Privacy Policy

Last updated: 2026-10-20

This policy explains what the Odomira app and its servers collect, why, who can see it, how long it is kept, and how to delete it. It applies to the Odomira apps for Android and iOS and to the Odomira service.

1. Who we are

Odomira is operated by the Odomira developer, an individual developer based in Hyderabad, Telangana, India, the controller of the personal data described here (“we”, “us”). For privacy questions or requests, write to privacy@odomira.app. For help with the app, write to support@odomira.app.

Odomira contains no advertising or analytics SDKs, and we do not sell or rent personal data. The Google map and navigation components in the app collect data as described in section 4.

2. Using Odomira without an account

An account is optional. Without one you can record rides, see your statistics and heatmap, use the garage, and get directions on your bike’s dashboard. Your rides, bikes, garage entries and settings are then stored only on your phone and are not sent to our servers. They stay there until you delete them, uninstall the app or clear its data. When you later sign in, rides recorded on that phone are backed up to your account.

On Android, if you have turned on Google’s device backup, this app data, including rides recorded while signed out, may be included in your Android backup, which Google stores under your Google account and its terms.

Some features always contact Google, with or without an account: the map, place search, route previews and turn-by-turn navigation. See section 4.

3. What we collect with an account

When you sign in, the app backs up the following to our servers so you can restore it on a new phone and use the online features.

Category	What it includes
Account	Email address, display name, username, a password stored only as a bcrypt hash (if you set one), and, if you use Google or Apple sign-in, the account identifier that provider gives us. With Google or Apple sign-in we receive your email address and name from the provider.
Rides	Start and end time, distance, duration, average and top speed, elevation gain, the bike used, and the ride’s GPS route (position, time, altitude, speed, heading and accuracy for each point). For a ride ridden in a group, the group’s name, the display names of the riders, the leader, the destination name, how long you rode together, and the number of riders, regroups and stops. Rides you add by hand (to correct the odometer) hold a distance, a date and, if you type it, the dashboard reading.
Bikes	The name and brand of each paired bike, its Bluetooth hardware (MAC) address, the connection type, when it last connected, and its vehicle identification number (VIN) if you enter it.
Garage	Fuel fills (date, litres, cost, full or partial, notes), service and part resets (date, odometer, cost, notes), odometer readings you enter after a ride, tank size, range on a full tank, current fuel level, reserve marks, and which service items you track.
Parked bike	The last location where each bike was parked, so you can find it.
Settings	App preferences such as units, theme, map and navigation options, timeouts, and the Home and Work addresses you save as shortcuts.
Group rides	While you are in a group: your live position (with speed, heading and accuracy), riding or stopped status and stop reason, battery level, GPS quality, when you were last seen and whether you are online, the pings and regroup points you send, the group’s destination and shared route, and a random identifier created for this app installation so the group can tell your devices apart. See section 6.
Crash reports (optional)	Only if you turn on Send crash reports: the error trace and message, the time of the crash, the app version, the phone make and model, and the operating system version. No ride data or location is added. This setting is off by default and only works while you are signed in.
Sign-in codes	When you request an email code (to confirm your address, sign in, or reset a password), we store a hashed copy of the 6-digit code with your email address until it expires.
Server logs	For every request to our servers: IP address, time, the requested address, response status and duration, the app’s user agent, and, for signed-in requests, your account ID and app build. Requested addresses can contain a username being checked for availability or a bike’s Bluetooth address. Request bodies, passwords and session tokens are not logged.

The app does not collect your contacts, photos, messages, browsing history or health data, and it does not record lean angle or acceleration from your phone’s motion sensors.

4. Map, search and navigation services

Odomira uses Google Maps Platform for maps and directions. When you use these features, the app sends the needed data directly from your phone to Google, which processes it under the Google Privacy Policy and the Google Maps Platform terms:

Map display (Maps SDK): the map area you view.
Place search (Places): the text you type, your exact current location and your region setting, to rank nearby results.
Route previews and fuel stops (Routes API and Places): your current location as the start, the destination, any stops and your avoid options (tolls, highways, ferries), and searches for fuel stations along the route.
Turn-by-turn navigation (Navigation SDK): your device location and the route. Once you first pick a destination, Google’s navigation component keeps using your location until the app is closed.
Ride thumbnails (Maps Static API): a ride’s route, including its exact start and end points and the relative speed of each segment, to draw a small map preview that is then kept on your phone.

In addition, Google’s map, navigation and place components collect the following on their own, by default, whenever they run in the app: device and app metadata (operating system version, device name, model, brand and form factor, and the component’s build and version), your IP address, a pseudonymous identifier for the component that Google uses to count active users, usage and interaction data (for navigation, interactions such as panning and zooming the map, previewing turns and viewing parts of the navigation screen), and crash reports and diagnostic metrics such as stack traces and abnormal terminations. Your location is sent to Google for navigation, routing and live traffic. Odomira does not receive this data. Google describes it for each component: Maps SDK, Navigation SDK and Places SDK.

Google sign-in on Android runs through Credential Manager, part of Android and Google Play services. When you choose it, Google shows the account picker and handles the sign-in under the Google Privacy Policy; Odomira receives only the identifier, email address and name listed in section 3.

Voice search uses your phone’s built-in speech recognition (on Android, the system speech service, usually Google; on iOS, Apple speech recognition, where Apple may process the audio on its servers). That service handles the audio under its own terms; Odomira receives only the recognised text and does not store audio.

Activity detection uses your phone’s activity recognition (Google Play services on Android, Core Motion on iOS) to notice when you start and stop riding. The result is used on your phone only and is not sent to our servers.

5. Phone permissions

Location, including “Allow all the time”: to record your ride’s route, including while the screen is locked, to show your position on the map, to navigate, to remember where your bike is parked, and to share your position with your group during a group ride. Background location is used while a ride is being recorded, a bike session is active or you are in a group ride, and by Google’s navigation component after you first pick a destination until the app is closed. Location is the only required permission.
Nearby devices / Bluetooth: to find, pair with and connect to your motorcycle’s dashboard and send it directions. The Bluetooth advertise permission is part of the dashboard connection.
Companion device (Android): lets the system tell Odomira when your paired bike is nearby, so the app can connect and start in the background.
Physical activity: to detect when you start and stop riding.
Notifications: to show ride status, navigation, group ride updates, and fuel and service reminders.
Microphone and speech recognition (iOS only): for voice search; Apple may process the audio. The Android app does not request microphone access; voice search there is handled by the system speech service.

Every permission except location can be refused; the app explains what stops working. You can change permissions at any time in your phone’s settings.

Other Odomira users

Rankings. If you are signed in and use Bike riding mode, your display name, username and ride totals (distance, riding time and top speed over rolling periods) appear on the leaderboard that other signed-in users can see. Only rides recorded with your bike connected count. To leave the leaderboard, switch to Record only under Settings → Riding mode, or delete your account.
Group rides. When you create or join a group with its code, the other members see your display name, your live position, speed and heading, whether you are riding or stopped (and why), your battery level and GPS quality, when you were last seen and whether you are online, and the pings and regroup points you send. Your position is shared only while you are in an active group. Each member’s saved ride keeps the group’s name and the display names of the riders.

Service providers

We use these providers to run Odomira. They process data on our behalf and only as needed to provide their service:

Hetzner Online GmbH: server hosting, database and backups.
Resend (United States): delivers sign-in and verification emails; receives your email address and the code.
Cloudflare (United States): domain name service for odomira.app, hosting of this website, and routing of email sent to our addresses.
Google: maps, place search, routes and navigation as described in section 4, and Google sign-in if you choose it.
Apple: Sign in with Apple if you choose it.

We may also disclose data where the law requires it, or to protect the rights, property or safety of our users or others.

7. Purposes and legal bases

Under the EU and UK General Data Protection Regulation (GDPR), we rely on these legal bases:

Performance of a contract (providing the service you asked for): your account, ride backup and restore, the garage, the parked-bike location, settings sync, the leaderboard in Bike mode, group rides, and sign-in emails.
Legitimate interests (keeping the service secure and working): server logs, rate limiting, abuse prevention and backups. We keep these limited and short-lived, as described in section 9.
Consent: crash reports (off unless you turn them on; you can turn them off at any time in Settings → Data & Privacy) and the phone permissions you grant.
Legal obligation: where we must keep or disclose data by law.

8. Where data is stored and international transfers

Our servers and backups are hosted by Hetzner in Germany, in the European Union. If the servers move, we will update this section before the move. Some providers (Google, Resend and Cloudflare) may process data in the United States or other countries outside the European Economic Area. Where data leaves the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses or, where the provider is certified, the EU-U.S. Data Privacy Framework.

9. How long we keep data

Account, bikes, garage, settings, parked location, ride summaries: until you delete them or delete your account.
Ride routes (GPS traces): the detailed route is removed from our servers one month after upload; the ride summary (date, distance, duration, speeds) is kept. Routes already on your phone stay there.
Deleted rides: can be restored for 24 hours, after which the route is removed. The hidden ride summary, without its route, is kept for 90 days so your other devices also remove the ride.
Deleted bikes and garage entries: a record of the deletion is kept for 90 days so your other devices also remove the entry. Deleted ride-log entries (odometer readings after a ride) are kept, hidden, until you delete your account.
Group ride positions and pings: positions are deleted within about an hour of the group ending, and pings within about two hours of being sent. A group ends when it is ended in the app or after 4 hours with no update from any member. The group and its member list are deleted 24 hours after it ends. Live positions and pings are left out of the nightly database backups, but may be in the hosting provider’s whole-server backups described below.
Email codes: valid for 10 minutes; expired codes are deleted by a daily cleanup.
Crash reports: deleted 90 days after we receive them. When you delete your account, your crash reports are no longer linked to you.
Server logs: web server access logs up to 56 days; application logs, kept in the server’s system journal, up to 8 weeks.
Backups:
- A copy of the database, without live group positions and pings, is made every night and kept on the server. The newest 14 copies are kept, so each copy is deleted after 14 days.
- When off-site backup is set up on the server, each nightly copy is also stored encrypted on separate Hetzner storage in the EU, where we keep one copy per day for the last 7 days, one per week for the last 4 weeks and one per month for the last 6 months. A copy can therefore be up to about 6 months old.
- Hetzner also makes whole-server backups, kept for up to 7 days, which contain everything on the server, including live group positions and logs.
Data you delete disappears from backups as they age out.

10. Deleting your account

In the app, open Settings → Data & Privacy → Delete account and confirm. This permanently deletes your account and the data linked to it from our servers: profile, rides and routes, bikes, garage entries, parked locations, settings and group memberships. Groups you created and still belong to end for everyone. You can also ask by email; see the account deletion page for details, including what is kept and for how long.

11. Your rights

Depending on where you live, you have the right to:

access the personal data we hold about you and receive a copy;
correct inaccurate data;
delete your data;
receive your data in a portable, machine-readable format;
restrict or object to processing based on legitimate interests;
withdraw consent at any time, without affecting earlier processing.

You can edit most data in the app, export the data on your phone under Settings → Data & Privacy → Export all data, and delete your account in the app. For anything else, email privacy@odomira.app from the address on your account. We answer within 30 days.

If you are in India, under the Digital Personal Data Protection Act, 2023, you can ask to access a summary of your personal data, correct, complete or update it, erase it, and nominate another person to exercise these rights if you die or become incapable. Our grievance contact is privacy@odomira.app; we respond within 30 days.

You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work, or where you think your rights were infringed.

12. Children

Odomira is meant for motorcycle riders aged 18 and over and is not directed at children. You must be at least 18 to create an account. If we learn that an account belongs to someone under 18, we delete it. If you believe a child has given us personal data, contact privacy@odomira.app.

13. Security

All traffic between the app and our servers is encrypted with HTTPS.
Passwords are stored only as bcrypt hashes; email codes are stored only as hashes and are locked after 5 wrong attempts.
Sign-in sessions expire after 30 days.
Off-site backup copies are encrypted, and live group positions are kept out of the nightly database backups.
Access to the servers is limited to the operator.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

14. Changes to this policy

We will update this page when the app or our practices change, and change the “Last updated” date above. For significant changes we will tell you in the app or by email before they take effect.

15. Contact

The Odomira developer, an individual developer based in Hyderabad, Telangana, India
Privacy: privacy@odomira.app
Support: support@odomira.app