Privacy

Carbiter — privacy

Last updated 29 September 2026.

Carbiter records what your car reports about itself, works out what your driving costs, and says how much to trust that number. All of it happens on your phone.

What is collected

Carbiter itself collects nothing. There is no account, no server, no analytics and no crash reporter. Your drives, your routes and your car's VIN live in the app's own container on your phone, and the app has no way of its own to send them anywhere.

The free version carries advertising, and that part is not nothing. It uses Google AdMob, which is Google's code running inside the app, and Google's code does talk to Google. What it takes is described below. Carbiter Pro removes it entirely — there is no advertising code path at all once the app knows the purchase exists.

That split is the whole of this policy: what the app knows about your car never leaves; what an advertisement needs to exist is Google's, and it never includes anything about your car.

What is stored, on your phone

The database lives in the app's own container, encrypted by iOS at rest with your device passcode.

Location

Location is used for two things: correcting fuel figures for gradient, and recognising that two drives were the same journey. It is never used to keep a Bluetooth connection alive.

Your route never leaves the phone. Not the track, not a bounding box — the recorded route is read by this app and by nothing else. Two deliberate exceptions, both described below and both taken only by you: a diagnostic package, which you build and send yourself, and one point — a drive's start or finish, or where the car was last recorded — when you tap it and choose to open it in a maps app or copy its coordinates. This paragraph said "not a fix, not a start point" with no second exception until 29 September 2026, a day after the maps menu shipped.

Google's advertising code works out roughly where you are anyway, and it does it without being told: an internet connection carries an IP address and an IP address is worth a city. Google's own privacy declaration calls that coarse location, and it is listed below with everything else that SDK takes. It is not your route, the app does not hand it over, and Carbiter Pro removes the code that does it.

You can decline it. The app records drives without it and says which numbers are affected.

Three ways something can leave, and they are not the same thing

Nothing leaves on its own. There are exactly three paths out, they carry very different amounts, and the app never takes any of them by itself.

Sharing a drive

Sharing sends a summary and no route: distance, duration, economy, how much that figure is worth, and the area rounded to about a kilometre. Every field is listed on screen before anything leaves. ADR-0013 explains why a route is harder to share safely than it looks, and none of those rules has changed.

One place, opened in a maps app

The pins at either end of a drive's map, and the last recorded place on the Dashboard while the car is parked, open a small menu beside them: Apple Maps, Google Maps, Waze, or Copy coordinates. Opening the menu sends nothing; only that point leaves, and only to the app you choose. Tapping a maps item hands one coordinate pair to that app — for Apple Maps with the pin's label, such as Finish, 28 Sept 2026 at 14:32 — and if the app is not installed, to that company's web page in your browser instead, which is the same disclosure to the same company. Copy coordinates puts the two numbers on your clipboard and nowhere else. Never the route, never the drive's figures. What the maps app then does with the point is that company's policy, not this one. ADR-0013, Amendments 4 and 5.

A diagnostic package, when you are reporting a problem

Settings can build a diagnostic package — a ZIP you make deliberately, to send to somebody who is helping you with a car or with the app. It is the opposite of the summary above in every way that matters, so it is described separately rather than folded into it.

It contains a copy of the whole database: every drive, every sample, your routes in full and your car's VIN. It also contains the field logs, which are on by default — what the app did and when, with your car's make, model and internal identifier and your adapter's name in them, though no route and no VIN — and the raw adapter logs, which are not: those are the bytes off the bus and you have to switch them on. It also contains a short list of settings — which adapter you chose, how far setup got, whether logging is on, and which version of Carbiter you have — a description of the phone it came from (the app's version and build, the iOS version, the phone model, its language and its time zone), and whatever you type into the note field. A manifest.json and a README.txt inside the package list exactly what went into it and what was left out, so the person receiving it can see the contents without opening the database, and so can you.

Three things are true about it and are worth saying plainly:

• Nothing is sent. The app writes a file and stops. Where it goes is a system share sheet away, opened by you, with the recipient chosen by you. Closing that sheet is not evidence it arrived anywhere.
• It is not collected. No copy is kept, nothing is uploaded, and the working file is deleted when you leave the screen and again on the next launch if the app was interrupted.
• No payment details are in it. No transactions, no receipts, no advertising identifiers — a deliberate omission rather than an oversight. What is in it is which version you have, Lite or Pro, on one line of the README.txt: the package exists so somebody can tell why the app behaved as it did, and half the behaviour depends on that. This bullet read "nothing about a purchase is in it" until 2026-09-27, which the package's own README was already more careful than.

Send one only to somebody you would show your driving history to. That is the honest summary: this is your data in full, and the package is as sensitive as the drives it copies.

Deleting

From Settings, at five granularities: one drive, drives older than a date, one car and all its drives, the VIN alone, or everything. "Everything" means three stores — the database, the raw adapter logs and the field logs — and each is named in the confirmation.

In the database, deletion overwrites rather than unlinking: secure_delete, then VACUUM, then a write-ahead-log checkpoint. A test plants a recognisable coordinate, deletes it, and greps the raw file and its sidecars to prove it is gone.

The raw adapter logs, the field logs and any diagnostic archive are ordinary files, and deleting one removes it the way iOS removes any file — nothing is overwritten first, and no promise is made about the storage underneath. After erasing, the app lists each folder again, and if anything is still there it says what, rather than reporting everything gone.

One honest caveat: if your iPhone backs up to iCloud or a computer, an older backup may still contain data you have deleted from the app. Nothing about that is under this app's control.

Your car

Carbiter only reads. It never writes to your vehicle: no clearing of fault codes, no programming mode, no raw CAN. That is enforced at a single choke point in the code with a test asserting the clear-codes command is rejected — see ADR-0015.

Advertising

The free version shows one banner. It comes from Google AdMob, and Google publishes what its SDK takes:

Nothing about your car is in that list, and nothing about your car is available to it. The advertising view is handed a rectangle and nothing else — not a drive, not a VIN, not a route, not a fuel figure. There is no code path from the recording side of this app to the advertising side.

You are asked before anything is requested. Google's consent form is shown on first launch where the law requires one, and until it has been answered Carbiter requests no advertisement at all — the space is there and it is empty. Your answer is Google's to store and yours to change: the same form is reachable again from Settings → Carbiter → Advertising choices, where your region provides them. That entry point did not exist until 2026-09-27 and this sentence pointed at nothing: the form is the app's to present, not something Google offers from outside it.

Carbiter does not ask to track you, and asks Google for non-personalised advertisements. iOS has a permission for linking what you do here with what you do elsewhere, and this app never asks for it, so the advertising identifier is not available to it. That alone would not make the advertisements non-personalised — Google's SDK can build a profile from an identifier of its own without ever touching Apple's — so Carbiter asks for non-personalised advertisements explicitly, on every request. Both halves, because only one of them was true until 2026-09-27.

Pro removes it. Not hidden, not collapsed — once the app knows the purchase exists, the advertising code is not reached, no request is made and the space goes back to the screen.

Paying

Carbiter Pro is a one-off purchase handled entirely by Apple. The app is never told your payment details, your Apple Account or your name; it is told that a purchase exists, and nothing more. The diagnostic package carries that one fact — Lite or Pro, on one line of its README.txt — and no transaction, receipt or identifier. This paragraph said the fact was kept out of the package until 29 September 2026, contradicting the section above it and the package itself.

Contact

kirill@krivoy.co.uk — questions about the app, about what it stored, or a request to have something deleted. A diagnostic package, if you build one, goes to the same address, and only because you chose to send it.

Carbiter is made by one person. A reply takes as long as that implies.