RevDash
Legal
Privacy policy
RevDash is two things: an Android OBD-II dashboard that works entirely on your phone with no account, and an optional cloud service that stores trips you choose to upload. This policy covers both, and is explicit about which half is which.
RevDash is built and operated by Devin Norgarb (“I”, “we”). There is no advertising in the app or on this site, and no data is sold or rented to anyone.
The short version
- The app works with no account and no network. Gauges, fault codes, charts, layouts and trip logging are all local.
- Nothing is uploaded until you create an account and tap Upload. There is no background or automatic upload.
- If you do upload, we store the trip, including GPS, if you recorded it, on a server we operate, and you can delete it.
- The trip replay page can load Google photorealistic 3D Maps when a Maps API key is configured. That requests map imagery from Google for the area of the drive. The 2D map is still served from this origin. You can switch between them.
- The landing page, the docs, this privacy policy, and the cloud dashboard send page views to Google Analytics. Trip ids, share-link tokens, GPS, and vehicle readings are not included.
- The app sends crash reports and anonymous usage events. Crash reports can include a screenshot of the screen you were on. Read that section.
- We do not sell your data.
1. What stays on your device
Whether or not you ever make an account:
- Vehicle profiles: name, preferred adapter id, protocol hint, fuel type, and dashboard layout.
- App settings: theme, units, chart window, poll pace, keep-screen-on, and whether the app may prompt to enable Bluetooth.
- Imported PIDs and alarms.
- Trip logs: timestamped OBD readings and, when you have granted location permission, GPS columns (latitude, longitude, altitude, speed, bearing, accuracy).
- Backup zips: files you export or import through Android’s document picker.
Uninstalling the app or clearing its storage deletes all of this. Files you exported with the system file picker are yours, wherever you saved them.
2. Bluetooth and Wi-Fi
The app uses Bluetooth Classic, Bluetooth Low Energy, and optionally Wi-Fi, to find ELM327 adapters and to exchange OBD-II commands with the one you select. The adapter’s name and identifier are stored in the active vehicle profile so reconnecting does not need a fresh scan. Adapter identifiers are not uploaded and are not sent to any analytics service.
3. Location
Precise location is requested for two reasons:
- Finding adapters: some Android versions require location permission to discover nearby Bluetooth devices.
- Trip logs: if you record a trip, GPS coordinates are written into the log next to the OBD columns.
Location is never streamed live. If you decline the permission, everything else still works; you simply get a trip with no route. If you granted it and later upload a trip, the GPS columns go with it. That is what draws the map on the replay page.
4. RevDash Cloud, only if you sign in
Creating an account is optional and the app is fully usable without one. If you create one, we store:
| Data | Why |
|---|---|
| Email address and a hashed password | To sign you in. The password is stored only as a slow one-way hash, never in a readable form. |
| Session tokens (stored hashed) and the browser or app user-agent that created them | To keep you signed in and let you sign out everywhere. |
| Device and vehicle names you have set | So trips can be attributed to the right car and phone. |
| Trip records: start and end time, duration, sample count, units | The trip list, and enforcing your plan’s limits. |
| The trip telemetry itself, including GPS: held as files in object storage on the same server | This is what the replay draws. |
| Subscription state and the payment provider’s identifiers, if you have paid | To know which plan you are on. |
| Uploader tokens for Torque Pro, stored hashed | So a third-party recorder can send drives to your account without knowing your password. |
Uploads are manual. A trip stays on the phone until you are signed in and press Upload. There is no background sync, no “upload on Wi-Fi” behaviour, and no upload at all without an account.
Where it is stored
On a virtual private server that we operate. Telemetry never passes through a third-party analytics or storage provider on the way in or out of replay. Backups are encrypted copies held with a separate storage provider so that one failed disk is not the end of your trip history.
How long it is kept
| Plan | Trips kept |
|---|---|
| Free | Up to 20 uploads a month, kept for 30 days from the end of the drive, then deleted automatically. |
| Pro | Kept until you delete them or close the account. |
Share links
If you create a share link for a trip, anyone holding that link can view that one trip without signing in. That is the point of it. The link carries a 256-bit random token, we store only a hash of it, and it stops working after it expires (30 days by default). A shared trip does not reveal which vehicle it came from. Treat a share link like a key: anyone you send it to can pass it on.
Deleting it
You can delete an individual trip at any time. Deleting your account signs out every session immediately, releases your email address, and queues your stored telemetry for erasure. Backups age out on their own schedule, so a copy may persist in an encrypted backup for a short period after deletion.
5. Crash reports and analytics
This section describes the only data the app sends without you pressing anything, so it is worth reading rather than skipping.
Crash and performance reporting (Sentry)
The app reports crashes, performance traces, and a sample of sessions to a Sentry instance that we host ourselves, not to a third-party analytics company. These reports include the app version, the Android version, the device model, a stack trace, and a record of which screens and controls were used in the run-up to the problem. Personal identifiers such as your IP address are not attached to these reports.
Crash reports can include a screenshot of the screen that was showing when the app crashed, and a description of the on-screen layout. If the app crashes while a trip or a map is on screen, that image may contain your data, potentially including a location.
Session replay, when sampled, masks all text and all images before it leaves the phone. Reports are used to fix faults and nothing else.
Usage analytics (Google Analytics for Firebase)
The app counts screen views and a few product events, connect, disconnect, trip start and stop, code refresh and clear. These go to Google. They do not include vehicle readings, GPS coordinates, fault codes, or Bluetooth addresses. Advertising identifier collection is switched off.
6. This website
The landing page (/), the docs (/docs), this privacy
policy (/privacy), and the dashboard (/app, and share
links at /s) load Google Analytics 4. It counts page views. On the
dashboard those are sign-in, the drive list, account, admin, and that a trip or a
shared trip was opened. It does not include trip ids, share-link
tokens, vehicle readings, GPS coordinates, or the email you signed in with.
Advertising features and Google signals are switched off.
Aside from that tag, the landing page and the docs load no other third-party scripts, fonts, or images.
Trip replay is different again. The default view is a photorealistic 3D globe from Google Maps, which fetches imagery for the area you are looking at. Google therefore sees the viewport of that drive (and your IP address, as with any HTTPS request to them). A 2D map, served from this origin, is one click away. Ordinary web server logs on our side record requests, including IP addresses, and are kept only for operating and securing the service.
7. Payments
Paid subscriptions are bought and paid for through Google Play, which is the seller of record. Card details are entered on Google’s systems and are never seen by or stored on our server; we receive only a purchase identifier, the product bought, and whether the subscription is active. There is no other payment processor, and no way to pay us directly.
8. Your rights
You can ask for a copy of what we hold about you, ask for it to be corrected, or have it deleted. Trip data can be exported yourself at any time as a full-resolution CSV from the replay page, on the free plan as well as Pro. For anything else, use the contact address below. Depending on where you live you may also have the right to complain to a data protection authority.
9. Children
RevDash is a vehicle diagnostic tool and is not directed at children under 13. We do not knowingly collect personal information from children.
10. Safety and scope
RevDash reads generic powertrain OBD-II. It does not write to the ECU, does not run actuator tests, and is not a substitute for a professional scan tool. It is not affiliated with any vehicle manufacturer. Do not operate a phone while driving.
11. Changes
If this policy changes in a way that affects what we collect or why, the date at the top changes and the current version always lives at revdash.me/privacy.
12. Contact
Questions about this policy: the email listed for the publisher on the Google Play
listing for RevDash (app.revdash.obd).