Effective 19 October 2026
This policy explains what personal data the CoDriver app for Android and iOS collects, why, who processes it, how long it is kept and what rights you have.
CoDriver is published by AppHero OÜ, a company registered in Estonia, which is the data controller for the data described here. Contact us about privacy at siim@apphero.ee.
CoDriver needs your phone's precise location (GPS) while the app is open, to follow the road you are on and to call each note at the right moment. It does not use your location in the background. Your GPS track is used on the phone and is not recorded or uploaded. Some coordinates do leave the phone, because the notes are built from online map and elevation data:
Like any website, these services see your IP address when the app contacts them. We do not send them any identifier of you or your device.
Your saved routes and their notes, your last 12 destinations, your settings, and downloaded map tiles and heights are kept in the app's storage on your phone so drives work without signal. We do not receive them. They are removed when you delete them in the app or remove the app. Your phone's own backup (iCloud or Google) may include them under your backup settings.
We collect usage statistics with Google Analytics for Firebase: which screens and features are used, for example that a drive was started (its mode and language), a route was planned, a drive ended and how far it went, a voice sample was played, or an update prompt was shown and answered, plus standard events such as first open, sessions and app updates. We collect crash reports and diagnostics (device model, OS version, app version, the state of the app when it crashed) with Firebase Crashlytics. Both use an app-installation identifier and are not linked to you as a person.
On Android, usage statistics also include the phone's advertising ID, so that Google Ads can tell us whether people who saw or tapped our ads went on to install and use CoDriver. We use it only to measure our own advertising: the app shows no ads, and we do not sell or share it for other purposes. On iOS we do not use the advertising identifier (IDFA) and do not track you across other companies' apps or websites. If you installed CoDriver from an Apple Search Ads ad, Apple tells the app which of our campaigns it was (campaign, ad group and keyword numbers, no identifier of you); we record that once with the usage statistics.
You can turn usage statistics off at any time in Settings › Privacy › Usage statistics: the app then stops sending them, the advertising ID included. On Android you can also reset or delete the advertising ID in the phone's settings. Crash reports are still sent, to keep the app working.
Usage statistics do not include your position, the places you search for or your routes; Google Analytics works out only an approximate region (such as the country) from your IP address.
To tell you about new versions, the app asks Firebase Remote Config for the latest version number when it starts, sending its installation identifier, app version and basic device settings such as language.
Some rally stages come with an onboard video. Videos published on YouTube are played in YouTube's own embedded player: YouTube (Google) then receives your IP address and device information and may use cookies under the Google Privacy Policy. Our own videos are streamed from Firebase Storage. Nothing is sent to YouTube unless you open such a video.
The calls are played from voice recordings that come with the app. If a phrase is missing, the phone's own text-to-speech engine says it. The app does not use the microphone.
We do not collect your name, email address, contacts, messages, photos, files, browsing history, health data or payment details, and we do not use the camera or microphone.
| Purpose | Legal basis (GDPR art. 6(1)) |
|---|---|
| Following the road, routing, place search, building and calling pacenotes, maps | Performance of our contract with you: providing the app you asked for (b) |
| Usage statistics (including measuring our ads), crash reports, update checks, security | Our legitimate interest in a working, improving and secure app and in knowing whether our advertising works (f); you can object to usage statistics at any time with the switch in Settings › Privacy |
| Location access on the phone | Granted by you through the system permission prompt; you can withdraw it in the phone's settings |
| Embedded YouTube videos | Your choice to open the video (a); YouTube processes the data as its own controller |
We use these service providers. Each receives only what it needs to answer the app's request:
| Provider | Service | Data | Location |
|---|---|---|---|
| GraphHopper GmbH | Routing, place search, naming a dropped pin | Route points (start, stops, end), search text, your position for nearby results, IP address | Germany (EU) |
| Heidelberg Institute for Geoinformation Technology (openrouteservice) | Routing when GraphHopper fails | Route points, IP address | Germany (EU) |
| OpenFreeMap | Map and road tiles | Map areas downloaded, IP address | EU |
| Google (Firebase) | Our elevation service (Cloud Functions, europe-west1, Belgium) and its cache (Cloud Storage); demo video streaming; Remote Config | Points along the road ahead, IP address; installation identifier, app version | EU / United States |
| Google (Firebase, Google Ads) | Google Analytics for Firebase, Crashlytics; measuring our Google Ads campaigns | Usage statistics, crash reports, installation identifier, device model and OS; on Android, the advertising ID | United States |
| Google (YouTube) | Embedded stage videos, only when you open one | IP address, device information, cookies | United States |
| Elevation data providers: IGN / Géoplateforme (France), Maa- ja Ruumiamet (Estonia), BEV (Austria), Autonomous Province of Bolzano – South Tyrol, GPXZ (elsewhere) | Heights for road points | Coordinates of road points only, sent by our elevation service, never your IP address or any identifier | EU; GPXZ: United States |
Map data is © OpenStreetMap contributors, available under the Open Database License (ODbL). The routing and place search services above are built on it.
Transfers outside the European Economic Area rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. All data is sent encrypted (HTTPS).
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its processing, and to receive it in a portable format. Because CoDriver has no account and the data we receive is not linked to your identity, we may not be able to find data that is yours; tell us what you need and we will help where we can. You can turn usage statistics off in Settings › Privacy, stop location access at any time in your phone's settings, and remove everything stored on the phone by deleting the app. Email siim@apphero.ee. We answer within one month.
You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the data protection authority where you live.
CoDriver is meant for drivers and is not directed at children under 16. We do not knowingly collect their data.
If this policy changes, we update it here with a new effective date. The Terms of Use describe how the app may be used.