OBD Mechanic is built by drivers, for drivers. The app reads a lot of data from your car (that's the point) and it's all yours, on your phone: your drives, your laps, your readings. We don't track you and we don't sell anything about you. This page says exactly what the app keeps, what leaves your phone, and why, in plain English.
Last updated 26 August 2026 · applies to the OBD Mechanic Android app (com.obdmechanic.app)Beta builds send back anonymous car learnings: the fault codes seen, the car's make/model/year/engine (never the VIN, reg, or anything about you), which adapters behave and which misbehave, the sensor readings used in a diagnosis, and what the mechanic answered. It's anonymous, but it makes the answer faster and better for the next driver with your fault on your model. The more drivers in the beta, the more experienced the mechanic becomes. This may become an opt-in switch later; for now it's part of joining the beta.
Nearly everything the app does happens on your phone. Live readings from your car, your dashboards, saved diagnoses, trip logs, and everything in the garage (your VIN, your reg lookup results, and the things you add yourself, like insurance details, policy numbers and breakdown contacts) are stored only on your device.
Encrypted at rest. Garage and paperwork data is encrypted with a hardware-backed key (AES-256, Android Keystore) that never leaves your phone's secure hardware. Paperwork fields additionally sit behind your screen lock or fingerprint inside the app. Because the key lives in your phone's hardware, this data doesn't transfer to a new phone, by design.
Music and notification data (the now-playing tile, optional message read-aloud) is read locally under Android's notification-access permission, which you grant explicitly and can revoke any time, and is never transmitted anywhere.
The dashcam and the rear-view "mirror" dial use your phone's camera. They only run when you add one of those dials to a dashboard, and Android asks for the camera permission the first time. Everything they capture stays on your phone. None of it is uploaded, ever.
The camera runs as a foreground service with an ongoing notification while recording. Android requires this, and it's how recording keeps going with the screen off. There is no cloud upload, no background recording, and no analytics on any of it.
Accounts are Sign in with Google. There's no separate password to create or for us to store. We keep your email address and the authentication record with Supabase (our backend provider), plus your spanner balance and a ledger of top-ups and spends. Google's sign-in also shares your name and a link to your profile picture (Google shows you exactly what it shares before you tap). We keep your name with your account. It may power a friendly touch one day, like greeting you by name. The profile picture we don't use or show anywhere: we've no interest in your selfies, we're all about cars.
When you run a diagnosis, the job goes to our server and on to our mechanic, built on Anthropic's Claude, working with our own car-by-car reference library and fault research on top. The mechanic gets your fault codes, the car's make, model, year and engine, the sensor readings that matter, your question, and any glovebox facts you've chosen to share. It never gets your VIN, registration, name, location, or anything from the paperwork section. Our server keeps a record of paid jobs (the question, the answer, and the car's make/model/year) tied to your account, for billing integrity and to make the mechanic better at recurring faults.
When you add a car by number plate, the reg is sent via our server to the UK Government's DVLA Vehicle Enquiry Service and DVSA MOT History API, which return the public record for that vehicle (make, colour, engine size, MOT and tax status). The result is stored on your phone, encrypted. We don't keep a copy server-side.
Map tiles are fetched from OpenFreeMap, so like any website, its servers see your IP address and which map areas you load. If you use navigation, your chosen start point and destination are sent via our server to OpenRouteService to calculate the route.
Some map features work from wherever you happen to be rather than from a route you've asked for, and they can't do that without saying roughly where that is:
Your live speed and the second-by-second track of a drive stay on the phone. They are never uploaded. None of the above is stored against your account or used to build a picture of where you go, and the app never uses your location in the background: when the screen goes off mid-drive, location stops.
Spanner top-ups are handled by Stripe on the web and by Google Play in the app. Either way we never see or store your card details. We record only that a top-up happened, so your balance is right.
Beta improvement data (what beta builds send back and why) is covered in "While we're in beta" above.
On your phone: uninstalling the app deletes all local data. You can also delete individual cars or fields in the garage at any time.
On our server: your account, spanner ledger, and paid-job records are kept while your account exists. To delete your account and its server-side data, email ask@jim.scot from your account's address and we'll remove it. Beta or not, this works today. Aggregated, de-identified improvement data (e.g. "this adapter fails on this command") may be retained, as it contains nothing about you.
Who we are: OBD Mechanic is a J-I-M production, made in Scotland, UK. Contact: ask@jim.scot.
Processors we rely on: Supabase (backend and authentication), Anthropic (AI processing), Stripe (web payments), Google Play Billing (in-app payments on Play builds), DVLA/DVSA (vehicle lookups), OpenFreeMap (map tiles), OpenRouteService (routing), Photon by Komoot (place search). Speed limits, nearby places and speed-camera data are built from OpenStreetMap (© OpenStreetMap contributors, ODbL) but served by us or bundled in the app. No OpenStreetMap service receives anything from you.
Your rights (UK GDPR): you can ask for a copy of the data we hold about you, ask us to correct it, or ask us to delete it: email ask@jim.scot. You also have the right to complain to the ICO, though we'd rather you told us first so we can fix it.
Children: the app is for drivers and vehicle owners and isn't directed at children under 13.
Changes: if this policy changes in a way that matters, we'll say so in the app's release notes and update the date at the top of this page.