Kermo Privacy Policy
Effective date: 11 October 2026
Last updated: 28 October 2026
This is a translation of the Ukrainian text. If the two differ, the Ukrainian version applies.
1. Who is responsible for the data
Kermo is an app by Mavka Labs. Mavka Labs is responsible for the processing of data described in this policy. Questions about data: mavkalabs.support@gmail.com.
2. Summary
- There are no accounts, no ads and no tracking. Data is not sold, not passed to advertisers and not used to build profiles of people.
- Data about the user, the car and trips is stored on the phone.
- Trip records and the activity log are kept only with consent. Consent can be changed in the app's settings, where keeping records and the log can also be turned off.
- A trip record is transferred only by the user's own action: when they share the record or add a trip to a problem report (section 8).
- Crash reports (Firebase Crashlytics) are sent automatically. They contain no data about the user or the car (section 6).
- Analytics (Firebase Analytics) — only with consent: which steps and buttons are used and how trips go, without coordinates, the route, the VIN or the user's text (section 7).
- A problem report is sent only by the user themselves (section 8).
- The map, search and routing work through third-party open services. They receive only the data needed to show the map, download roads, find an address or plan a route (section 5).
3. How the app works
Kermo guides a car along a route when GPS is gone, drifting or showing the wrong place.
- With an OBD-II adapter, the app gets the speed from the car. The phone's gyroscope and compass show the direction of travel, the accelerometer shows stops and the phone's position in the holder, and the OpenStreetMap road map shows where the car can be. GPS is used to suggest the starting point and, on the road, as a backup — only after checking that it shows the true position.
- Without an adapter, the app estimates the speed automatically from the speed limits on the roads along the route (from OpenStreetMap), and the car's position moves along the route. The driver corrects stops, speed and position by hand. GPS is only shown on the map and does not change the car's position.
The app only reads data from the car and changes nothing in it.
4. Data on the phone
| Data | Purpose | Retention | Transfer |
|---|---|---|---|
| Sensor readings: gyroscope, accelerometer, compass, barometer | Direction of travel, stops, leaving the car | Not stored separately | Only in a trip record |
| Location data (GPS), if allowed | Starting point, showing the car on the map, checking GPS | Not stored separately | To the services in section 5 — only the points needed for a request |
| Car data from the adapter: speed, mileage, other readings | The car's true speed | Not stored separately | Only in a trip record |
| Car parameters: speedometer scale, car profile, compass position in the holder | Accurate speed and direction for this car | Until the app is deleted | No |
| Adapter address and name; the adapter's Wi‑Fi network name | Reconnecting to the adapter | Until the adapter is removed in the settings; after that only its address stays in the list of removed adapters, so the app does not connect to it by itself | Adapter name — only in a trip record |
| VIN | Identifying make, model and year; choosing commands for the car | The phone's secure storage (iOS Keychain, Android Keystore) | Never. It is not shown on screen and not written to the log or records; they hold only an irreversible fingerprint (the first 16 characters of an HMAC-SHA256 computed with a key that exists only on the phone) |
| Saved places: home, work, the car's location, recent places, destinations, stops; the number of arrivals at places | Guidance, resuming a trip | Until deleted | To the services in section 5 — only the points needed for a request |
| Settings: theme, last adapter, completed introduction, the speed for the no-adapter mode, the answer to the analytics question, the number of trips and the date of the first launch (for analytics) | Remembering choices | Permanently | No |
| Road cache | Guidance with a weak connection | Up to 90 days | No |
| Trip records (with consent) | Replaying a trip and finding guidance errors: the wrong road, a wrong turn, a lost connection to the adapter | Until deleted | Only by the user's action (section 8) |
| Activity log (with consent) | Finding errors outside a trip: adapter connection, starting point, the app closing | 30 days | No; actions during a trip and just before it are also in the trip record |
Contents of the activity log: app launches and closings; the car's position saved to resume guidance; the adapter's state, its name and connection errors; the car's speed once per second outside a trip record; car positions marked by the user, destinations and found places with their coordinates; guidance prompts with street names; where the dot was on the map and where GPS showed the car when the app was unsure of the car's position; position corrections by GPS; speed camera alerts; trip summaries; the car's make, year and platform, the VIN fingerprint; without an adapter — the driver's corrections (speed, pause, position); the phone's battery level and charging, the screen state.
Contents of a trip record: GPS points (coordinates, accuracy, speed, heading, altitude; on Android — satellite data); the route and the roads of the trip; the calculated position of the car; car data from the adapter; the phone's sensor readings and the list of its sensors; the car's make, year and platform, the VIN fingerprint; the same app actions as in the log, for the time of the trip and just before it.
A trip record shows where the user has been. Guidance works the same without records.
5. Third-party services
The services receive only the data needed to show the map, download roads, find an address or plan a route: no name, VIN or phone number. Each service sees the IP address and the request itself, and works under its own privacy rules.
| Service | Data | Purpose |
|---|---|---|
| OpenFreeMap (tiles.openfreemap.org) | The part of the map on screen | Showing the map |
| Kermo road files (tiles.shturman.mavkalabs.com; Cloudflare, Inc.) | The road files needed (they reveal the approximate area). Cloudflare may log requests; Mavka Labs does not see those logs | Downloading roads |
| Photon (photon.komoot.io; komoot GmbH) | The typed text (from three letters on) and the area, accurate to about a kilometre | Address suggestions |
| Nominatim (nominatim.openstreetmap.org) | The search query and a search area centred on the car's position; a point chosen on the map; the car's position while setting home or work | Finding an address; the address of a point |
| Overpass (overpass-api.de, overpass.openstreetmap.fr, overpass.kumi.systems, overpass.private.coffee) | The bounds of the area around the car or the route | Downloading roads when Kermo's road files are missing |
| OSRM (router.project-osrm.org), FOSSGIS (routing.openstreetmap.de, valhalla1.openstreetmap.de) | Start, destination and the car's heading; during a trip with a route — the car's position about every 5 minutes and when re-routing | Planning a route |
| Google (maps.app.goo.gl, goo.gl), Apple (maps.apple), 2GIS (go.2gis.com) | A short map link the user shared | Finding the point the link leads to |
| Apple (App Store), Google (Google Play) | Installation, update and crash data under their own rules | Installation and updates |
When the services change, this policy is updated before the new version of the app is released.
6. Crash reports (Firebase Crashlytics)
When the app crashes or an error occurs, it sends a short report to Firebase Crashlytics (Google LLC). No separate consent is asked, because the reports contain no data about the user. Google processes them only for Mavka Labs under the Firebase data processing terms. The developer's debug builds send no reports. If the user has agreed to analytics (section 7), its latest events before the crash are added to the crash report.
Contents:
- a crash: the type and text of the error, where in the code it happened, the app and system version, the phone model, and the data Crashlytics collects itself, including the Crashlytics and Firebase installation IDs;
- the adapter did not connect: the step and the cause, Bluetooth or Wi‑Fi, the error text, whether a trip was under way;
- the connection to the adapter dropped: the connection state, the error text, Bluetooth or Wi‑Fi, the number and rate of readings before the drop;
- GPS corrected the car's position: the fact of the correction, the GPS state and how the app had been moving the dot before that.
Not sent: coordinates, GPS data (other than its state), the VIN, the car's speed, turns. Reports about the adapter do not include its name. Adapter addresses (MAC, UUID, IP) and numbers that look like coordinates are removed from error texts.
Purpose: stable operation and fixing errors. The reports are not linked to a person and are not used for ads, tracking or profiles.
Legal basis: Mavka Labs' legitimate interest in the app working without failures. Retention: 90 days, after which Google deletes the reports.
7. Analytics (Firebase Analytics)
Only if the user has agreed. Without consent no event is sent, and the app works the same.
Consent. The question is a separate step of the introduction, after the first screen that describes the app. For those who updated the app and those who declined, the question is repeated in a window after the app opens: up to three times (the second time at the next opening, the third not sooner than 3 days later). After consent, or after turning it off in the app's settings, the question is not asked again. The answer can be changed at any time in the app's settings.
Contents:
- steps of the introduction: which were completed, which buttons were tapped, how long a step took (as a range);
- the answers to the system permission requests;
- the adapter: connection attempts, the kind of link (Bluetooth, Bluetooth LE or Wi‑Fi), the cause code of a failure, dropped connections and how long they lasted;
- the start: whether the app asked about the car's place, which answer was chosen, how many seconds (as a range) it took for the car's place to appear on the map, whether the car's direction was chosen; what the app knew when it asked: how long ago (as a range) the car's place was known, how far GPS was from it (as a range), the GPS error, whether the adapter was giving the speed;
- the route: where the destination was chosen from (search, recent, home, work, map), whether the route was built and how many seconds it took, its length (rounded), leaving the route and returning to it, rebuilding, the faster way;
- the trip: the trip's number on this phone; with or without an adapter; with or without a route; duration and distance (rounded); speed (to 10 km/h) and minutes by speed range; how many times and for how many minutes the app was not sure where the car is; by how many per cent the battery charge dropped and whether a charger was connected; whether the app wrongly decided that the car was parked (the car moved off within 5 minutes), how soon (as a range) and why; how fast the adapter answered (typical and near-worst, in milliseconds); the phone's highest heat level as the system reports it and for how many minutes it was hot; how many pieces of the road map failed to load; how many times the phone was picked up; how many hours after the first launch the first trip and the first trip with an adapter took place;
- GPS: its state (sound, doubtful, off, gone); how far it differs from the car's position (as a range: under 10, 10–30, 30–100, 100–300 m, more); when the position was corrected by GPS; for how many minutes of the trip the app took data from GPS; the GPS's own error as the phone reports it, in metres: at the moment GPS was lost, came back or the guiding changed, and over the trip (typical and near-worst, minutes by error range); how long ago (as a range) the last GPS data arrived; whether the phone gave only an approximate location; without an adapter — when and why the app switched from guiding by GPS to guiding by hand and back, whether the car was standing then, how long guiding by hand lasted, for how many minutes GPS guided and for how many by hand;
- the app: minimized during a trip or a route and for how long; closed (how, and whether during a trip);
- the answer to the question after a trip about whether everything worked, and the trip's number; whether a problem report was opened and which reasons were ticked, even if the report was not sent (without its text);
- which sections of the settings were opened.
Firebase adds itself: a random installation ID, the phone model, the system and app version, the language, the country and city from the IP address (the IP address itself is not stored).
Not sent: coordinates and GPS points, street and place names, the route, the VIN and its fingerprint, the car's make and model, adapter names and addresses, any text the user types, the advertising identifier.
Purpose: to understand where the app is hard to use or does not work, and to fix it. Events are not used for ads, for tracking across other apps or for profiles of people; Google signals are off. Google processes them only for Mavka Labs under the Firebase data processing terms. If the app crashes, Crashlytics (section 6) adds the latest analytics events of those who agreed to the crash report. The developer's debug builds send nothing.
Legal basis: consent. It can be withdrawn in the app's settings: collection stops and the analytics installation ID on the phone is erased. Retention: 14 months, after which Google deletes the events.
8. Problem report
A report is sent only by the user themselves — from the app's settings, or after a trip if something went wrong.
Contents: the chosen reasons, the user's text, the app version, the phone's operating system. If a trip is added to the report — its number and record (contents: section 4). Before sending, what the record contains is shown under the trip.
Without a record: a report from the app's settings can be sent without a trip. If there is no consent to records, no new records appear on the phone; existing ones remain until deleted.
Does not contain: the VIN. There is no account. The IP address is not stored.
Storage: Mavka Labs' private storage on Cloudflare (Worker, R2); Cloudflare, Inc. processes reports only for Mavka Labs.
Purpose: finding and fixing guidance errors. Legal basis: consent, given by sending the report; it can be withdrawn by asking for the report to be deleted. Retention: until the problem is dealt with, no longer than 12 months.
Rating the app: if after a trip the user answers that everything worked, the App Store or Google Play rating window opens. Mavka Labs receives nothing in this case.
9. Permissions
Any permission can be withdrawn in the phone's settings.
- Location (while using the app): starting point, showing the car on the map, checking GPS. During a trip the app also works with the screen off (on iPhone a blue indicator is shown, on Android a notification). The “Always” permission is not requested.
- Motion sensors (iPhone only): the barometer, to tell bridges and overpasses apart. On Android the barometer needs no permission.
- Bluetooth and local network: connecting to the adapter over Bluetooth, Bluetooth LE or Wi‑Fi. Bluetooth is not used to determine location. For a Wi‑Fi adapter, the app reads the name of the current network and can switch to the adapter's network; it does not change or remember other networks.
- Notifications (Android 13+): showing that guidance is running during a trip.
10. Storage and protection
- Data is stored in the app's storage on the phone, except the reports and events in sections 6–8.
- The activity log is deleted automatically: days older than 30 are deleted by the app at every launch.
- The VIN and the key of its fingerprint are not included in Android backups and do not move from an iPhone to another phone.
- iCloud and Google backups may contain places, trip records and the log. These backups are kept by Apple or Google; Mavka Labs does not see them.
- Exchange with the services in sections 5–8 is only over a secure connection (HTTPS). The app connects to a Wi‑Fi adapter directly, without the internet.
- The reports and events in sections 6–8 are stored on Google and Cloudflare servers, which may be outside Ukraine, including in the EU and the US. Both companies process them only for Mavka Labs, under contract and with protection no weaker than described here.
- Mavka Labs' servers hold no other user data.
11. Deleting data
- Trip records: in the app's trips section.
- Recent places: in the app's settings, places section.
- The car's location: from the car marker on the map.
- Adapter: in the adapter settings.
- Car parameters: together with the app.
- Activity log: automatically after 30 days; keeping it is turned off in the app's settings.
- Analytics: turned off in the app's settings, and the analytics installation ID on the phone is erased; Google deletes events already sent after 14 months.
- All data on the phone: by deleting the app. On iPhone, the VIN in the secure storage is erased at the next installation.
- Backups: in the iCloud or Google settings.
- A problem report that was sent: a request to mavkalabs.support@gmail.com stating the date it was sent.
- A record that was shared: it is kept by the recipient; Mavka Labs cannot delete it.
12. Children
The app is intended for drivers and is not intended for persons under 18. Children's data is not knowingly collected.
13. Rights
Under the Law of Ukraine “On Personal Data Protection” (in the EU, under the GDPR), the user can find out what data is processed, request its correction or deletion, and withdraw consent. Most of this the user does on the phone themselves (section 11). Other requests: mavkalabs.support@gmail.com. Complaints: the Ukrainian Parliament Commissioner for Human Rights.
14. Map, sources and licences
- Map data: © OpenStreetMap contributors, Open Database License 1.0 (https://www.openstreetmap.org/copyright).
- Vector map: OpenFreeMap © OpenMapTiles.
- Kermo road files: a derivative database of OpenStreetMap, ODbL 1.0. A copy or a description of how it is produced — free of charge on request: mavkalabs.support@gmail.com.
- Speed cameras and speed limits: OpenStreetMap, ODbL 1.0.
- Search and routing: Photon (komoot), Nominatim, OSRM, FOSSGIS — on OpenStreetMap data.
- Open-source software: MapLibre Native (BSD-2-Clause), Flutter (BSD-3-Clause), Firebase Crashlytics and Analytics (Apache 2.0), OBDb (CC BY-SA 4.0), vininfo (BSD-3-Clause), the Manrope font (SIL Open Font License 1.1). The full list of libraries and licence texts — in the app's settings, the about section.
15. Changes to this policy
Important changes are announced on this page and in the update notes in the store. The date of the last change is at the top.
Revision history:
- 28 October 2026. In analytics: the GPS's error in metres as the phone reports it; what the app knew when it asked about the car's place; a wrong decision that the car was parked; the adapter's answer time, the phone's heat, road map pieces that failed to load, how many times the phone was picked up.
- 27 October 2026. Added analytics (Firebase Analytics) — only with consent.
- 26 October 2026. Map short-link services learn which point a link shared by the user leads to.
- 14 October 2026. Added the no-adapter mode: the speed is estimated automatically. The contents and purpose of a trip record and of the activity log are described separately. Search services receive the car's position while home or work is set; routing services — the car's position during a trip with a route. The activity log is deleted after 30 days, at every launch. Added backups, deleting data, sources and licences, the offer of the road files under the ODbL. Crash reports are sent without separate consent. A problem report does not contain the adapter's name.
- 13 October 2026. Added crash reports (Firebase Crashlytics). The motion sensors permission on iPhone is used only for the barometer.
- 12 October 2026. The text rewritten in plainer language. Developer: Mavka Labs.
- 11 October 2026. First edition.