Українська →

Privacy Policy of the Neiv app

Edition of October 14, 2026. Document version: 2026-10-14.

In short

Neiv is a navigator that keeps your position on the road when the GPS signal disappears or is distorted. To do that, the app reads data from your phone and from your car.

By default no data about your trips leaves your phone for our server until you allow it yourself. The app has no registration and no account; we do not require your name, your email or your phone number. If you write to us yourself (the feedback form, a vehicle request), you may leave a contact—it is optional. Navigation works in full even if you choose “Send nothing”. A few service connections to our server the app makes always—they carry neither your route nor your trip recordings, and the full list of them is in the section “What the app always does”.

Neiv keeps working when the screen is locked or the app is minimised: while it is running, it keeps reading your position from GPS and (if an adapter is connected) stays connected to the OBD adapter, so that when GPS disappears or lies, reckoning can take over without a gap. Sending of the data you have allowed may also happen from the background. The app does not ask for “Always” location permission; fully closing the app (swiping it up in the app switcher) stops all of this, whereas the Home button does not. In the App Store version we do not send the coordinates of your position: the traffic map, if you turned it on, sends the road segments you drove, without coordinates (see “The traffic map—a separate choice”).

Separately from the sending levels there is a “Traffic map” switch. It is off by default, is turned on and off on its own, and has its own section below.

The app has a paid subscription, a referral programme (“Invite a friend”) and a promotion for video authors. They work through our server, so they have a separate section below.

Who processes the data

The Neiv app is developed by Kiril Polishchuk (Поліщук Кіріл Васильович), individual entrepreneur registered in Ukraine, who is also the personal data controller; details: tax ID 3811908712, 23B Sviatoslava Khorobroho St, apt. 53, Berdychiv, Zhytomyr Oblast, 13303, Ukraine, phone +380 97 277 47 44. The same details are given in section 2 of the Terms of Use. Privacy contact: privacy@neiv.app.

The data is technically stored and delivered on our behalf by our processor Cloudflare, Inc.—servers, storage and receipt of mail sent to our addresses, including outside Ukraine (see “Where the data is stored and for how long”). A data processing agreement is in place with it, and it processes the data only on our instructions. Mail sent to support@neiv.app and privacy@neiv.app arrives in the developer’s mailbox at Google (Gmail)—a separate email service that processes mail under its own rules. The developer learns about new messages in Telegram: only a notification with the message number and a link to our database arrives there, without the text or your contact. The device service mark (DeviceCheck) is verified by Apple. Only for requests to join the closed Android test on the neiv.app/android website (not through the iPhone app), the email address from the request is added to the tester list in Google Play Console (Google); this is described in a separate notice at https://neiv.app/android/privacy/.

Only for messages for which you have separately allowed automatic AI analysis, the message text and technical context (without your contact) are also processed by OpenRouter, Inc. (USA), by the model developer TypeSafe AI, Inc. (USA), to which OpenRouter passes the request, and by Cloudflare’s Workers AI model—see “If you write to us through the feedback form, by email or on Telegram”.

What the app reads on your phone

This happens on the device and does not mean that the data goes anywhere.

The “phone only” mode. If no OBD adapter is connected, the phone itself can approximately estimate your position without GPS—from the sensors in the table above. This happens on the device: we do not receive a position calculated this way in the “Traffic map” passes, in trip recordings or by any other channel—this mode has no channel of its own. For the mode to turn on, the app uses the signed settings file from our server (a service connection from the section “What the app always does”); that file must be no more than 7 days old.

Trip recordings are stored in your phone’s memory. You can review them on the “Trips” screen and delete them at any time together with the app. If iCloud Backup is turned on for your phone, trip recordings are also included in that backup; it is kept in your Apple Account, and we have no access to it.

What the app always does

A few connections to our server are what the app needs in order to work at all, so they happen at any sending level—including at “Send nothing”. The list is complete:

• the signed settings file and service messages from us—the limits of work without GPS, the availability of the “phone only” mode and the announcements the app has to show you;
• confirmation of paid access and a time check—whether your subscription is active and how many free minutes are left. Without that check, guidance without GPS does not turn on;
• the map catalogue, the download of the region packages you chose yourself, and the automatic update of such a package if we withdraw it (over Wi-Fi only, and not in Low Data Mode);
• vehicle profiles—the tables from which the app learns how your model reports its speed. This is data signed by us—only numbers (the signal number, its position in the frame, the scale), and the code that reads it is built into the app;
• a table for your particular car—only if you ran an adapter check: for up to 30 days after the check, no more often than once every 6 hours, the app sends the server the random number of that check and asks whether we have prepared a table for your car (see “The adapter check with the “Check modes” button”). The request carries nothing else about you or your car;
• the vehicle list supplement—a list signed by us of the models added after your version of the app was released. The app downloads it when you open the vehicle picker, at the “Region map” step during first setup and for the result of a vehicle request; the request carries only the app’s service key, the same for all installations, and nothing about you or your car;
• the status of your vehicle requests—only if you sent a request and asked to be notified of the result: the app sends the random tickets of those requests and receives their status (see “If you write to us through the feedback form, by email or on Telegram”);
• the download of the traffic map for your region. This is receiving a ready-made map, not sending your own drives: sending is turned on by the separate “Traffic map” switch. The map is downloaded automatically, over cellular as well, and costs up to about 3 MiB a week;
• the speed camera database—public police data for on-road alerts. The request carries no position of yours; it is turned off in Settings → Road warnings;
• the boundaries of the temporarily occupied territories—a file the app uses to shade those territories and not route into them. The app may download updates automatically, including over mobile data; the request carries no position of yours;
• a one-time service mark of the device from Apple (DeviceCheck)—so that the starter free minutes are granted, and a friend in the referral programme is credited, only once per device. It is created only as a result of your own action and only in three cases: you tap “Get starter minutes” on the subscription screen (then it goes together with a random claim number); you enter a friend’s code and finish the setup; you turn on the “Traffic map” (once a day, to get permission to send). Without these actions the mark is neither created nor sent (more detail in the sections on the subscription, the referral programme and the traffic map).

None of these connections carries your route, your trip recordings, your name or your contacts.

What is sent to us—and only by your choice

You choose the level at first launch and can change it at any time: Settings → Data and privacy.

Send nothing

No data about your trips leaves the app. All navigation features work as usual. The service connections from the section “What the app always does” remain—they carry neither your route nor your trip recordings.

Level 1. Connection passport (nothing is pre-selected on the consent screen)

In plain words. The passport is a technical note about how your phone got along with the adapter in your car. It contains: whether the adapter connected and what the car replied; a short (60 s) sample of the data the adapter takes from the car (wheel speed; in PRO mode also steering, turn-rate, gear and engine-speed signals); if the connection failed, a short reason (for example “Bluetooth is off” or “the adapter did not answer”) and whether the car was moving; a summary comparing the car’s speed with the GPS speed; the phone model, iOS version, vehicle profile and the name of your adapter. It does not contain: your name, coordinates, route, VIN, names of other devices or Wi-Fi networks. It is kept for 12 months; switch it off in Settings → Data and privacy; to have it deleted, email privacy@neiv.app with your pseudonym. The full list follows.

Your route is not sent. When you connect the adapter in your car, the app sends a “connection passport”—no more than 20 per car × adapter pair over all time (plus one if the car was not running). Separately from this limit, the app sends a shorter failure passport when it could not find or connect the adapter you have already chosen, or the car did not answer it, and a summary after a drive if the link to the adapter dropped or was unstable, iOS routed internet traffic through the Wi-Fi adapter’s network for more than half a minute, the mode of working with the car turned out different from the one you chose, or the car’s data looked wrong, and also after the first comparison of the car’s speed with the GPS speed—both the very first one for the pair and the first after every change of the vehicle profile or of the tuning for it. For a car × adapter pair there is no more than one such passport per reason per day, three per day and ten per month, and no more than six per day for you in total. One passport is up to 96 KB, of which the compressed raw-stream sample is up to 64 KB. It contains:

• whether the adapter connected and whether speed can be read; the adapter’s answers to the standard initialisation, supported-parameters and speed requests;
• how the connection went, and if it failed or the link dropped—the technical reason: the step at which the connection stopped (Bluetooth off, restarting or not allowed, adapter not found, a device that is not an adapter or someone else’s adapter found, the adapter busy with another app, the adapter or the car did not answer, the protocol did not fit) and whether the car was moving at the moment the app first requested its data (yes/no); system error codes, the standard service numbers of the adapter’s Bluetooth services, attempt counters and step durations in seconds (including how long the app waited in the background); in PRO mode—how many bus frames, how many distinct frame numbers and which highest number the adapter passed on in 10 seconds, without the frames’ contents; for dropouts—the reason, the duration, whether the link recovered, whether the adapter restarted and whether the car was moving at that moment (yes/no). For a Wi-Fi adapter, only the network state as classes: whether Wi-Fi is connected, whether this network has internet access and for how many seconds iOS routed internet traffic through the adapter’s network, whether its address looks like an adapter’s, whether local network access is allowed, whether the app recognised the adapter in it and switched to it, counters of connections and of data received, how long the passport waited to be sent and how the connection to the adapter ended. The passport contains no names of nearby devices, no Wi-Fi network name, no access point address and no IP addresses—instead of a device name only the mark “other” or an OBD-adapter brand from the list built into the app, and instead of the network—only the class of its private address range (like a typical adapter’s or other), without the address itself;
• if the car is moving but the adapter you chose never connected—the mark “the car was moving”, the duration of movement as a range (up to 5 minutes, 5–15, 15–60 or over an hour), whether the adapter connected after all and roughly how long it took (to the nearest 30 seconds), whether the app was open or running in the background, the type of the chosen adapter (Bluetooth or Wi-Fi), the Bluetooth or Wi-Fi state as classes, as above, and counters of connection attempts—without speed, distance, coordinates or time of day;
• a sample of the adapter’s raw data stream for the first 60 seconds after connecting. In BASE mode these are the answers to the standard speed and mileage requests. In PRO mode the app passively listens to the car’s bus, and then the sample contains raw CAN bus frames, but only frames of the signals the app uses: wheel speeds and rotation direction, steering angle, the car’s turn rate, mileage, engine speed and engine-reported speed, gear. The app discards all other bus frames on the phone (the exception is the adapter check you start yourself, see below);
• the tuning state for your car: the distance coefficient the app uses to convert the speed from the car into metres travelled, whether it is already locked, how many measurements and how many kilometres of driving it rests on and how many measurements were rejected; speed-signal quality counters (how many frames arrived, how many were rejected and why, whether there were gaps, whether the speed “froze”); how the speed from the car agrees with the GPS speed while driving—only summary figures computed on the phone: the ratio of these speeds, its spread and how closely they change together, on how many measurements the comparison was made, for how many seconds the car showed zero while GPS saw movement (and vice versa), for how many seconds the speed “froze” and whether there were jumps, and the speed range of the comparison (in steps of 10 km/h)—without the speed series themselves, coordinates or time of day; the mode you chose and the mode actually running, with the reason for the switch; counters of speed requests and of the car’s answers to them (how many went unanswered, how often and how quickly the car answered); the vehicle profile number, its revision and where it came from (built into the app or from our server), and the state of the check of a new table for your car (whether the app is still checking it, has accepted or rejected it, for what reason, the counters of this check and the highest speed at which it was carried out—only in steps of 10 km/h);
• the time of sending (UTC): exact in the first three passports of a pair, only the date in the following ones and in failure passports and summaries after a drive (separately from the passport’s contents, our storage, as for any file, automatically records the moment of receipt; for a failure passport or a summary it may be close to the time of the drive);
• your pseudonym (see “A pseudonym instead of a name”), phone model, iOS version, app version and build, vehicle profile, adapter type and the name your adapter presents itself with (its Bluetooth name or its firmware response; in test builds, your note about it)—only your adapter, not other devices nearby.

The passport contains no coordinates and no route. We do not collect the VIN: the regular passport contains no VIN frames, and in the adapter check recording the app masks frames that look like a VIN on the phone, and our server does it again. The passport is sent over any network, including cellular in “Wi-Fi only” mode. It goes only after you tap “Save choice” on the consent screen; if you turn it off there or choose “Send nothing”, no passport is sent.

Separately from the limit of 20 goes the adapter check you start yourself—see “The adapter check with the “Check modes” button” below.

Who controls the amount. The limit of 20 and the limits for failure passports are enforced by the app itself, and our server can only lower them. We can stop or limit the acceptance of passports at any time—for everyone or for a single pseudonym; we cannot expand collection beyond what is described here without your consent. To know the current limits, the app from time to time sends the server a short request carrying only your pseudonym and the date of the edition of this policy that you accepted, and, when you switch extended diagnostics on or off, that choice.

A message sent through the feedback form is linked to your passports only when you tick a separate box for that yourself (off by default)—see “If you write to us through the feedback form”.

What for: to tune speed reading for your particular car, to check that the app decodes your particular car’s data correctly (three samples are sometimes not enough for that), to see which adapters really work, and to find the cause when the adapter does not connect or the car’s data is read incorrectly.

The adapter check with the “Check modes” button

The “Check modes” button (Settings → Car adapter, and also the adapter connection step when you first get to know the app) tries BASE and PRO modes in turn and switches on the better one by itself. Its result is sent as the same kind of passport with the exact time—only when you tap it, and no more than 10 times a day; it does not count towards the limit of 20.

The check recording. Together with the result the app sends a separate recording of the check itself—so that we can find where exactly your car reports its speed if the app does not read it yet or reads it wrongly. The check itself consists of several short phases, and the recording covers each of them. It contains:

• speed polling (BASE mode)—up to 10 seconds of standard speed requests and the car’s answers to them, verbatim, together with the adapter’s service replies;
• bus listening (PRO mode)—up to 10 seconds of the frames the adapter lets through while the PRO mode is being checked;
• all the frames the car’s bus broadcasts while the car is standing—up to 10 seconds, verbatim as the adapter returned them, including damaged lines and the adapter’s service replies, as well as the commands the app sent to the adapter;
• conditionally, up to 60 seconds of your first drive-off after the check: only with trusted GPS; the recording is aborted as soon as GPS loses trust. If the app already reads the speed from your car, it does not switch the adapter while moving and records only what the adapter returns anyway (the answers to the usual speed requests or the frames the app already listens to)—so that position keeping loses nothing. All bus frames are recorded while moving only when the speed from the car cannot be read. The recording while moving ends by itself as soon as you stop or 60 seconds have passed, and is aborted immediately if anything goes wrong;
• GPS speed once a second and its error—only within these 60 seconds, without coordinates, heading or time of day. From it we recognise which bus signal is the speed;
• recording quality counters (how many lines arrived, how many were damaged, whether the adapter’s memory overflowed), the tuning state for your car (as in the passport above), the adapter mode and type, the vehicle profile, the car’s make (its number in our list) and year, the phone model, the app build, only the date of the check without the time, your pseudonym and a fingerprint of the car × adapter pair.

We do not collect the VIN. Some cars broadcast their VIN on the bus. The app replaces frames that look like a VIN with asterisks on the phone, before sending, and our server checks the recording again and masks in the same way anything that may have slipped through. The recording contains no coordinates, no route and no time of day.

How many and when. No more than 3 recordings a day and no more than 10 for one car × adapter pair over all time; one recording is up to 1.5 MB before compression (up to 1 MiB compressed). The recording is sent only when “Connection passport” or a higher level is selected, and only after you have confirmed this edition of the policy. “Send nothing” also stops the drive-off recording if it has not been made yet.

What happens next. If the recordings show how your car reports its speed, we may prepare a decoding table for your particular car and bind it to the random number of this check (or to the ticket of your vehicle request). For up to 30 days after the check, no more often than once every 6 hours, the app asks our server whether such a table exists, and downloads it. The table is only numbers (the signal number, its position in the frame, the scale), signed by us; the code that reads it is built into the app. It adds no data about you. The app first checks a new table against the GPS speed on your next trips and only then uses it for position keeping; if it does not match, the app discards it and works as before. If the same table is independently confirmed by at least two different car × adapter pairs, we may add it for all owners of this model—by then without any link to you.

How long it is stored. Check recordings—12 months from receipt, after which they are deleted by an automatic storage rule. Until then they are labelled with your pseudonym and are deleted together with your other data at your request (see “Your rights”). They are not part of extended diagnostics.

Extended connection diagnostics (a separate consent, off by default)

If passports are not enough to understand why your adapter does not work, the app may offer extended diagnostics. This is a separate, voluntary consent: it is off by default, it is not part of the sending levels and is not turned on together with them. Declining blocks nothing—the navigator and the regular passport work as before.

Where it is offered. A window appears no more than once per car × adapter pair and no more often than once a week—when the adapter is new to you and no data comes from the car: the adapter failed to finish starting up twice in a row, the car answers but no speed comes through, or the car was moving but the adapter got no reply at all. The window never appears while you are driving. You can turn extended diagnostics on or off yourself at any time: Settings → Data and privacy → Extended connection diagnostics. It can be turned on only when the “Connection passport” level or a higher one is selected.

What is sent. The same contents as the connection passport above (the adapter check recording is not part of it), only more often and always with the date instead of the exact time: up to 5 passports a day, no more often than once every 10 minutes, up to 60 per consent—including when the adapter did not finish starting up. They do not count towards the limit of 20.

How long it lasts. 14 days from your consent; if we marked your pseudonym for diagnostics beforehand, the first period may be longer, but no more than 30 days from your consent. If we are still investigating, we may extend it, but no further than 30 days from your consent; after that it turns itself off, and turning it on again needs your new consent. We may stop or limit it earlier—as soon as we have found the cause. The server never turns it on by itself and never expands it beyond these limits.

How long it is stored. Separately from regular passports, for 90 days from receipt, after which they are deleted by an automatic storage rule. We delete them earlier when you turn extended diagnostics off, create a new pseudonym (which also turns it off) or ask us to delete your data, and when the investigation is closed and the data is no longer needed. We delete them immediately; if that fails, they are deleted automatically no later than 90 days from receipt.

Level 2. Problem reports—a trip sent by hand

There are no automatic reports by marker. A recorded trip can be sent only with the button on its card on the “Trips” screen—a separate action, one trip at a time. Such a trip travels in full, as at level 3: the route, the data from the car and the readings of the phone’s sensors. The button works at any level except “Send nothing”. The button exists only for trips recorded in full: if only the trip summary (track map, date, time and distance) is kept on the phone, there is nothing to send. In the App Store versions of the app trips are not recorded in full, so this button is not there and there is nothing to send by hand; full trip recordings are made only in test builds of the app.

Without your tap nothing is sent.

What for: a trip in which the navigator got it wrong is the most valuable data for fixing it.

Level 3. Automatic sending of full trips (turned on and off by you)

Every recorded trip is sent by itself, without a tap. The entire trip is sent: the route from start to finish, the data from the car, and the full sensor stream of the phone—100 measurements per second (gyroscope, accelerometer, barometer). We do not thin this stream out: it is exactly where the behavior of the suspension and of the turns shows, which is what the level exists for.

We do not trim the start and the end of the route. That means the recording will show the place where you get into the car and where you leave it—usually home and work. We do this deliberately: the first minutes of a trip are where the scale factor for your particular car is picked up, and without them the level loses its point. The same applies to a trip you send by hand. If that is not acceptable for you, do not turn this level on and do not send trips by hand—then no trip goes anywhere.

What for: to work out exactly how your car model reports speed and angles, and to add it to the list of fully supported cars.

This is the largest amount of data about you, so this level is turned on by a separate confirmation and never turns itself on.

In the App Store versions of the app automatic sending of trips is turned off, and this level is not offered. If you chose it in a test build, the choice is kept and shown as “Connection passport”, but raw trip recordings are not made on the phone and are not sent anywhere, so the level acts the same as “Connection passport”. Full trip recordings exist only in test builds of the app.

The traffic map—a separate choice

This is a separate switch, not a level on the scale above. It is off by default, is turned on separately, is turned off separately, and works at any chosen level—even at “Send nothing”. We ask about it on a separate screen because its purpose is a different one: not “to fine-tune dead reckoning for your particular car”, but “to build a shared map of travel times for everyone”.

What exactly is sent

• a road-graph segment—a stretch of road between two junctions, in your direction of travel (the segments of one trip go in the order you drove them);
• the time it took you to drive that segment, and the metres you covered on it;
• how much faster or slower than the average speed on that segment you drove it—one number per segment, only for a pass without stops and only when the map already covers the segment (it does not contain the accumulated estimate of your driving style);
• the day of the week and the 15-minute slot in which you drove it;
• how long you stood still at the end of the segment—this is how traffic lights are found;
• the road class and position quality on the segment: its uncertainty and whether the position was carried by GPS or by dead reckoning;
• the week of the trip (in UTC), your time zone offset and the map region. Together with the day of the week and the 15-minute slot this gives the date and time you drove the segment to within 15 minutes;
• the trip totals: its duration and length, how many segments were recorded and dropped;
• service quality flags: whether the phone clock jumped, whether GPS spoofing was noticed, how many episodes of doubtful GPS were found and discarded, whether the trip recording was cut off (for example, the app closed in the middle of the trip);
• the region map version and the app version.

To get permission to send, once a day the app shows the server a one-time service mark of the device from Apple (DeviceCheck): it proves only that this is a genuine device with our app, is not stored, and is linked neither to trips nor to the pseudonym.

The list above is complete: these are not “technical indicators”. It carries no name, no phone number, no email and no account—the app has no accounts at all. The file contains no coordinates, and the first and last 500 metres of every trip are not recorded at all—precisely because that is usually home and work. However, a trip file is the road segments you drove, in order, so the road you took in the middle of the trip can be reconstructed from it until the server merges the file into the map (at most 14 days).

When it is collected

While the app is running and you are driving—on any trip, even without a planned route. This includes the background: if you minimise the app or lock the screen and it keeps running, collection continues. When the app is fully closed, no road data is collected: collection does not start itself in the background (iOS may wake the app only to finish downloading a map). The app does not ask for the “always” location permission for this either.

Under which key

Every trip travels under its own one-time random code, created at the start of that trip and never repeated. It is not your pseudonym from the section below: the two data streams are never stitched together—neither on the phone nor on the server. That is why your trips do not add up into one history: we cannot tell that two trips belong to the same person.

How long it is stored

• a trip file that was sent—deleted as soon as the server has merged it into the aggregated map; if the merge did not happen, an automatic storage rule deletes the file within 14 days at the latest;
• the service record of receiving a trip (its one-time code, region, week, time of receipt, app version, file size, the intake result—merged or rejected and why)—90 days from receipt, after which it is deleted automatically; it contains no coordinates, no passes themselves and not your pseudonym;
• the aggregated map (the average speed on a segment by day type and 30-minute slot)—indefinitely: it no longer contains either trips or their codes, and an individual drive cannot be recovered from it. Whether dead reckoning carried the position is kept in the aggregate only as a “yes/no” mark for a segment and slot; it is not part of the map that users receive, and neither is any sign of GPS jamming or spoofing.

Whom it is passed to

No one except Cloudflare, on whose servers the data is stored (see “Who processes the data”). The only thing that leaves is the aggregated map itself, and it comes back to the users of the app, you included. Everyone gets the map regardless of whether you turned this switch on: access to it will never be a reward for data, and no paid feature depends on it.

Occupied and frontline territories

Road-pass data for the traffic map is neither collected nor published for the temporarily occupied territories of Ukraine: the app does not record passes within these territories, and the server does not accept or publish data for the Autonomous Republic of Crimea, the city of Sevastopol and Luhansk Oblast, and for other oblasts only within the areas free from occupation. For frontline oblasts (Donetsk, Zaporizhzhia, Kherson, Kharkiv, Sumy, Mykolaiv and Dnipropetrovsk), the map is published without data about stops at intersections: without the share and duration of stops and without the traffic-light mark.

How to withdraw, and what gets deleted

The switch can be turned off at any time: Settings → Data and privacy → Traffic map. At that very moment the app stops collecting, erases from the phone everything that has not gone out yet, and asks the server to delete the trips that were sent but not yet merged into the averages.

Honestly about the limit: a contribution that has already been merged into the averages cannot be taken out—there is no longer either your trip or its code in there, so there is nothing to look for. This is a property of an aggregate, not our reluctance; that is why we say it before you turn the switch on, not afterwards.

The estimate of your driving style stays on the phone

The app estimates how much faster or slower your driving is than average—in order to show you a more accurate travel time. That estimate is computed on the phone, stored on the phone and is never sent to the server: a pass carries only the speed deviation on that one segment, described in the list above. Turning the switch off does not erase it: it is not our data about you, it is your own calculation that goes nowhere.

Which trips are never sent—at any level

• Trips without an OBD adapter or without a single GPS fix. If the adapter was not connected or GPS gave no point at all, the trip is not sent at all: without them the recording proves nothing, while the risk for you remains. This applies to trip recordings. “Traffic map” passes, if you turned it on, are collected without an adapter too, and the connection passport may report that the car was moving but the adapter did not connect—this is described in the relevant sections above.
• The demo trip (the ready-made clip the app plays on the introduction screen).
• “Check without GPS”—the mode in which you turn GPS off yourself to see dead reckoning. Such recordings go into separate storage and are not mixed with real trips: GPS disappeared there by your will, not because of interference.
• The engineering developer mode—everything recorded with the debugging levers switched on.

A pseudonym instead of a name

The data you have allowed to be sent is labeled with a random pseudonym that the app itself creates on your phone. The pseudonym is linked neither to your Apple Account, nor to an advertising identifier, nor to a phone number, nor to the car’s VIN.

You can replace it at any time: Settings → Data and privacy → Create a new pseudonym. After the replacement, new data goes under the new pseudonym, and we ourselves do not link it to what was sent earlier. However, connection passports and check recordings contain the car profile, adapter data and phone model, so by matching these data old and new records could in theory be correlated. The link can be broken completely only by deleting what was sent (see “Your rights”); a deletion request is tied to the pseudonym, so send it before the replacement. Deleting the app erases the pseudonym from the phone; but if iCloud Backup is on, restoring the phone from a backup brings it back.

If you write to us through the feedback form, by email or on Telegram

There is a feedback form in Settings: Settings → Feedback and help. It can also be opened from the connection diagnostics window, and a vehicle request—from the vehicle picker screens (the “Submit a request” button). It is a letter you compose and send yourself, as a separate action. What travels with it:

• your text and the category you chose (“bug”, “unclear”, “idea”, “other”; a request from the vehicle picker screens has a category of its own—“vehicle request”);
• a contact—if you want to give one: an email or a Telegram handle. Without it the form works exactly the same; there is simply nowhere for us to reply;
• the app version and build number, the iOS version, the phone model, the interface language, the navigation mode at the moment of sending (GPS or dead reckoning) and the build channel (TestFlight or App Store)—so that test messages can be told apart from ordinary ones;
• the vehicle profile, your adapter’s name (if the app knows it) and the code of the last message the app showed you—so that we understand the state it got things wrong in;
• a random feedback-channel number. It exists purely for the “no more than a few messages an hour” limit and is linked neither to the trip pseudonym nor to the installation identifier (the only exception is the checkbox described below).

You can leave the technical context out—the form has a separate switch for that.

If you write from the connection diagnostics window. When no data comes from the car, the app may open the form from the connection diagnostics window. Then the feedback also carries:

• the adapter connection state: the protocol, whether the adapter finished starting up, whether the car’s control unit answered, whether speed can be read and what state the link is in;
• the connection log—a short record of the adapter start-up: the app’s commands and the adapter’s answers. The app cleans it on the phone: it removes the VIN, the serial numbers of the control units and of the adapter, coordinates and the time of day. Its separate switch is off by default: the log is added only if you turn it on yourself, and you see its exact text before sending;
• only if you tick the box “Link to my connection data” yourself (off by default)—your pseudonym, so that we can find your connection passports (see “Level 1. Connection passport”). This link is deleted when the message is closed, or after 90 days.

There are no coordinates, no route and no trip recordings in the form. Everything that will be sent is shown before the “Send” button.

If you submit a vehicle request. When your car is not in the list or the app cannot connect to it, you can send a request from the vehicle picker screens. Besides what is listed above, it carries only data about the car, not about you:

• the make, the model and the model year;
• where the car is from—which market it was built for (Europe, USA, Korea, Japan, China, other or “don’t know”);
• the fuel type and—if you want—the engine;
• what is wrong: the car is not in the list, does not connect, speed cannot be read, speed is wrong, or other;
• your description; if you picked the car from the list—also the number of that entry in our list and the list version.

The form does not ask for the VIN, the licence plate, a phone number or a name—please do not type them into the description either. Requests are reviewed only by the developer and by rules in our own code; they are not passed to automatic AI analysis, even if you have allowed it. Our response target is 5 working days, as for other messages (Terms of Use); whether the car appears in the list depends on whether it can be supported, and we promise no timeframe for that.

Notice of the result of a request. If “Notify me when the request is processed” is on in the form, our server gives the app a random ticket for that request—a new one for each request; on its own it points neither to you nor to your phone. The ticket is kept on your phone, and in our database only its hash (an irreversible fingerprint) is kept next to the message, together with our decision: “car added to the list”, “connection fixed” or “cannot support it yet”. From time to time, no more often than once every few hours, the app sends the tickets of unfinished requests to our server and asks for their status. These requests are not logged at all: the server records neither the IP address nor the time of these requests—neither in the message database nor in the operational journal. When there is a decision, the app shows a card and, if you have allowed notifications, also a notification that the phone creates itself: we use no third-party push notification services. The app asks for notification permission only after you have sent a request with “Notify me” on. On the phone the app keeps no more than 10 requests, each for no longer than 180 days; in our database the ticket is deleted together with the message.

Email and Telegram. Mail to support@neiv.app is received by Cloudflare: the server stores the text of the message (without attachments), the subject and the sender’s address, and forwards the message to the developer’s mailbox (Google). If you write to our bot @neiv_response_bot (the app shows a link to it on the feedback screen while the bot is working), the message text and your Telegram handle or number are stored. Automatic AI analysis is not applied to email or to messages to the bot.

Who reads it. The message is stored in our database, and that is where the developer reads it. Only a “new message No. …” notification arrives in the developer’s working Telegram chat: the number, the category, where it came from (the form, email, the bot or the App Store), whether you allowed AI analysis, and a link to our database—without the text, the email subject, your contact or technical data. Once a day the developer gets a summary in Telegram—only counts and message numbers by part of the app, without text or contacts.

Automatic AI analysis—only with your permission. To find identical problems faster, we may automatically identify the type of a message (bug, request, question…), its severity and the part of the app. The model only assigns these labels with a confidence score: it does not reply to you, does not close your message and makes no decisions about you—a person does that. For this, the message text and technical context—without your contact, the channel number, the adapter name, the connection log or the pseudonym—are processed by:

• OpenRouter, Inc. (USA)—the service through which we send the request to the model. Requests to it are sent in zero-data-retention mode: no copy of the request remains with OpenRouter after the response. OpenRouter passes the text to the Jev model of TypeSafe AI, Inc. (USA);
• Cloudflare—the Workers AI model, on the same servers where our data is stored.

Email addresses and phone numbers that you typed into the text yourself are replaced with placeholders first. The result—type, severity, part of the app and a confidence score—is stored next to the message for as long as the message itself. The legal basis is your separate consent (Article 11 and Article 29(4)(1) of the Law of Ukraine “On Personal Data Protection”).

The form asks for permission once, the first time you send: “Allow” or “Don’t Allow”. Your feedback is sent either way, and no feature of the app depends on your answer. If the list of these services changes, the form will ask you again. You can change your choice at any time: Settings → Data and privacy → “Automatic AI analysis of feedback”. After you turn it off, new messages are not passed to AI at once, and messages already sent—as soon as our server receives your choice. Without permission, messages are reviewed only by the developer and by rules in our own code. To have messages you already sent deleted, write to privacy@neiv.app.

App Store reviews. Reviews and ratings you post on Neiv’s App Store page are public: anyone can see them. So that we don’t miss a problem, once a day we receive from Apple the review text, its title, the rating, the storefront country and the date—without your nickname. The review is stored in our database on Cloudflare’s servers together with other messages and for as long as they are; we do not link it to your trips, pseudonym or purchases. Automatic AI analysis is not applied to App Store reviews. The legal basis is our legitimate interest in improving the app (Article 11(1)(6) of the Law of Ukraine “On Personal Data Protection”); you made this text public yourself. To have your review deleted from our database, write to privacy@neiv.app and quote it; you remove the review from the App Store yourself.

How long we keep it. The contact—up to 30 days after the message is closed (a reply was given or the problem resolved), but no longer than 180 days from sending. The connection log—90 days; the passport link—until the message is closed, but no longer than 90 days. The message itself—up to 180 days after it is closed, but no longer than 12 months from sending; spam and test messages—30 days after closing. Anonymous problem counters (how many people reported the same bug) are kept without a time limit—they contain neither text nor contact. These periods apply to our database; we delete mail in the developer’s mailbox no later than 12 months after it arrives, and at your request—right away. The hash of a vehicle-request ticket and our decision on it are kept for as long as the message itself and are deleted together with it. To have a message deleted sooner, write to privacy@neiv.app.

When and how the data is transferred

The App Store versions of the app do not make full trip recordings, so everything below about trip parts applies only to test builds. There a trip recording is cut into two-minute parts; each is compressed and sent separately during the trip—precisely because there is no Wi-Fi on the road, and after the trip the app is usually closed already.

The delivery mode is chosen in Settings → Data delivery:

• Wi-Fi and cellular—trip recordings (test builds only) are sent on the road over cellular too, but no more than 250 MB a day. When the daily limit is used up, the remaining parts wait for Wi-Fi;
• Wi-Fi only—trip recordings (test builds only) wait for Wi-Fi. Connection passports and adapter-check recordings, if you have allowed them, are also sent over cellular in either of these two modes;
• Off—trip recordings, connection passports and adapter-check recordings are not transferred; trip recordings stay on the phone. This mode does not stop “Traffic map” passes—only that map’s own switch governs them (see “Traffic map—a separate choice”).

If the connection dropped, the transfer continues from the same place at the next opportunity; parts that have already arrived are not sent again. After a successful transfer the copies of the parts are deleted from the phone—the trip recording itself stays with you.

The modes above govern the trip recordings, passports and check recordings that go from you. “Traffic map” passes, if you turned it on, are sent over any network, cellular included, regardless of these modes. Separately from them the app downloads the traffic map for your region—automatically and over cellular as well, with no switch of its own. The price is up to about 3 MiB a week; without it the travel time shown to you would be markedly worse. This is receiving a ready-made map, and it does not depend on the “Traffic map” switch with which you allow your own drives to be sent.

If you buy a subscription, take part in the referral programme or in the promotion for authors

This is a separate part of the app with its own data. Everything described above does not apply to it, and vice versa.

Installation identifier. So that the server can tell whose subscription this is, the app creates a random installation identifier (the same one the app passes to the App Store as appAccountToken). It is created only at the moment you first buy a subscription or first open the “Invite a friend” screen. Before that no subscription is tied to you. It is not linked to your Apple Account, your email, or the advertising identifier. The installation identifier and the free-minutes record are kept in the protected iOS storage (Keychain) of this phone, without iCloud sync, and remain after the app is deleted—so that the subscription, rewards and minutes already used are not lost on reinstall. They can be erased by resetting the phone to factory settings.

The claim number for the starter minutes is a different number. The app creates it only after your consent to the device check (a button on the subscription screen) and sends it together with the device mark (below) so that the same claim is not counted twice. It travels in the same request field as the installation identifier, but it is a different random number: it is linked neither to your subscription, nor to the trip pseudonym, nor to your Apple Account.

Starter free minutes and the device mark. So that the starter free minutes are granted once per device, the app asks Apple for a service mark of the device (DeviceCheck) and sends it to us together with the claim number. The mark contains none of your data and is not an identifier of a person; it is stored on Apple’s side, and all we see is the answer “this device has already been granted” or “not yet”. For the starter minutes this happens only after your consent—a button on the subscription screen—regardless of the sending level you chose; without it the mark and the claim number for the starter minutes are neither created nor sent, and there are no starter minutes; the subscription, the 20 free weekly minutes and the emergency minutes are available anyway. You can give this consent at any time later.

The device mark when you enter a friend’s code. If you entered a friend’s code, then when you finish the setup the app likewise asks Apple for a service mark of the device (DeviceCheck) and sends it to us together with the installation identifier—so that the friend is credited only once per device. We do not store this mark; on Apple’s side only a note remains that “this device has already been credited as a friend”. There is no separate button for this: it is a step of entering the code itself.

It and the statistics pseudonym are two different things that never meet: the pseudonym labels trip data, the installation identifier labels purchases and rewards. We do not link them, and there is no referral code in the trip data.

What goes to our server:

• the installation identifier;
• the state of your subscription as confirmed by Apple (whether it is active, until what date, which plan, whether there were refunds). We do not see your card number, your name or any payment details—the payment is entirely on Apple’s side;
• your participant code (the 8 characters the app shows on the “Invite a friend” screen), and, if you entered someone else’s code, the fact that these two installations are linked;
• reward counters: how many friends have been credited, how many free minutes have been accrued, how many discounts on your next charge you have earned and how many you have already used;
• if you entered a friend’s code—a one-time Apple device service mark (DeviceCheck), which the app sends when you finish the setup; we do not store it;
• if you submit an entry to the promotion for authors once it is open: your participant code, a link to the video and the contact you provide yourself (an email or a messenger handle) so that we can reply.

What does NOT go—at any of these steps: your coordinates, routes, trip recordings, vehicle data, the telemetry pseudonym, contacts from your address book. The referral programme does not read your address book and sends invitations to no one: you pass the code to your friend yourself, however you see fit.

How long we keep it:

• the referral programme registry (the “who invited whom” links, the accruals)—24 months from the completion of the reward, after which it is deleted automatically;
• the participant's installation identifier, referral code and reward counters—kept while the programme runs and deleted at your request;
• entries to the promotion for authors together with the contact—12 months, after which they are deleted automatically;
• the starter-minutes claim number together with the remaining starter minutes—without a separate period, while the service runs: otherwise starter minutes would be granted again after a reinstall;
• the record of the subscription itself (the installation identifier and the status confirmed by Apple)—without a separate period, while the service runs and for as long as accounting rules require.

How to leave or delete. Write to privacy@neiv.app and give your participant code—we will delete your record in the referral programme and your promotion entries. This does not cancel the subscription: you cancel a subscription in your Apple Account settings, and our actions do not affect it.

How the reward arrives. For a friend who takes out a paid subscription you receive a 50% discount on your next charge on the monthly plan. Technically this is an App Store promotional offer: our server signs it for Apple, and Apple applies it—after you confirm the purchase yourself in the app. We see neither your payment details nor the amount charged. Free subscription days (the promotion for authors) work differently: there Apple moves the date of your next charge, or we grant the access ourselves.

Refunds. If a friend refunded the subscription, the reward for that friend is not credited. The terms of the referral programme are on the neiv.app/referral page. The promotion for authors is not open yet; its terms will be published separately.

Where the data is stored and for how long

The data that is sent is stored on Cloudflare R2 servers (infrastructure, including outside Ukraine—the cross-border transfer is needed to carry out your sending choice). Retention periods:

• raw trip recordings, sent by hand or automatically—12 months, after which they are deleted by an automatic storage rule, not by someone’s decision to clean up;
• per-trip summary statistics without coordinates (how long and how far dead reckoning carried the position, adapter connection counters; they come only from test builds of the app)—labelled with your pseudonym, stored for 12 months, after which they are deleted by an automatic storage rule; until then they are deleted together with your other data at your request;
• connection passports, including failure passports and summaries after a drive—12 months, after which they are deleted by an automatic storage rule. Until then they are labelled with your pseudonym and are deleted together with your other data at your request (see “Your rights”);
• extended-diagnostics passports—90 days from receipt, earlier in the cases described in “Extended connection diagnostics”;
• adapter check recordings—12 months from receipt, after which they are deleted by an automatic storage rule; until then they are labelled with your pseudonym and are deleted at your request;
• a decoding table prepared for your car and the fingerprint of the check number it is bound to—for as long as the table is needed; it contains no data about you;
• the service record of passport quotas under your pseudonym (identifiers and number of the passports and check recordings sent, the date of your consent to extended diagnostics, a stop mark and our note on it)—without a separate period, except for the record of failure passports, where failure reasons are kept only for the current day (UTC), and identifiers and counters only for the current month, after which they are deleted; it contains no data from the car;
• “Check without GPS” recordings lie in separate storage with the same 12-month period;
• messages (feedback form, email, Telegram)—up to 180 days after closing, no longer than 12 months from sending; the contact—up to 30 days after closing; the connection log—90 days; the hash of a vehicle-request ticket—together with the message (see “If you write to us through the feedback form, by email or on Telegram”);
• the “Traffic map” data lives separately from everything listed above: the trip files that were sent—until they are merged into the aggregated map, no longer than 14 days; the service record of receiving a trip (without coordinates)—90 days; the aggregated map—indefinitely (see “The traffic map—a separate choice”).

IP address. The server uses the IP address of a request only at the moment of the request, to limit request frequency and filter out bots (for the promotion web form, also through the Cloudflare Turnstile check). IP addresses are not stored in our databases; the only exception is the attempt counter of the promotion web form, which lives for 1 hour.

Counting device activity. To know how many devices open the app and come back to it, from time to time we use Cloudflare’s request logs to count how many different pairs of “IP address (for IPv6, only the network prefix) + the app’s mark in the request (User-Agent: app name, build and iOS version)” made the service request for the map catalogue at launch or when the app comes to the foreground (no more often than once every 6 hours). The pairs are compared only in memory; only the summary numbers stay in our databases, not the IP addresses or User-Agent values. Cloudflare keeps the request logs for its own retention periods. This count is not linked to a pseudonym, installation identifier or trip recordings and does not let us identify you; it is approximate because an IP address changes.

The operational request journal. Calls the app makes to some of our services leave a technical line in the journal: the request path, the response code, how long the handling took, the app version, the iOS version and the first four characters of the pseudonym or identifier, if the request carried one. There are no request bodies, no coordinates and no texts of any kind in the journal. The lines are deleted automatically after 14 days: the journal exists so that we can see server failures, not people’s behaviour.

Transfers outside Ukraine. Cloudflare’s servers are located, among other places, outside Ukraine; this transfer is needed to carry out your choice of what to send. Mail sent to our addresses is also stored in the developer’s mailbox at Google (servers outside Ukraine), because otherwise the developer could not reply to you. Messages for which you have separately allowed automatic AI analysis are also transferred to the USA—to OpenRouter and TypeSafe (see “If you write to us through the feedback form, by email or on Telegram”); OpenRouter’s servers may also be located in other countries. The legal basis for this transfer is your unambiguous consent (Article 29(4)(1) of the Law of Ukraine “On Personal Data Protection”). In addition, a data processing agreement is in place with OpenRouter: OpenRouter processes the data only on our instructions, and the agreement includes the EU standard contractual clauses for international transfers. You can withdraw your consent at any time (Settings → Data and privacy); questions—privacy@neiv.app.

Whom we pass the data to

We do not sell data and do not pass it on for advertising or analytics. The app has no ad networks, no third-party analytics SDKs, no cross-app tracking. No third party collects information about your activity in other apps or on websites through Neiv. The data is received only by those named in “Who processes the data”, and only for their own task: Cloudflare stores and delivers everything sent to our server, receives mail and keeps request logs (see “Where the data is stored and for how long”); Telegram receives only a notification of a new message without its content, and the messages you yourself write to our bot; Google keeps mail sent to our addresses in the developer’s mailbox; OpenRouter, TypeSafe and Workers AI—only the messages for which you allowed automatic AI analysis (see “If you write to us through the feedback form, by email or on Telegram”); Apple verifies the device service mark; Google (Play Console)—only the email address from a request to join the Android beta that you submitted on the website (https://neiv.app/android/privacy/). Beyond them—only on a lawful demand from an authorized state body of Ukraine.

Your rights

• Change or withdraw your consent—at any time, Settings → Data and privacy. The change takes effect from the next trip; switching “everything” off stops the transfer immediately, including the one already on its way.
• Delete the data that was sent—write to privacy@neiv.app and give your pseudonym (it is shown in Settings → Data and privacy). We delete everything linked to it, and the server stops accepting new data under that pseudonym.
• Get a copy of your data and find out whether we process it—write to privacy@neiv.app and give your pseudonym or participant code. We reply within 30 days; the copy is free of charge, in a commonly used machine-readable format.
• Turn the “Traffic map” off—a separate switch in Settings → Data and privacy. Collection stops immediately, and the trips that were sent but not yet merged into the averages are deleted automatically. No pseudonym is needed for this: road data does not carry one.
• Break the direct link with what was sent—“Create a new pseudonym”. This does not delete what was sent earlier (except extended-diagnostics passports—those we delete): new data goes under the new pseudonym, and we ourselves do not link it to the old data. However, the car profile, adapter data and phone model in passports and check recordings are the same before and after the replacement, so correlating old and new records cannot be ruled out; a complete break is deleting what was sent (the item above).
• Delete the local recordings—deleting the app erases all trips from the phone; you delete their copy in iCloud Backup, if there is one, in your iCloud settings.
• Contact us—privacy@neiv.app. We reply within 30 days.
• Complain—if you believe we have violated your rights, you can turn to the Ukrainian Parliament Commissioner for Human Rights (https://ombudsman.gov.ua) or to a court. Contacting us first is not required.

Since we do not know who you are, your pseudonym is the only way to find your data. If you have replaced it or deleted the app, what was sent earlier can no longer be found, neither by you nor by us.

Children

The app is intended for people aged 16 or over and is not addressed to children. We do not knowingly collect the data of people under 16.

Permissions the app requests

• Location “while using the app”—to show the position and guide along the route. While the app is running, the position keeps updating even when the app is minimised or the screen is locked; fully closing the app stops this. If you turn the “Traffic map” on, the very same permission is used for it—the app asks for no new one. During an adapter check that you start yourself, GPS speed—without coordinates—goes into the check recording (see “The adapter check with the “Check modes” button”). For the connection passport, the app compares the car’s speed with the GPS speed on the phone and uses the latter to mark whether the car was moving; only summary figures and marks are sent, without coordinates. The app does not ask for “always” under any circumstances.
• Motion & Fitness—only in test builds (the barometer for trip recording); versions from the App Store do not ask for this permission. The gyroscope and the accelerometer for dead reckoning without GPS need no separate permission.
• Bluetooth—the link with the OBD adapter in your car.
• Local network—the link with a Wi-Fi OBD adapter in your car.
• Notifications—only to tell you the result of your vehicle request. The app asks for this permission only after you have sent a request with “Notify me” on; the phone creates the notification itself.

Refusing any of the permissions does not block the app: it will work in a limited mode and will honestly say what exactly is missing.

Policy changes

The app will announce changes that expand data collection on a separate screen and will ask for consent anew. The date of the edition is always at the top of this page. The app also asks you to confirm a new edition that does not expand collection, because consent is recorded against a specific edition.

That is how it is done with this edition too: until you have confirmed it on the “What’s changed” screen, no data about your trips is sent from your phone—no matter which level is set in Settings. The service connections from the section “What the app always does” continue meanwhile: without confirming access the app could not even tell you what has changed.

What changed in the edition of October 14, 2026. We have not started to collect new data: the app sends nothing new, and what is sent, the pseudonym, the traffic map and the retention periods are unchanged. Several places in the description changed. The “phone only” mode: without an OBD adapter, the phone itself can approximately estimate the position without GPS from its sensors—this happens on the device, nothing is sent, and the table “What the app reads on your phone” no longer claims that dead reckoning is impossible without data from the car; for this mode the app uses the signed settings file, which was already among the service connections. Counting activity: the section “Where the data is stored and for how long” now says that we count devices that opened the app and came back by the pair “IP address + the app’s mark” from Cloudflare’s request logs, without storing that data in our databases. The vehicle list supplement is also downloaded at the “Region map” step during first setup and for the result of a vehicle request—earlier only the vehicle picker was named. For requests to join the Android beta on neiv.app/android, a pointer to their separate notice was added, and Google Play Console is named among the recipients of those requests. A new edition of the Terms of Use (October 14, 2026) is released at the same time. This does not expand collection; the app still asks you to confirm the edition because consent is recorded against a specific edition.

What changed in the edition of September 28, 2026. The connection passport now also explains failed connections: the technical reason for a Bluetooth or Wi-Fi adapter failure (without device or network names), link dropouts with a “car was moving: yes/no” mark, the mark “the car was moving but the adapter did not connect” with the duration as a range, and summary figures comparing the car’s speed with the GPS speed—without coordinates; such passports have their own count limit. The rest of the edition narrows and clarifies the description. Mentions of a “map of jamming areas” were removed: no such map exists. Trip statistics from test builds are now described honestly—they are labelled with a pseudonym and kept for 12 months, not “de-identified, indefinitely”. A traffic-map trip file is deleted right after it is merged into the map, within 14 days at the latest (previously 120 days); in the aggregate, dead reckoning is only a “yes/no” mark, and no published map contains any sign of GPS jamming or spoofing. A new subsection “Occupied and frontline territories” was added: passes are neither collected nor published for the temporarily occupied territories, and in frontline oblasts the map is published without stop data. A paragraph about the IP address was added; retention is now stated for the installation identifier, referral code, reward counters and the starter-minutes claim number; the app creates and sends the DeviceCheck device mark together with the starter-minutes claim number only after your consent on the subscription screen, not at first launch (the other cases—a friend’s referral code and the traffic map—are described in their own sections); the connection log in feedback is now off by default; it is clarified that vehicle-request status checks are not logged and that only some of our services keep the operational journal. Retention is now stated for the service record of receiving a traffic-map trip (90 days, no coordinates), and replacing the pseudonym is described honestly: it removes the direct link but does not make correlating old and new records impossible. The right to get a copy of your data was added, as were a mention of iCloud Backup and of keeping the installation identifier in the Keychain, and the occupied-territory boundaries file in the list of service connections; deleting what was sent is done by email to privacy@neiv.app, without a button in the app. The list of traffic-map passes now names two fields the app was already sending: the speed deviation on a segment from the average and the mark of a cut-off recording; it is clarified that the “Off” delivery mode does not stop traffic-map passes, and that the adapter name in the passport is the name your adapter presents itself with. It has also been clarified—without changing what is collected: the app works in the background while it is running; a traffic-map trip file is the road segments you drove, in order, without coordinates; the delivery modes are named as in the app, and it is stated that passports also go over cellular in “Wi-Fi only” mode; an “In plain words” introduction has been added to the connection-passport section. Because the contents of the connection passport have expanded, the app will ask you to confirm the new edition.

What changed in the edition of September 26, 2026. A new section appeared: “The adapter check with the “Check modes” button”. When you run the check yourself, the app sends, besides its result, a check recording: short phases of speed polling (BASE) and bus listening (PRO), all the frames the car’s bus broadcasts, up to 10 seconds while parked and (under conditions) up to 60 seconds of the first drive-off after the check (while moving—all bus frames only when the speed from the car cannot be read), GPS speed without coordinates, heading or time of day, quality counters, the car’s make and year, and only the date. We do not collect the VIN: frames that look like a VIN are masked on the phone and again on the server. Recordings are stored for 12 months, no more than 3 a day and 10 per car × adapter pair, one recording up to 1.5 MB before compression. The connection passport now also carries the tuning state for your car: the distance coefficient and the kilometres accumulated for it, the speed-signal quality counters, the number and revision of the vehicle profile and the state and reason of the result of the check of a new table. From a check recording we may prepare a decoding table for your particular car: for up to 30 days the app asks the server about it by the random number of the check and uses it only after checking it against GPS. Levels 2 and 3 have been clarified: in the App Store versions automatic sending of trips is turned off, the choice of level is kept, but raw trip recordings are not made and not sent; full recordings exist only by hand in test builds. Because this expands collection, the app will ask you to confirm the new edition.

What changed in the edition of September 25, 2026. The section on messages now includes the vehicle request: you can send it from the vehicle picker screens when your car is not in the list or the app cannot connect to it. The request carries the make, model, year, market, fuel type, engine (if you want), the type of problem and a description; it is reviewed only by the developer and is not passed to AI. If you want, the app keeps a random ticket for the request, asks our server about its status from time to time and tells you the result—with a card or a notification the phone creates itself; the server keeps only the hash of the ticket and our decision, for as long as the message. The app also downloads a signed supplement to the vehicle list from our server, sending nothing about you. Notifications have been added to the permissions. Because this expands collection, the app will ask you to confirm the new edition.

What changed in the edition of September 23, 2026. The “Connection passport” section has changed: there are now up to 20 passports per car × adapter pair instead of three (plus one if the car was not running); from the fourth passport of a pair it carries only the date, without the time; in PRO mode the sample keeps only the CAN bus frames of the signals the app uses, and the app discards the rest on the phone; the adapter check you run yourself is now described (only when you tap it, up to 10 a day). Our server can stop or reduce passport collection, but cannot expand it. Extended connection diagnostics is new—a separate consent, off by default: up to 5 passports a day and up to 60 per consent, for 14 days (30 at most). Connection passports are now stored for 12 months, extended-diagnostics passports for 90 days. The section on messages now covers email and the Telegram bot, names the retention periods and describes automatic AI analysis of messages, which works only with your separate permission. Google (the developer’s mailbox) has been added to the recipients and—only for messages with permission— OpenRouter and TypeSafe (USA) and Cloudflare’s Workers AI model; a paragraph “Transfers outside Ukraine” has been added. The feedback form now also sends the interface language, the navigation mode and the build channel, and from the connection diagnostics window—the connection state, the cleaned connection log and, only with your checkbox, the link to your passports. Only a notification of a new message, without its text or your contact, now arrives in Telegram. Because this expands collection, the app will ask you to confirm the new edition.

What changed in the edition of September 21, 2026. We have not started collecting anything new: what is sent, the pseudonym, the traffic map and the retention periods have not changed by a single word. Two places changed. “Children”: the previous edition said “not addressed to children under 13”, now the threshold is 16, the same as in the Terms of Use. The subscription and programmes section no longer names the page of the promotion for authors: the promotion is not open yet, we accept no entries, and its terms will be published separately—the disclosure of what an entry would send is unchanged. This does not widen collection. The app still asks you to confirm the edition, because consent is recorded against a specific edition.

What changed in the edition of September 18, 2026. One item changed: “When it is collected” in the section “The traffic map—a separate choice”. The previous edition said road data is collected only while the app is open. Now it is collected while the app is running—including in the background, when the app is minimised or the screen is locked: otherwise a trip broke off every time you took a call or switched the music. What is sent, the one-time trip code, the first and last 500 metres that are never recorded, and the retention periods have not changed. Because this widens collection, the app asks about the traffic map again: an answer given under the previous edition is not carried over, and until you answer, no road data is collected or sent.

What changed in the edition of September 15, 2026. We have not started collecting anything new—this edition describes what the app was already doing but the policy was silent about. A new section appeared: “What the app always does” (the access and time check, the settings, the map catalogue, the vehicle profiles, the traffic map download, the one-time DeviceCheck device mark). The feedback form with its optional contact field, the operational request journal with its 14-day period, and the traffic map download over cellular are now described. The phrase “nothing is sent” has been made precise: without your permission no data about your trips is sent, while the service connections are always there. The rules about the sending levels, the pseudonym, the traffic map and the trips that are never sent have not changed by a single word.

What changed in the edition of September 14, 2026. A new section appeared: “The traffic map—a separate choice”. The app learned to build a shared map of travel times out of measurements from all drivers, and for that it needs the speed at which road segments are driven. This is a separate switch, off by default: it is not part of levels 1–3, does not turn on together with them, and is asked about on a separate screen. The rules about the sending levels, the pseudonym and the trips that are never sent have not changed by a single word.

What changed in the edition of August 30, 2026. A new section appeared: “If you buy a subscription, take part in the referral programme or in the promotion for authors”. The app now has a paid subscription, a referral programme and a promotion for video authors, and with them an installation identifier that is created only if you use one of them. The rules about trips, sending levels and the pseudonym have not changed by a single word.

Contact

privacy@neiv.app