Privacy policy

Our privacy promise

01 What we collect

We keep collection narrow and purposeful:

• Account info — your name, your email, and your password if you set one (stored only as a hash).
• Trip & location data — the routes, distances, times, and classifications that make mileage tracking work, and the purposes and notes you add to your drives.
• Vehicle info — what you tell us about the cars you drive.
• People you send reports to — the name, email address and role (your accountant, for example) of anyone you save as a report recipient, so we can email them the reports you choose to send.
• Device & usage data — diagnostics that help us fix problems with tracking and the app: the app version, your phone’s model and system version, the identifier your phone gives the app, the token we use to send it notifications, settings that affect tracking (such as permissions and battery optimization), and a log of what the tracker decided — for example, when it noticed a drive start or end, and why. The app keeps this log on your phone for up to 7 days and sends it to us once a day while the phone is charging. It contains no map coordinates.
• Payment info — handled by Stripe, Google Play, or the App Store, whichever you pay through; we never see your full card number.
• Your photo — the avatar you upload, if you do. It is shown on your account and nowhere else.
• Messages to support — what you write to us in the support chat in the app or on the website, and the photos, screenshots or PDFs you attach to it. Only our support team opens the files you attach, and we delete them 180 days after you send them.
• How you found us — if you arrive on the website through a link with campaign tags (the utm_ part of an address, which says where the link was posted — a post of ours on Pinterest or Instagram, for example), the first such tags and the page you landed on are saved with your account when you sign up on the website. That record stays with us. When Google Analytics runs on the website, it also receives the address of each page you visit, tags included.
• Your mobile number — only if you ask us on odo.tax to text you a link to the app. It is used for that one text and not kept with us (section 4 says how).

Children — the app and the website are made for working adults. They aren’t intended for anyone under 18, and we don’t knowingly collect personal data from children. If you believe a child has given us their information, contact us and we’ll delete it.

02 Location data, specifically

To log miles automatically, the app needs access to your location in the background. It uses your phone’s low-power motion sensors to notice when a drive starts, then records the route. Your location is used only to build your trips and reports — it is never used to profile you or build an advertising graph. What the motion sensors notice stays on your phone, except whether it was still, walking or in a vehicle, which goes into the diagnostic log described in section 1.

You can turn tracking off at any time in the app, which stops new location collection immediately.

03 How we use it

We use the data above to detect and log trips, calculate estimated deductions, generate exportable reports, keep your account secure, provide support, improve detection accuracy, see which links and posts bring people to us, text you a link to the app when you ask for one, and — if you connect an AI assistant such as Claude — answer what it asks about your log and make the changes you let it make. That’s the whole list.

04 Who we share with

We share data only with service providers who help us run the app and the website — for example cloud hosting, mapping, and payment processing — and only the data they need to do their job. They are bound by contracts that forbid using your data for anything else. We may also disclose data if the law requires it.

If you connect OdoTax to an AI assistant such as Claude, and allow it on the page we show you, we send that assistant what it asks for while you use it: your drives, totals, vehicles, odometer readings, saved places, purposes and the reports you made — never the GPS track of a drive, your email address, your payments or your devices. If you also let it make changes, we make the ones it asks for: a drive’s category, purpose, notes, parking, tolls and vehicle; a drive you made that the app did not record, from the day, the time and the two places you give it, which we look up and measure by road with our mapping provider; names for your places: a new place where a drive started or ended, which we save at the spot the drive recorded, or a new name for a place you saved; your list of purposes: one added, renamed, hidden or shown again; your vehicles and their odometer readings, added or corrected; and mileage reports, made and emailed to your own address only. The assistant is never sent your GPS coordinates. What the assistant’s maker keeps of it follows their own privacy policy and your settings with them. You can disconnect it at any time in Settings → Security → Connected apps, and it stops at once.

Messages you send to support are answered first by an AI model from Anthropic, which processes them only to write the answer.

A question you send with Ask AI in the help center is answered by the same AI model, from our help articles. Only the question is sent, with nothing about you or your account. We keep the question and the answer for 30 days, to answer the same question again without asking the model and to see what the help center is missing, and we do not record who asked it. For up to a day we count how many questions came from one network or account, to keep the feature from being abused; if an account goes past the daily limit, we note that it did, without its questions.

If you ask us on odo.tax to text you a link to the app, we give your phone number to Twilio, our text message provider, to check that it is a US number and to send that one text; Twilio keeps a record of the message under its own privacy policy. We don’t store your number ourselves: we record that a text was sent, and for up to two days we keep a one-way fingerprint of the number so the same number can’t be texted over and over. We don’t use it for marketing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes, and text messaging opt-in data and consent are never shared with any third party.

To tell a person from a script, we use Cloudflare Turnstile on the forms on odo.tax that text you a link to the app, when you ask for a sign-in or sign-up code on odo.tax, on the form on odo.tax/connect, and on Ask AI when you are not signed in, or your account is new or its email address is not confirmed; Turnstile looks at technical details of your browser and your connection.

Some of the maps we show are drawn from OpenStreetMap data — © OpenStreetMap contributors, used under the Open Database License.

05 Selling your data

In the language of US state privacy laws: in the past 12 months we have not sold or shared personal information, including precise location. Your location is treated as sensitive data and is used only to provide the service you signed up for.

06 How long we keep it

We keep your trips and reports for as long as your account is active, because mileage records are useful for years (the IRS recommends keeping them for several). When you delete your account, we permanently delete your personal data within 30 days, except where the law requires us to keep limited records. Diagnostic logs are deleted 30 days after they arrive, and are not kept in our backups.

07 Your rights & controls

Wherever you live, you can:

• Access & export your data as CSV or PDF.
• Correct any inaccurate information.
• Delete your account and data.
• Withdraw location permission at any time.

Residents of the EU/UK (GDPR) and California (CCPA) have additional rights, including the right to object to processing and to lodge a complaint with a regulator. Exercise any right from your settings or the contact page. Exercising your rights never changes your price or level of service.

08 Security

We encrypt your data in transit and at rest, limit internal access to a need-to-know basis, and review our practices regularly. No system is perfectly secure, and we treat your location history as the most sensitive data we hold.

If something goes wrong — if a security incident affects your personal data, we’ll notify you and the relevant authorities without undue delay, as required by law, and tell you plainly what happened and what we’re doing about it.

09 Contact

Privacy questions or requests? Reach us through the contact page, at privacy@odo.tax, or by mail. The company responsible for your personal data is Odo Labs LLC:

Odo Labs LLC
800 Third Avenue FRNT A PMB 1031
New York, NY 10022-7604
United States