "Sync work records (test)", a test feature shown on the Account screen only while Work mode is on, and off until you turn it on. It covers Work mode's shifts (when they started and ended, the platforms you chose, the odometer you typed or the car reported, and the area you typed), your payouts (amount, tips, platform, date and how they were entered), the platforms' annual summaries you typed, and your work-or-personal calls on trips, each with its revision history and seal. Why: to back them up and show them on your other devices. They are never shared with anyone you share a car with, and you can remove them from Tachwise from the same card. Without the switch, Work mode records stay on your phone.

Never synced under any switch: your home and work locations (3.15). They stay on your phone.

Shared cars work apart from these switches (3.19). When you're signed in, adding a car with its VIN read from the car registers you with that car's shared history, as its owner or with a request to its owners, and when a car you belong to has another member, your drives in it go to its shared history as engine data only.

Why: to back up your data and show your car's history on any device you sign in on; to provide the calendar feed if you turn it on (3.11); to keep a record for the car itself across its owners (3.17); and, in aggregate, to build the models behind Tachwise's estimates (3.18). Due dates, ranges, battery health and similar figures are estimates, worked out from the data available, and the app says so where it shows them.

Turning a switch off stops future uploads for that purpose. In the app you can also ask us to remove what that purpose already stored, and you can export or delete everything (section 9).

3.8 "Share data with Tachwise" (optional)

This switch in Settings → Privacy is off until you turn it on. When on, the app sends trip and car-health data (engine and battery readings, parked battery samples, trouble codes) and your logbook entries, including the dates, the odometer, what you marked in your checks and the findings of your recordings (not the photos or audio themselves), to the server named in the app's settings. Why: to build your history and, over time, improve Tachwise's diagnosis.

In the current beta, Tachwise does not yet run a public server that receives this data; the switch sends only to the server address set in the app's settings. Before we run one, this section will be updated to say where it is hosted and how long the data is kept.

3.9 Checks, photos and sound recordings (optional)

Check with Otto shows your car through your phone's camera while it guides a check (tires, under the hood, the dipstick, the body), and listens through the microphone during a listening check. The live camera view and the live sound are used on your phone only: they are not saved and not sent anywhere. What is kept is what you choose to capture: the photos you take, the short clips you record, and what you mark at each step (for example the oil colour you picked, or a tread depth you measured). The app does not analyse your photos or clips; it records what you saw. The sound tool also records a noise together with the engine speed and road speed at that moment. All of it is stored on your phone, in your logbook.

Reading a receipt or pump photo (optional, your own key). On a fill-up you can photograph the receipt or the pump display and keep the photo with the entry. If you choose a provider in Settings (Anthropic's Claude, OpenAI's ChatGPT or Google's Gemini) and add your own key for it, a "Read this photo" button appears. Only when you tap it, that one photo (the copy the app keeps, without its location data) goes from your phone straight to the provider you chose, under your account with them and their terms, and the amounts it reads come back to your phone for you to check before saving. We are not involved and never receive the photo or your key. Your key is kept on your phone only: it is not synced or put in car files or exports, though your phone's own backups (Google, iCloud) can include app data. Receipts can show part of your card number. Values read this way are marked "read from your photo".

The photo and audio files are only sent to us if you turn on a separate switch, "Use my photos and recordings to improve diagnosis". Photos and recordings can capture licence plates, VINs, faces and conversations, so please take them with that in mind. If you turn the switch off, anything not yet sent stays on your phone.

Where things are on your car. When a check shows where something is (the hood release, the fuel door, the dipstick), the app asks our server whether we have that for your car's make, model and year, and tells us which item from a fixed list it was looking for, so we know what to add next. The request carries the make, model and year only: no VIN, no account, no user ID, and nothing you typed. We keep a count of which make, model, year and item were asked for, not who asked. A note you save about your own car ("on my car it is here") stays on your phone. The demo car asks nothing. Like any request, it passes through Vercel, whose short-lived request logs (3.4) can include the make, model and year in the address.

3.10 Your route (optional)

If you turn on "Record my route with this phone's location", the app reads your phone's GPS about once a second, only while the engine is running, and keeps the points on your phone with the trip. With the switch off, your location is never read at all. A recorded route only leaves your phone if you have also turned on "Share data with Tachwise" (3.8) or, with an account, "Sync my drives" (3.7).

Fill-ups the app notices. When the app sees your car's fuel level rise between two drives, it adds a fill-up to your logbook with the time, the odometer when the car reports it, and the fuel gauge before and after, for you to complete with the cost. With route recording on, that entry also keeps where it happened: the station from map data already on your phone, and the location rounded to about 10 metres, taken from the route points just before you stopped or just after you set off. That location is part of the logbook entry, so it syncs with "Back up and sync my cars" if you turned that on, and it goes into a car file only if you include your trips. With route recording off, no location is added.

3.11 Calendar reminders

• Add to calendar (available now, no account): the app builds the calendar file on your phone. Nothing is sent to us. If you choose "Google Calendar", your browser opens Google Calendar with the reminder's title and date filled in, and Google's own privacy policy applies to what you save there.
• Subscribed calendar feed (planned, needs an account and its own switch): we would create a private web address that your calendar app checks for updates. The feed shows your vehicle's nickname, each maintenance item, its estimated date and a short note. It never includes your VIN or location. Anyone who has the address can read those lines, so keep it private; you'll be able to revoke it and make a new one with one tap. We store only a scrambled (hashed) form of the address.

3.12 Emails we send

• Sign-in emails (once accounts launch) are sent through our email provider because you asked for them.
• News about Tachwise (launches, the beta) is sent only if you ticked the box asking for it. Every such email will identify us and include a way to unsubscribe.
• If you write to us, we keep the conversation to answer you and to keep a record of requests such as deletion.

3.13 "Share data with my insurer"

This switch only records your preference. Tachwise has no connection with any insurer and sends nothing to one.

3.14 Fuel price pooling (optional)

The app's fuel plan (being built, not in the beta yet) works out a good day and place to fill up. Open data in Canada and the US has no daily, station-by-station price history, so the app can add your fill-up prices to a shared regional pool. This is a separate switch, "Fuel price pooling", off until you turn it on, and the app lists what it sends on the switch itself.

• What is sent, for each fill-up you log: exactly four things: the date; a 5 km map grid cell (a cell about 5 km across) around where you filled up, or around the home area you typed if the app has no location for that fill-up; the fuel grade (regular, midgrade, premium or diesel); and the price per litre. Our server refuses an upload with any other field in it.
• What is never sent: the station, your odometer, your car or VIN, your account, your name or email, or your exact location.
• No account, no identifier. The upload is anonymous. Your phone's network (IP) address is not stored with it: to stop abuse, the server counts uploads per address over the last hour using only a salted, scrambled (hashed) form of the address, held in that server's memory and lost when it shuts down. It is never written to our database or our logs.
• What we keep: the four values, the currency (worked out from the cell's country), and the hour the upload arrived. Prices far from the country's latest average are rejected. A day's price for a cell is published only as the middle (median) value of at least three uploads.
• Why: to give everyone in a region a daily price signal that no public source provides.
• Turning the switch off stops future uploads. Because an upload carries nothing that links it to you, we can't find or delete your earlier ones.

3.15 Nearby places: fuel stations and repair shops

To show fuel stations (and, later, repair shops) near the places you usually drive, the app asks our server for the ones inside a set of 5 km map tiles around those places. The request carries the tile codes and the kind of place, never your account, a user ID or a precise location. Our server gets the places from OpenStreetMap and keeps them per tile; it does not record which tiles were asked for or by whom. Like any request, it passes through Vercel, whose short-lived request logs (3.4) can include the tile codes in the address.

Your home and work locations never leave your phone. The app works them out on your phone from your trips if you turned on route recording (3.10), or from a postal code or town you type in, and nothing counts as home or work until you confirm it. The fuel plan itself (your tank, your driving, your usual stations and the suggested day) is also worked out on your phone.

3.16 Regional fuel price files

For your region and fuel grade, the app downloads a public price file: a year of daily prices, their statistics and a price model. These files are the same for everyone, are built from the sources below and from pooled prices (3.14), and hold no information about any user. Downloading one needs no account.

Some of these sources' licences require us to credit them:

• Source: Natural Resources Canada, retail fuel prices.
• Contains information licensed under the Open Government Licence – Ontario.
• Source: U.S. Energy Information Administration.
• Données : prix-carburants.gouv.fr, ministère de l'Économie (Licence Ouverte 2.0).
• Station and shop locations: © OpenStreetMap contributors (ODbL 1.0).
• Place names: GeoNames (CC BY 4.0).
• Prices shared anonymously by Tachwise owners.

3.17 Your car's record, across owners

Cars outlive their owners' phones and accounts. When you sync a car (3.7), our server keeps one car identity record for its VIN, separate from your account: the VIN; the year, make, model, engine and powertrain decoded from it; when the car was first and last seen on Tachwise; and how many Tachwise accounts have held it. Your synced rows point at that record. No account can read the car identity record or another account's rows; only Tachwise can join a car's history across its owners, for these purposes:

• A verified history for the next owner. If someone later adds the same VIN to their own account, the app is designed to show them, without any action by you, that Tachwise has records for this car from a given month and year and how many owners it has had; your odometer readings (date and reading); and the dates and kinds of your service entries (for example "oil change · March 2025 · 84,210 km"). It shows them nothing else: no notes, costs, photos, recordings, trips, drives, trouble codes or locations, and never your name, email or account. Everything else reaches a later owner only if you choose to hand the records over to them, a feature that is planned, not built. The limited automatic display above is also planned and not yet shown in the app; it is stated here so that your consent covers it.
• Odometer checks. If a reading for a VIN is lower than an earlier owner's, Tachwise records that, and the app is designed to say so, to help spot a rolled-back or mistyped odometer. Today this check runs only on our side; showing it in the app is planned.
• Statistics about cars like yours (3.18).

A VIN linked to your account is personal information, and we treat it as such. The car identity record is about the car, so it remains after you delete your account (section 8); every row and file under your account is deleted.

Confirm that showing a later owner an earlier owner's odometer readings and service dates, without naming them, is appropriate under PIPEDA (and Quebec's Law 25), and whether the earlier owner should be able to opt out of it.

3.18 Statistics about cars like yours, and Tachwise's models

We use synced data in aggregate, across many cars of the same year, make and model, to learn how cars like yours age and fail: which trouble codes appear at what age and mileage, how long parts really last, and how batteries and fuel economy change over time. That is what improves the estimates and explanations the app gives you, and it is what Tachwise's future models will be built from.

• A figure about a group of cars is shown to owners only when the group has at least 20 cars, and never with anything about one particular car or owner.
• Model building uses the synced rows and, if you turned those switches on, drive recordings and photos. It never uses your home or work location (they never leave your phone) and never identifies you in what it produces.
• These figures are estimates about a group, not a statement about your car.

Whether building models from synced data is sufficiently covered by the three switches' wording as express consent, or needs its own line on each switch, is for the lawyer's view.

3.19 Shared cars

A car can be shared. Its owners, and the people they let in, see one history for it, and other Tachwise drivers can record drives into that history when the owner's phone isn't in the car. This works apart from the switches in 3.7 and 3.8, so all of it is described here.

Recording someone else's car for its owners.

• When: only when your phone is connected to an adapter in a car whose VIN, read from the car, isn't in your garage, and you have said yes for that car. The app asks once per car ("Record for its owner") and keeps your answer on your phone. A yes also hands over the drives your phone already recorded in that car.
• The setting: "Record other cars for their owners", in Settings → Privacy, is on until you turn it off, but nothing is recorded for anyone until you say yes for a car. With it off, the app doesn't ask, and a car outside your garage is treated as before: the app offers to add it. Turning it off also deletes the drives still waiting on your phone to be handed over (see "How to stop or leave").
• Your phone never connects by itself to an adapter you haven't chosen. The first time, you tap Connect and choose the adapter. On Android, "Start recording when I drive" reconnects only to adapters your phone has connected to before.
• What a drive holds: engine data only. When the drive started and ended; each trip's summary (distance, duration, top speed, fuel or energy used, fuel level, odometer readings when the car reports them, and how the engine was used: warm-up, idling, load, rpm and temperatures, plus the hardest braking or acceleration where the adapter measures it); and the trouble codes the car reported during the drive, with their freeze frames. Never your route or your phone's location: the app doesn't read your location while it records a car for its owners, a drive carries no position, and our server removes any position field before storing it. Your logbook, photos, recordings and the once-a-second recording of the drive are not sent.
• Where it goes: to that car's shared history on our database in Canada (section 7), filed under the car's VIN. It stays with the car. Only the car's members can read it; you can't. The app hands a drive over once it has finished (nothing recorded in it for half an hour), then deletes it from your phone, and it never shows in your own history. A drive that can't be handed over within 7 days of its end is deleted unsent.
• Who you are to the owners: "another Tachwise driver". They never see your name or email. If you're not signed in, the app uses an anonymous sign-in for this alone: a random id kept in the app's storage on that phone, with no email, which can hand over drives and read nothing. If you're signed in, your account's id is used instead. Either way the id is stored with each drive, so that owners can block it and so that we can limit each id to 30 drives a day. It reaches the members' phones with each drive; the app shows them at most its last four characters (in an owner's list of blocked drivers). A car file exported from the app names whoever recorded a drive with a label, "another driver" or, for a member of the car, "another member", instead of their id (each drive keeps the reference our server gave it, which begins with eight characters of the id). Like any sign-in, it appears in our sign-in provider's security logs (3.7).

Owners and members.

• The first owner is the first Tachwise account that adds the car with its VIN read from the car. When you're signed in and add a car that way, the app tells our server, which records you as its owner or, if it already has one, sends its owners a request from you. This happens whether or not the switches in 3.7 are on. We keep the VIN, your account's id, your role, and how and when you joined.
• Members are owners (who can invite, approve, remove members, delete drives, and block and unblock drivers) or viewers (who can see the history). An owner approves or denies a request, or invites someone with a link that works once, for one person, for 14 days; we keep only a scrambled (hashed) form of the link. Owners see the car's invites that nobody has used yet (who made each one and when it runs out, never the link) and can cancel one, which stops its link working. Members see each other, and owners see a request, as "Another Tachwise driver" and the last four characters of an id, never a name or email.
• Co-owners and viewers see each other's drives. When a car you belong to has another member, your own drives in it, from the day your phone first sees that membership, also go to its shared history, engine data only as above. Your own copy stays as it was, and the switches in 3.7 still decide what syncs to your account.
• Owners can delete any drive another driver recorded in the car, and block that driver unless they are a member of the car: every drive of theirs in the car is deleted, and their drives are refused from then on. Owners see the drivers they blocked, shown as "Anonymous driver" or "Another Tachwise driver" and the last four characters of an id, and can unblock one: their new drives are accepted again, and the drives deleted by the block don't come back. A member can't be blocked; an owner removes them from the car instead.

How long. A car's shared history is kept while the car has an owner, unless an owner deletes a drive. Drives recorded for a car that has no owner yet are kept for its first owner, and deleted once they are 90 days old. If a car's last owner deletes their account, its history stays with the car, and the next account that adds the car with its VIN read from the car becomes its owner. A log of each hand-over (the id, the car's VIN and the time), kept for the daily limit, is deleted after 90 days.

The 90-day deletions are built but run only once they are scheduled on our database; schedule them before this policy takes effect. The same goes for the database change behind the invite and blocked-driver lists, unblocking, the server refusing to block a member, and the server refusing drives after "Stop for this car": apply it first. Confirm too that a car's next owner may see drives from before they owned it when the last owner deleted their account.

How to stop or leave.

• Turn off "Record other cars for their owners" (Settings → Privacy) and nothing more is handed over, for any car. The drives still waiting on your phone to be handed over are deleted then, unsent; a drive being recorded at that moment stays on your phone as your own and is never sent.
• For one car, tap "Stop for this car" on the banner the app shows while it records that car. It takes effect at once: the drive under way, and any of that car's drives still waiting on your phone, stay on your phone as your own and are never sent, and the app tells our server, which then refuses any further drive from you to that car. To record it for its owners again, choose "Not mine: record it for its owner" when you add a car with its VIN read from the car.
• Signing out doesn't stop either: the app uses the anonymous sign-in instead.
• To leave a car's shared history, tap "Leave this car" on the car's Shared with screen and confirm. A viewer can always leave; an owner can leave while another owner remains, and the last owner can't. Leaving cancels the invites you made to the car that nobody used. Your drives already in its history stay with the car, your new drives stop going to it, and the car stays in your garage with your own history. An owner can also remove you, or you can write to us. When you leave, the car's shared drives are deleted from your phone at once; when you're removed, the next time it checks.
• Deleting your account (section 8) removes your memberships, requests and invites. Drives already in a car's shared history stay with the car: they never carried your name or email, and its owners can delete them.

Confirm that a drive may stay in a car's shared history after the person who recorded it deletes their account, and how someone who recorded drives without an account can ask for them to be removed (the app doesn't show them their anonymous id).

4. What we don't do

• We don't sell or rent your personal information.
• We don't use it for advertising, and we don't let advertising networks track you on our sites or in the app.
• We don't send your GPS route, raw engine data, photos or recordings to our servers unless you turn on the switch for that purpose. (A noticed fill-up's location travels with its logbook entry, 3.10.)
• We don't send your home or work location to our servers, ever (3.15).
• We don't show one account's records to another, except the limited car record a later owner of the same car may see (3.17) and a shared car's history, which its members see (3.19). Neither names you.
• We don't share your data with insurers, dealers or employers.
• We don't use cookies for analytics.

We may disclose information if the law requires it (for example a valid court order), and if Tachwise is ever sold or merged, the buyer would have to keep treating your information under this policy.

5. Consent

We handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other privacy laws that apply. We collect only what we need for the purposes described here, and we rely on your consent:

• By submitting a waitlist form, you agree to us using those details for the purposes in 3.1 or 3.2.
• Marketing email needs your express consent under Canada's Anti-Spam Legislation (CASL): the email box on our forms starts unticked, and we record the wording you agreed to and when.
• Each optional purpose in the app has its own switch, off until you turn it on: sharing data with Tachwise; photos and recordings; route recording; fuel price pooling; and, with an account, "Back up and sync my cars", "Sync my drives", "Include photos and recordings" and, when it launches, the calendar feed. When you sign in, the app recommends turning the three account switches on; it does not turn any of them on for you.
• "Record other cars for their owners" (3.19) is on until you turn it off, but it records nothing until you say yes for a particular car. Joining a shared car, by an invite or a request, is your choice too.

You can withdraw consent at any time: turn the switch off, use the unsubscribe link in an email, or write to privacy@tachwise.com. Withdrawing consent stops future collection or use for that purpose; it doesn't undo what was lawfully done before. Some features won't work without the related consent.

6. Service providers

We use a few companies to run Tachwise. They process information only on our instructions, under contracts that require them to protect it.

Our source code is kept on GitHub; no user data is stored there. If you choose NHTSA VIN look-up or Google Calendar, your phone talks to those services directly (3.6, 3.11).

If you add your own key to read receipts from photos (3.9), your phone sends the photo you choose directly to that company (Anthropic, OpenAI or Google), under your own account and agreement with them. They are not our service providers and we have no part in that exchange. Check their terms: some free tiers may use what you send to improve their products.

7. Where your information is stored

Our database is in Canada. The waitlists, accounts, synced data, car identity records, shared car histories, and the drive recordings and media files you choose to sync are stored in Supabase's Canada (Central) region.

Some information goes to the United States. Vercel, PostHog and Resend are US companies with US servers. That means your waitlist entry passes through Vercel on its way to our database; analytics events are stored by PostHog in the US; and your email address and the emails we send you are handled by Resend in the US. Information in another country is subject to that country's laws, and its courts, government and law enforcement may be able to get access to it.

8. How long we keep it

• Waitlists: until the product you signed up for launches and we have told you about it, or until you ask us to delete your entry, whichever comes first. If you unsubscribe, we keep your email and the date only to make sure we don't email you again.
• Accounts: while your account is open. When you choose "Delete my account", you are signed out everywhere, your calendar feed stops working immediately, and you have 30 days to change your mind by signing in and choosing "Restore my account". After 30 days, your account and every row and file stored under it (vehicles, logbook, maintenance, drives, recordings, photos) are permanently deleted. You can still export your data during those 30 days. What remains is the car identity record (3.17): the VIN, the make, model, year, engine and powertrain decoded from it, when the car was first and last seen, and the count of owners. It no longer points at you. Drives in a shared car's history also stay with that car (3.19).
• Shared cars: a car's shared history is kept while the car has an owner, until an owner deletes a drive. Drives recorded for a car with no owner are deleted once they are 90 days old, and so is the log of hand-overs. A drive waiting on your phone to be handed over is deleted unsent 7 days after its end if it can't be handed over, or as soon as you turn off "Record other cars for their owners" (3.19).
• One purpose at a time: turning a sync switch off stops uploads for that purpose; asking the app to "also remove from Tachwise" deletes that purpose's rows and files from our servers while your account stays open.
• Backups: deleted information can remain in our database provider's backups for up to 30 days more, until those backups expire. We don't restore deleted data from backups except to recover from a failure.
• Analytics: kept by PostHog under our account's retention settings. The events don't contain your email or name.
• Emails and requests: as long as needed to handle them and to show that we did (for example, a record that we deleted your data when asked).
• On your phone: until you delete it or clear the app's storage.

9. Your choices and rights

You can ask us to:

• see the personal information we hold about you and how we've used it;
• correct it if it's wrong or incomplete;
• delete it (with an account, you can do this yourself: Account → "Delete my account", or one purpose at a time by turning its switch off and choosing "also remove from Tachwise");
• export it in a common format (with an account, Account → "Export my data" gives you a JSON file with every row your account holds and a list of every drive recording and media file, plus everything on that phone);
• withdraw consent for any optional purpose.

Write to privacy@tachwise.com from the email address you signed up with. We may ask you to confirm it's you. We'll answer within 30 days, and tell you if we need longer and why. It's free. If we can't do something you ask, we'll explain why.

If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or to your provincial privacy commissioner (in British Columbia, the Office of the Information and Privacy Commissioner, oipc.bc.ca).

10. Cookies and storage on your device

• Our websites set no cookies. Analytics runs in memory only and is forgotten when you leave the page. Our pages load fonts from Google Fonts, so your browser contacts Google to download them.
• The app stores its data on your phone in your browser's IndexedDB and localStorage (3.5). That's how it works without an account. It isn't used to track you.
• With an account, the app keeps your sign-in session token in your browser's storage on that device. Signing out removes it.
• Without an account, if you hand over drives for a shared car (3.19), the app keeps its anonymous sign-in in the same storage. Clearing the app's storage removes it.

11. Children

Tachwise is made for drivers and vehicle owners. It isn't directed at children, and we don't knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to us and we'll delete it.

12. Security

• Connections to our websites and the app are encrypted (HTTPS).
• The waitlist tables can't be read or written through the database's public interface; only our server-side functions can reach them.
• Each account's rows are protected by row-level rules so one account can't read another's, and its drive recordings and media files sit in private storage under a path only that account can reach. The car identity records (3.17) can't be read by any account. Sign-in uses one-time links or codes, so there is no password to steal. Calendar feed addresses are stored only as hashes.
• A shared car's history can be read only by its members (3.19). An anonymous sign-in can hand over drives and read nothing, each id can hand over at most 30 drives a day, and invite links are stored only as hashes.
• Each synced logbook record carries a seal computed on your phone; our server refuses a record whose seal doesn't match, and records are never changed in place, so your logbook can't be quietly altered on the server.
• Access to our systems is limited to the people who need it, with their own accounts.
• We collect as little as we can, and keep the app's data on your phone unless you choose otherwise.

No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner as the law requires. To report a security problem: security@tachwise.com.

13. Changes to this policy

We'll post any change here with a new "last updated" date. If a change is significant, for example a new purpose or a new kind of information, we'll tell you in the app or by email before it takes effect, and ask for your consent again where the law requires it.

14. Contact

Privacy questions and requests: privacy@tachwise.com
Security reports: security@tachwise.com
Mail: [legal name and mailing address to be added], British Columbia, Canada

See also our Terms of Use.