Privacy policy

Last updated: October 14, 2026

This policy explains what the SmartOBD app and this website collect, why, who else sees it and how long it is kept. SmartOBD is run by SmartOBD, LLC ("we", "us"). The app was built for us by PileUp Digital.

The short version

No accounts. We do not ask for your name, email, phone number or location.
Your scan history and notes stay on your phone.
When you use the AI mechanic, your scan goes to our server and on to Anthropic, the AI provider, to write the answer.
"Help improve SmartOBD" sends anonymous adapter logs with only part of the VIN. It is on by default and you can turn it off any time.
We do not sell your data or use it for ads. The app has no analytics or ad trackers.
This website has no cookies, analytics or trackers.

1. What stays on your phone

These are stored only on your device, in the app's own storage:

Your cars and their details (year, make, model, engine, body style and VIN).
Your scan history: the codes, freeze frame readings and AI answers for each scan.
Notes you add to a scan, and live data sessions you save.
Your settings, such as units, demo mode and Help improve.

We cannot see any of this. Deleting a scan in the app, or deleting the app, removes it from your phone. The app does not opt out of iPhone backups, so if you back up your phone to iCloud or a computer, this data is in that backup, and Apple's terms cover the iCloud copy.

2. Bluetooth and your adapter

SmartOBD uses Bluetooth only to connect to your OBD-II adapter and read data from your car: trouble codes, their status, freeze frame data and live engine readings. It does not use Bluetooth to find or track other devices, and it does not ask for your location.

3. What goes to our server

The app talks to our server at obd.pileupdigital.com at these times:

When it reads your car's VIN, to name the car (year, make, model and engine) and check it for recalls.
When you open the AI mechanic after a scan. The diagnosis is requested then, once per scan, not after every scan.
When you ask the AI mechanic a follow up question.
After a scan of a real car, while "Help improve SmartOBD" is on (section 5).

With every request

A device id. A random id the app makes once and keeps on your phone. It is not tied to your name, Apple ID or phone number. Our server never stores it as is: it mixes it with a secret value and stores only the scrambled result (a salted hash), which we use to apply the monthly limits and to keep your AI conversations private to your phone. Adapter log uploads (section 5) are the exception: they do not use the device id at all.
An app key. A key built into the app that proves the request comes from SmartOBD. It is the same for everyone and says nothing about you.
Your IP address, which every internet connection reveals. See "Logs" below.

When you ask for a diagnosis

Your car's year, make, model and engine.
The VIN, if the app has read it.
The trouble codes and their status (for example stored, pending or permanent).
Freeze frame and live engine readings, such as engine speed, coolant temperature, fuel trims, battery voltage and misfire counts.
A short note about the symptoms, if one is added.

When you ask a follow up question

The question you type, and the id of the diagnosis it is about.

Lookups

When the app reads your car's VIN, it sends the VIN to our server, which decodes it using public NHTSA data, and then asks our server for recalls on that year, make and model. Our server caches the results (VIN decodes for 180 days, recalls for 24 hours) so we do not ask NHTSA again. The cache is not linked to your device.

4. The AI provider (Anthropic)

To write the diagnosis and answer your questions, our server sends the scan data listed above to Anthropic, the company that makes the Claude AI models, through its API. For a follow up question it also sends the earlier answer and recent messages in that conversation.

Our server does not send Anthropic your device id or your IP address. Anthropic handles this data under its commercial terms and privacy policy, which also say how long it keeps API data. Under its commercial terms, Anthropic does not train its models on this data.

5. Help improve SmartOBD (adapter logs)

Every car speaks a little differently. To read more cars and explain more codes, the app can send us the adapter log from each scan of a real car. This is called "Help improve SmartOBD".

On by default, your choice. The app shows it with a switch on first launch, before any scan, and you can turn it off any time in Settings. While it is off, nothing is sent.
What is sent: the commands the app sent to your car and the car's raw replies for that scan; the first 11 characters of the VIN (who made the car, the model code, the year and the plant, never the last 6, the serial that makes it your car); the make, model and year; the adapter's name, firmware version and what it could do; and the app version.
What is never sent: your full VIN, your name, email or location, a device id or advertising id, your notes, photos or AI mechanic chats, and anything from the demo car.
Anonymous. Adapter logs are not linked to a device, an account or an IP address. Our server does not store your IP address with them, and the web server logs these uploads without it. As an extra safeguard, the server removes anything that looks like an email address or phone number, and cuts any full VIN it finds in the log text down to its first 11 characters.
Kept for 1 year, then deleted.

6. What our server keeps, and for how long

What	Why	How long
Each diagnosis: what the app sent (section 3) and the answer, with the hashed device id and the time	So follow up questions can refer to it, and to count scans against the monthly limit	Until you ask us to delete it. We do not delete these on a fixed schedule yet.
Follow up questions and answers, with the hashed device id	So the AI mechanic remembers the conversation, and to count messages against the limits	Same as the diagnosis they belong to
AI usage records: hashed device id, the kind of request, token counts and cost	To keep the AI spend in check	Until you ask us to delete them. We do not delete these on a fixed schedule yet.
Adapter logs (section 5), with no device id or IP address	To make the app work with more cars and adapters	1 year
VIN decode and recall results (section 3), not linked to any device	So we do not ask NHTSA again	180 days for VIN decodes, 24 hours for recalls
Short term rate limit counters, keyed by hashed device id and IP address	To stop abuse	An hour at most, in memory only

Logs

The app server writes one log line per request with the route, the result, how long it took, a request id and the first 12 characters of the hashed device id. It does not log VINs, your notes, your questions, IP addresses or the raw device id. These logs are kept until we clear them; we do not delete them on a fixed schedule yet.

The web server in front of it (nginx) keeps standard access logs, which include the IP address, time and the address requested. For a VIN lookup the address requested includes the VIN. These access logs are deleted automatically after 14 days. Adapter log uploads are logged without the IP address.

7. NHTSA

To fill in engine details for your car, the app also asks NHTSA's vPIC service (the US Department of Transportation's public vehicle database) directly. NHTSA receives the VIN and your IP address, and its own privacy policy applies.

8. Sharing a report

The PDF report is made on your phone. It only leaves your phone when you tap share and choose where to send it, for example to your mechanic by email or message. After that, it is handled by whatever app or person you sent it to.

9. Who we share data with

We share data only with the services that run SmartOBD:

Anthropic, to write the AI answers (section 4).
Our hosting provider, OVHcloud (OVH US), which runs the server the data is stored on. The server is in the United States, in Virginia.
NHTSA, for VIN decoding and recalls (sections 3 and 7).

We do not sell or rent personal information, and we do not share it for advertising. We may disclose data if the law requires it, for example in response to a valid court order.

10. Analytics and crash reports

The app contains no analytics, advertising or crash reporting SDKs. If you have chosen in your iPhone settings to share crash data with app developers, Apple may pass crash reports to us, and Apple's privacy policy covers that.

11. This website

smartobd.app sets no cookies and loads no analytics, ad or tracking scripts, and no third party fonts. The web server keeps standard access logs (IP address, time, page requested and browser type) to keep the site running and secure, and deletes them automatically after 14 days. Our domain's DNS is run by Cloudflare.

12. Your choices and rights

Use it without the AI. You can read codes and see them on your car without opening the AI mechanic, and then no diagnosis is sent. The app still asks our server to name your car and check recalls when it reads the VIN, and sends adapter logs while Help improve is on.
Turn off Help improve in Settings at any time.
Delete what is on your phone by deleting scans in the app or deleting the app.
Ask us to delete what is on our server. Because we do not know who you are, we can only find your data by its hashed device id, which the app does not show yet. Email contact@pileupdigital.com and we will help you find and delete it. If you delete and reinstall the app, it makes a new device id, and what was stored under the old one is no longer linked to your phone. Adapter logs are anonymous, so we cannot match them to you.

Depending on where you live (for example California, Virginia or Colorado), you may have the right to know what we hold about you, to get a copy, to correct it or to have it deleted. Email contact@pileupdigital.com to use any of these rights. We will not treat you differently for doing so.

13. Security

All traffic between the app and our server uses HTTPS. Device ids are stored only as salted hashes. Server access is limited to the people who run SmartOBD, and the database only accepts connections from the server itself, never from the internet. No system is perfectly secure, but we work to keep your data safe and will tell you if a breach affects you where the law requires it.

14. Children

SmartOBD is meant for drivers and is not directed at children under 13. We do not knowingly collect personal information from children.

15. Changes

If we change this policy, we will update the date at the top. If a change affects how your data is used in a big way, we will say so in the app or on this site before it takes effect.

16. Contact

SmartOBD, LLC
Email: contact@pileupdigital.com
Mailing address available on request by email.