Security

Your miles are yours.

OdoTax holds one of the most personal records there is — where you go. This is what happens to it, in the same plain English as everything else we write.

What we recordA drive, from start to end

We do not keep a live trail of where you are. OdoTax records a drive: where it began, where it ended, how far and how long. That is what a mileage log needs, and it is all we ask the phone for.

What we store

  • The date of each drive, where it started and where it ended
  • How far it was, and how long it took
  • The business or personal label you give it
  • Your vehicles, and the basics of your account

What we never do

  • Keep a live, minute-by-minute trail of your position
  • Put advertising trackers in the app
  • Store your card number on our servers

In practice

How that is actually done

Encrypted on the way
Every request between the app, the site and our servers runs over HTTPS. There is no plain-text path to your trips.
Backed up, encrypted, off-site
The database is backed up daily to encrypted archives held away from the server that made them, and the backup itself is monitored — a backup nobody checks is not a backup.
Your account, your keys
Sign in without a password at all if you prefer — we email a one-time code. Two-factor authentication is in settings, and so is the list of phones signed in to your account.
Payments handled elsewhere
Payment is handled by Stripe, Google Play or the App Store, whichever you pay through. We never see your full card number.
Leave with everything
Export your full history as PDF or CSV on any plan. Delete the account from settings and the trips go with it.
Tell us if we got something wrong
Found a hole? Write to security@odo.tax. We would rather hear it from you than from someone else.

Messages from us What a real one never asks for

Go by what a message asks for, not by the name on it. OdoTax sends its automatic emails from an address ending in @odo.tax, but a name and an address are easy to copy, and a forwarding address such as Apple's Hide My Email shows its own.

A message from OdoTax, whether an email, a text, a chat reply or a call, never asks you to:

  • Send, forward or read out your password, a code or a link we emailed to confirm it is you, a code from your authenticator app or a recovery code. Those are used only in OdoTax itself: in the app, or on the site at odo.tax or my.odo.tax. Support needs none of them, so do not type them into a chat.
  • Send a card number. A card is typed only on a payment page of Stripe, Google Play or the App Store, never in a message.
  • Give a Social Security number or a tax ID.
  • Pay a tax or a fine. OdoTax does not prepare tax returns, files nothing with the IRS and never writes on its behalf. The only thing OdoTax charges for is the Pro plan.

If a message asks for any of this, the request is not ours: do not answer it and do not press anything in it. Tell us at security@odo.tax, and forward the message if it came by email.

Found something? Tell us.

Responsible disclosure is welcome and we answer it ourselves. Write to security@odo.tax, or use the contact page for anything else.

security@odo.taxContact support

The privacy policy sets out your rights over this data in full.