Effective date: October 22, 2026
Application: Cavox
Application owner: Larisa Kozlova
Contact email: larisakozlova.dev@gmail.com
This Privacy Policy explains what data Cavox (the “Application”) collects and processes, how that data is used, where it is stored, which third-party services may process it, and how users can request deletion of their account and related data.
The Application may collect and process the following categories of data.
When you register, sign in, or use the Application, we may process:
Registration and authentication are provided through Supabase.
The Application may process vehicle data, including the vehicle identification number (VIN).
A readable VIN may be sent to the Cavox backend when identifying a vehicle or requesting a diagnosis. It may be stored for vehicles saved in the synchronized Garage, in a shared vehicle-identification cache together with decoded vehicle details, and in diagnostic session logs uploaded to and stored on the backend, as described in Section 1.6. A SHA-256 hash of the VIN may be stored in vehicle and diagnosis records.
These VIN values and hashes may be linked to a user or vehicle when associated with an account or diagnostic history.
The Application may collect and store data received from a vehicle through an OBD adapter, including:
This data is used to display diagnostic history, analyze trouble codes, and provide reference information about possible causes of vehicle issues.
To manage paid features, the Application may process:
Payments are processed through Apple App Store. Subscription status and entitlement management may be handled through RevenueCat.
The Application does not receive, process, or store full payment card details.
The Application may use Bluetooth or Wi-Fi to connect to a vehicle OBD adapter.
Bluetooth and Wi-Fi are used on the user’s device to establish a connection to the adapter and read diagnostic information.
Adapter and connection details, as well as raw OBD commands and responses, may also be recorded in diagnostic session logs and uploaded as described in Section 1.6.
To operate the Application, maintain security, and diagnose errors, the Application and third-party services may process technical data, including:
This data is used for Application functionality, security, error correction, and service quality improvement.
The Application also keeps a diagnostic session log that may contain a VIN, adapter or connection details, raw OBD traffic, and Application events. When an authenticated account is active, log chunks may be uploaded automatically to the Cavox backend on Supabase for troubleshooting and support. Manual sharing is not required for this upload.
We use collected data to:
To generate AI-assisted diagnostic explanations, the Application may send diagnostic data to OpenAI, including DTC codes, technical vehicle parameters, and symptom descriptions if provided by the user.
The AI diagnostic request uses diagnostic inputs rather than the raw session log. Symptom descriptions provided by the user are included in the request and may contain a VIN, email address, or adapter details if the user enters them.
AI-assisted diagnostics are provided for informational reference only and may contain errors, inaccuracies, or incomplete information. They are not professional vehicle diagnostics, a technical conclusion, a repair recommendation, or a basis for driving safety decisions.
If your vehicle shows warnings, unusual behavior, or any signs of unsafe operation, contact a qualified mechanic, service center, or official dealer.
The Application uses third-party services to operate. The data shared depends on the function and may include the categories described below.
These services process data under their own terms and applicable agreements.
Supabase is used for:
OpenAI is used to generate reference AI explanations of diagnostic trouble codes and possible causes.
The AI diagnostic request uses diagnostic inputs rather than the raw session log. User-provided symptom text is sent to OpenAI for analysis and may contain a VIN, email address, or adapter details if the user enters them.
We use Google Analytics for Firebase to understand how the Application is used and to measure and improve our advertising. Firebase Crashlytics is used for crash and error reports, and Firebase Remote Config supplies app configuration.
Google Analytics for Firebase automatically collects app-usage events, such as app opens, screen views, and sessions, and in-app purchase and subscription events reported by Apple’s StoreKit, including the product identifier and price. It also collects device and app information, such as device model, operating-system version, app version, and language, and an approximate location derived from the IP address. In addition, the Application sends its own events about how features are used, such as onboarding steps, paywall views, trial starts, and purchases.
Each installation of the Application has a random app-instance identifier. When a Cavox account identifier is available, analytics data is associated with it, so it can be connected with other data we hold about your account, such as your subscription status. The app-instance identifier is also passed to RevenueCat for subscription attribution.
If you start using the Application as a guest and later sign in, for example with Sign in with Apple, the analytics data from your guest use stays associated with the same account identifier.
Crash reports may include context added by the Application, such as vehicle model, OBD protocol, and connection type.
Google describes how it uses this information on its page How Google uses information from sites or apps that use our services.
We may advertise the Application with Google Ads. When our Google Analytics property is linked to our Google Ads account, we can measure which ads lead to installs, trial starts, and purchases, and Google can use these results to deliver our ads. Through this link, Google receives the analytics events described above, including install, trial-start, and purchase events, together with the identifiers and device information mentioned earlier.
The Google Analytics Advertising Features we use or may use are conversion measurement for Google Ads, advertising audiences, Google signals, and demographics and interests reporting. Google may measure the results of our ads with aggregated and modeled reporting, with Apple’s SKAdNetwork, and with on-device conversion measurement, in which the matching takes place on your device. Google may also use this data to personalize the ads it shows and, through Google signals, associate it with the Google Accounts of users who have turned on ads personalization.
We and Google may use first-party identifiers, namely the app-instance identifier and, when available, the Cavox account identifier, together with third-party identifiers and information that Google holds, such as identifiers linked to Google Accounts through Google signals and records of ad views and clicks, to measure the results of our ads and to personalize ads.
Google processes this data under its own terms and privacy policy.
We also advertise the Application with Apple Ads. After installation, the Application obtains an attribution token from Apple’s AdServices framework and sends it to RevenueCat, which uses it to determine whether the installation came from an Apple Ads campaign. The result contains campaign-level information, such as the campaign, ad group, keyword, and country. This does not require permission to track.
RevenueCat is used for:
Apple App Store is used to process payments, subscriptions, cancellations, and refunds according to Apple’s rules.
The Application does not store or process full payment card details.
Application data is stored in the infrastructure of Supabase and the other third-party services described above, as required for Application functionality.
We take reasonable technical and organizational measures to protect data against unauthorized access, alteration, disclosure, or destruction.
However, no method of internet transmission or electronic storage can be guaranteed to be completely secure.
Some data is processed locally on the user’s device, including the Bluetooth or Wi-Fi connection to the OBD adapter.
The diagnostic session log described in Section 1.6 may nevertheless contain adapter or connection details and may be uploaded automatically to the Application backend when an authenticated account is active.
Cavox may be available to users in different countries.
The Application and our advertising use third-party services including Supabase, OpenAI, Google Firebase, Google Ads, RevenueCat, Apple App Store, and Apple Ads. Data may be processed and stored on servers located in different jurisdictions depending on those services’ infrastructure.
Data used for Application functionality, authentication, diagnostic history, subscription management, and AI-assisted diagnostics may therefore be processed outside the user’s country of residence.
Account data and user-owned diagnostic records are stored while needed to provide the Application. The effect of deleting an account on these and other data is described in Section 9.
Some technical data may be retained longer if necessary for security, abuse prevention, legal obligations, payment processing, dispute resolution, or protection of the Application owner’s legitimate interests.
Diagnostic support logs are stored separately from diagnostic history and may remain after account deletion unless removed through a separate process. Contact us to ask about these logs or request their deletion.
Purchase and subscription data may be retained by Apple, RevenueCat, or other payment infrastructure providers according to their own rules, terms, and legal obligations.
Analytics and advertising data is retained by Google according to the data-retention settings of our Google Analytics property and Google’s own policies.
The user may delete their account through the Application if this feature is available in the current version. The data removed by that process is described below.
When in-app account deletion succeeds, the account is removed. Database relationships also remove its synchronized Garage records, which may contain a readable VIN, and AI diagnostic jobs, which may contain scan results and VIN hashes. Other records that may contain user or vehicle data are not necessarily removed; see the exceptions below.
Shared vehicle-identification caches may retain a readable VIN, VIN hashes, and decoded vehicle details after account deletion; the current account-deletion process does not automatically remove these entries.
Some data may remain after account deletion if required for legal obligations, security, abuse prevention, payment processing, dispute resolution, or if it is stored by Apple, RevenueCat, Google, or other third-party services under their own rules.
Diagnostic support logs are not automatically removed by this account-deletion process. You may request deletion of those logs using the contact email below.
If the user cannot delete the account through the Application, they may request deletion by contacting larisakozlova.dev@gmail.com.
Paid features may be provided through subscriptions.
Payments are processed through Apple App Store. Subscription status may be managed through RevenueCat.
The Application does not receive or store full payment card details.
Users can manage or cancel subscriptions through Apple ID / App Store settings.
Deleting the account in the Application or deleting the Application from the device does not always cancel an active subscription. To cancel a subscription, the user must use Apple ID / App Store settings.
Users may contact us at larisakozlova.dev@gmail.com to:
Depending on the user’s country of residence, additional rights may apply, including rights of access, correction, deletion, restriction of processing, data portability, or objection to processing.
We may request additional information to verify the user’s identity before fulfilling a request.
The Application is intended for users who are legally allowed to operate or maintain a vehicle under the laws of their country.
The Application is not intended for children under 13 and is not intended to knowingly collect children’s data. If we become aware that we have received data from a child without required parental or guardian consent, we will take reasonable steps to delete such data.
The user is responsible for safe use of the OBD adapter, compliance with vehicle diagnostic safety rules, and using the Application only in safe conditions.
Do not use the Application while driving if it distracts from the road or violates traffic laws.
We may update this Privacy Policy from time to time.
If we make material changes, we may notify users through the Application or by another available method.
The current version of this Privacy Policy is available at: https://LARIkoz.github.io/diagnostic-ai-legal/privacy-policy.
For questions about this Privacy Policy or data processing, contact us:
Email: larisakozlova.dev@gmail.com
Application owner: Larisa Kozlova