Privacy Policy
This is a translation for your convenience. If there is any difference between this text and the Portuguese (pt-BR) version, the Portuguese version prevails.
This policy explains, in plain language, how the OBD Log app and service handle personal data, in accordance with the Brazilian General Data Protection Law (Law 13.709/2018, the LGPD).
1. Who is responsible
Controller: JohnJohn 3D LTDA, CNPJ 27.140.814/0001-88.
Data subject contact and data protection officer (DPO): JohnJohn 3D Data Protection Officer, [email protected].
2. What data we process and why
| Data | Purpose | Legal basis (art. 7) |
|---|---|---|
| Account: email, password (stored only as an irreversible hash), name and photo (optional), sign-up date, the version of this policy you accepted. | To create and protect your account, identify you in the app and among the people you share a vehicle with. | Performance of the contract (V). Record of acceptance: consent (I). |
| Vehicle: name, make, model, year, profile, license plate (optional), notes, detected OBD protocol. If you provide them: gearbox and tires (number and ratio of gears, final drive, original and current tire sizes) and the shift light settings. | To organize your vehicles, adjust the analysis to your car and avoid duplicate registrations. | Performance of the contract (V). |
| Driving data (telemetry): engine readings (RPM, temperature, speed, etc.), fault codes (DTC), and location, obtained from the phone's GPS or from an external GPS receiver connected by Wi-Fi or Bluetooth (latitude, longitude, altitude, heading, speed and accuracy), with date and time, sent while you are streaming. | To show the history, compute the car analysis and let the AI you connect read this data. Location shows where you have been and how you drive: we handle it with extra care. | Performance of the contract (V). The Android location permission is requested when used and you can revoke it at any time. |
| Raw CAN frames (only if you turn this option on in the app). | To let the AI discover how to decode your car's signals. | Consent (I): option off by default, with confirmation. |
| CAN signal definitions you publish: the content, the title and your name (or "Anonymous", if you did not provide a name). | To share with the community in the marketplace. Private definitions are not shown to anyone except people you invite. | Consent (I): only applies if you choose "public". |
| OBD Log PRO subscription: Google Play purchase token, product, status (active, canceled, in grace period, on hold, expired), start and expiry dates, whether it renews automatically, order number and the record of status changes that Google reports to us. | To unlock the 60-day history of PRO, reflect cancellations and expirations, issue tax documents and honor the right of withdrawal. | Performance of the contract (V) and legal/tax obligation (II). Card numbers and bank details are handled only by the payment provider or the app store; we do not store them. |
| Server access logs: IP address, date and time and route accessed. We do not store passwords, tokens, license plates or invitation codes in these logs. | Security, fraud and abuse prevention, and compliance with the Brazilian Internet Civil Framework (art. 15, 6-month retention). | Legal obligation (II) and legitimate interest in security (IX). |
| Service emails: your email and, in notices, your name (if provided), plus the 6-digit code (we store only its hash). We send the sign-up confirmation code, the password reset code, and security notices and receipts: welcome, password changed, download or deletion of your data and a driver joining one of your vehicles. | To confirm that the email is yours, recover the account and notify you of actions on your account. We do not send advertising. | Performance of the contract (V) and legitimate interest in security (IX). |
| Access tokens (we store only the hash), label, name of the AI that connected, first/last use and number of calls. | To keep you signed in and show in the AI tab who is reading your data, so that you can revoke it. | Performance of the contract (V). |
| Race (track timer): the laps you complete with Race turned on (total time, time of each sector and reaction time at the start), the car you entered and the type of GPS used; and the tracks you register (name, city, state, description and the start, finish and sector points on the map). | To time you, keep your times and build the track ranking. Other drivers only see you if the Appear to other drivers option is on: in that case they see your nickname (first name and the initial of your last name), the car you entered and your best times, and, while Race is on, that you are at that track. They never see your license plate, email or position. | Performance of the contract (V). Appearing to other drivers and publishing a track: consent (I), off by default. |
| Live streaming and web panel: the stream key and the address of the panel link (we store only the hash of both), the public identifier of the watch link and the data layout you built. The camera video and audio pass through our server only while you are streaming; we do not record them. | To deliver the video to whoever has your watch link and to draw the data panel in programs such as OBS and vMix. | Performance of the contract (V): it only happens when you create the link or start the stream. |
| OBD Log devices (Core and Trace): serial number, date it was linked to your account and the history of linking and unlinking. | To grant PRO to whoever owns the device and to prevent the same device from being in two accounts. | Performance of the contract (V) and legitimate interest in preventing fraud (IX). |
Video (phone camera and microphone). In Record mode, the video stays only on your device, in the Movies/OBD Log folder, and is not sent to anyone. In Live mode, you choose the destination: through OBD Log, the video passes through our server and can be seen by anyone who has your watch link, without being recorded by us; through YouTube, Facebook, Twitch or another RTMP address, the app sends the video straight to that service, with the key you entered, and it is subject to that service's terms and privacy policy. The camera and microphone are used only on those screens, with your permission.
Web panel. The panel link shows, to whoever has it, the live readings of the chosen vehicle (those in the layout, such as speed and engine speed). The car's position is included only if you put latitude or longitude in the layout. Treat the link like a password: you can generate another one or turn it off whenever you want.
We do not intentionally process sensitive personal data (art. 5, II). Avoid writing information such as health, religion or personal documents in the vehicle notes.
3. Who we share it with
- People you invite to a vehicle. Whoever joins with an invitation code as a driver sees the vehicle, the trips, the location and the readings of it, the name or email of whoever drove, and the owner sees the member list. Warn and agree before sharing. The owner can remove a driver and a driver can leave at any time; the trips each person sent can be deleted by whoever sent them.
- The AI you connect. When you generate a token in the AI tab and put it in an AI assistant (Claude, ChatGPT, Gemini, Cursor, etc.), that third-party service starts reading your vehicle, trip and location data in read-only mode, under its own terms and privacy policy. This only happens by your decision, and you can revoke the token in the AI tab at any time.
- Google Play (Google LLC), if you subscribe to PRO: it charges you, processes the payment and tells us the status of the subscription. We query the Google Play API with your purchase token and receive renewal and cancellation notices; we send it only the token and your OBD Log account code, never your trips. Tax data may be kept for the period required by law.
- Infrastructure providers (processors) that keep the service running: server hosting, Cloudflare, which forwards traffic in encrypted form and measures visits to the site (see below), and Mailtrap, which sends the service emails (it receives your email, the message text and the code).
- Other drivers, in Race, if you turn on Appear to other drivers: nickname, the car you entered and best times, as described in section 2. Tracks you publish as public are visible to all users, with your nickname; private tracks, only to whoever has the invitation code.
- Whoever has your links. The watch link shows your live video and the web panel link shows the vehicle's readings; neither asks for a login. Share them only with the people you want to see them.
- Video platforms you choose (YouTube, Facebook, Twitch or another), when you stream to them.
- OpenStreetMap and Esri, only on the map screens, and cdnjs (Cloudflare), only on the watch page, as described below.
- Authorities, only when there is a court order or legal obligation.
We do not sell personal data, do not use it for advertising and do not use cookies or ads. The only third-party analytics tool is the site visit measurement described below; the app has no third-party analytics tool.
Map and watch page: when you open a map screen in the app (for example, to mark the start of a track), the app downloads the map images from the servers of OpenStreetMap (OpenStreetMap Foundation) or, in the satellite view, of Esri (World Imagery), both abroad. Those servers see your IP address and the region of the map you are looking at. Whoever opens the watch link downloads the video player from cdnjs (Cloudflare), which sees the viewer's IP address. We do not send them your account, vehicle or trip data.
Site visitors (obd-log.com): to know how many people visit the site, which pages they like and whether it loads fast, we use Cloudflare Web Analytics. When you open a page, your browser sends Cloudflare, which is located abroad, data such as the page opened, the site you came from, the browser and device type, the country and the IP address. According to Cloudflare, this tool does not use cookies or store anything in your browser, does not rebuild a profile of you from device characteristics (fingerprinting) and does not follow you across sites; the result is aggregated statistics, not one person's history. We do not link these statistics to any account or to vehicle or trip data. Legal basis: legitimate interest (art. 7, IX LGPD), to keep and improve the site. You can object at any time through the channel in item 1 (art. 18, §2) or block the script in your browser; the site works the same.
4. International transfer
Cloudflare, Mailtrap (email delivery), OpenStreetMap and Esri operate servers abroad; the AI assistant and the video platform you choose may process data outside Brazil. In these cases the transfer relies on art. 33 of the LGPD (the providers' contractual clauses and, for the AI and the video platform, your express request when you connect them).
5. How long we keep it
- Account and vehicles: while the account exists. When you delete the account, we eliminate everything that is yours immediately (see item 6).
- Trips (readings, location and analyses): 15 days on the free plan and 60 days with PRO, counted from the trip's last activity; after that they are permanently deleted from the server. Whoever leaves PRO keeps the 60 days for another 30 days. Download your data in Profile if you want to keep them longer.
- Subscription data: while the account exists; we may keep tax receipts for the period required by law.
- Access logs: for the legal minimum of 6 months, with automatic rotation afterwards.
- Expired tokens, invitations and email codes: removed automatically. Sign-ups that nobody confirms by email within 7 days, with no vehicle or trip, are also deleted.
- Backups: deleted data may remain in them for up to 30 days, until overwritten, and is not restored for use.
- Race: laps and tracks are kept until you delete the track or the account; changing the layout of a track resets its ranking. The notice that you are at the track disappears after up to 2 minutes without activity and is deleted from the server within 1 hour.
- Live streaming and web panel: the video is not recorded on the server. The key and the links remain valid until you generate new ones, turn them off or delete the account.
- Devices: the link lasts until you unlink the device or delete the account. The linking history of the serial number is kept; when you delete the account, it is no longer tied to you.
- On the device: the queue of readings not yet sent is erased when you sign out. The web panel link and the stream key are kept encrypted on the device and are erased when another account signs in on it.
6. Your rights (art. 18) and how to exercise them
You can, free of charge, at any time:
- Access and take your data (portability): in the app, Profile → Download my data tab. You receive a JSON file with your account, vehicles, trips, location and readings, Race tracks and laps, linked devices and the links you created.
- Correct: name and photo in Profile; password in Sign in → Forgot password; vehicles in Vehicles → Edit vehicle.
- Delete: a trip (on the trip screen, on the pencil next to the name, under Delete trip) or the whole account in Profile → Delete my account, confirmed with your password. It is permanent. If you own a shared vehicle, it passes to the longest-standing driver; if there are no other members, it is deleted. The signal definitions you published leave the catalog.
- Withdraw consent (CAN frames, public definitions and tracks, appearing to other drivers, web panel link, stream key, location, camera and microphone) on the app screens and in the Android permissions.
- Request information about processing, sharing, or review of decisions: through the channel in item 1. We reply within 15 days.
If you are not satisfied, you can complain to the Brazilian National Data Protection Authority (ANPD): gov.br/anpd.
7. Security
Traffic is always encrypted (HTTPS). Passwords are hashed with scrypt and tokens are stored only as hashes. Each account only accesses its own vehicles and those shared with it. AI tokens read your data and can only create private CAN signal definitions, which you decide whether to install or publish; they do not delete or change anything else. If there is an incident that may cause relevant risk or harm, we will notify you and the ANPD, under art. 48.
The watch link, the web panel link and the invitation codes are access secrets: whoever has them sees what they show, without a login. We store only the hash of the keys, and you can change them or turn them off at any time.
8. Children and teenagers
OBD Log is for people who drive and use their own vehicle; it is not aimed at people under 18 and we do not knowingly collect their data. If we identify a minor's account without a guardian's consent, it will be deleted.
9. Changes to this policy
If we change something relevant, we will publish a new version here and ask for new acceptance in the app before you continue using it.
Technical support document, reviewed by the controller. It does not replace legal advice.