The short version. One Coffee Car Care keeps your vehicle records in a database on your phone. This version has no account and no sign-in.
Four things can move data off the phone, and all four are yours to control: Android's own backup to your Google account, any file you choose to export, — only if you say yes — diagnostic reports that help us fix problems, and — only if you say yes, each time — a small sample of a file you are importing from another car app.
This policy describes the current version of the app. If a later version behaves differently, this policy is updated before that version is released — see section 8.
This app is published on Google Play by One Coffee Apps. If you have a question about privacy, or you want something explained, write to coffee@onecoffeeapps.com and a person will answer.
This policy applies to the One Coffee Car Care mobile app. It does not cover other services you may reach from it, such as Google Play itself.
Everything you enter is written to a database file inside the app's private storage on your device. That includes:
Android keeps this private to the app. Other apps on your phone cannot read it.
There are four routes by which data can leave the phone. You control all four.
Android backs up app data to your own Google account so a new or reset phone can restore it. This is a feature of the Android operating system, not something this app sends anywhere — the data goes from your phone to your Google Drive, under your Google account, and we have no access to it and no ability to read it.
You can turn it off for this app, or for the whole device, in your Android Settings → System → Backup. Google's handling of that backup is covered by Google's Privacy Policy, not by this one.
The app can export your records to a file. Nothing happens to that file until you decide what to do with it — where you send it, and who can read it, is entirely your choice.
The first time you open the app it asks whether it may send diagnostic reports. It is off until you answer, and "No thanks" means off. You can change your mind at any time in Settings.
If you turn it on, the following is sent:
Your vehicle records are never part of this. No odometer readings, no prices, no registration or VIN, no service history, no document details — the reports name a screen and a category, never a value you typed.
This is processed for us by PostHog, on their European infrastructure. When diagnostics are off, the app builds no reporting client at all — there is nothing running, queueing or waiting to send.
The app can read exports from other car-logging apps. It knows several formats already and remembers every format it has worked out before, and in both of those cases nothing leaves your phone — the whole file is read on the device.
When a file is in a format it does not recognise, it can ask our own service to work out how to read it. It asks you first, every time, on the screen where the import happens, and it shows you exactly what would be sent before you decide. If you say no, nothing is sent and no connection is made.
If you say yes, what is sent is a small sample of the file:
In those later rounds, values from the columns most likely to say something about you are removed before anything is sent and replaced with [redacted]: notes and comments, petrol stations, garages and other vendors, registration numbers and VINs, invoice and receipt numbers, addresses, towns and coordinates, phone numbers and email addresses, the names you have given your cars, and account identifiers. In every round, opening rows included, each value is cut short. Your history as a whole is never sent, and there is no way for the service to ask for it — the app enforces the limit itself, and refuses to send more however it is asked.
Checking that the request comes from the real app. At the moment you say yes, your phone asks Google Play to confirm that it is a genuine copy of this app installed from Google Play (Google's Play Integrity and Firebase App Check). For that check Google receives information about your device and this installation — not your file and not your records. The check is covered by Google's Privacy Policy. It runs only for this kind of import, and only after you say yes.
The service sends back instructions for reading the file — which column is the date, which is the cost — and your phone then reads the whole file itself, offline, using those instructions. It keeps them, so the next export from the same app needs no connection at all.
The service is operated by us, on Cloudflare. To work out the instructions it passes the sample — and nothing else — to an AI model from one of these companies, which process it on our behalf:
None of them uses your sample to train AI models. Our service does not keep the sample once the answer is sent; it records only the outcome, which model answered and what the request cost. OpenRouter and Cloudflare do not store it. OpenAI and Anthropic may keep a request for a limited time — up to 30 days — solely to detect misuse of their services, and then delete it. When you have not said yes, the app builds no client for this at all — there is nothing running, queueing or waiting to send.
This is a separate question from diagnostics, and answering one does not answer the other. They go to different companies, for different purposes, and only this one ever involves anything out of your own records.
As of the effective date at the top of this page, the app:
We do not sell your personal data.
Android may list permissions the app declares. What they are actually for:
You can refuse or revoke notification permission at any time in Android settings. The rest of the app keeps working.
This app is intended for adults who own or maintain vehicles. It is not directed at children, and we do not knowingly seek or use data from children. The diagnostics described in section 3 are off unless someone turns them on, and carry nothing that identifies a person.
If you ever need help with any of the above, or want to ask what a particular version of the app does with your data, write to us and a person will answer.
The app is under active development, and later versions may do things this version does not.
When that happens, this policy is updated before that version is released, and the version number and date at the top change with it. Where the law requires your consent for a new kind of processing, you will be asked for it in the app rather than through a policy change alone.