Privacy Policy

Your privacy matters

MechaOBD (“MechaOBD,” “we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains what information is collected, how it is used, and the choices you have when using the MechaOBD application.

Privacy by Design

MechaOBD is designed to keep your vehicle’s diagnostic information under your control. Most features operate entirely on your device without requiring an account or continuous communication with our servers.

Vehicle data leaves your device in two app flows. When MechaOBD connects to a vehicle, it sends the VIN to NHTSA’s vPIC service to look up the year, make and model. If you purchase and request a Diagnostic Report, MechaOBD sends the report capture to the MechaOBD service, which relays it to our AI processing provider.

Information We Collect

Information You Provide

MechaOBD does not require you to create an account to use the application.

If you contact us through the MechaOBD Help Center, we collect the information you choose to provide, including your name, email address, support topic, and message. We use this information only to review and respond to your request and provide customer support.

We do not require or collect the following to provide support:

• Phone number
• Mailing address
• Payment information

Vehicle Diagnostic Data

When you perform a Guided Health Check, Data Capture, Code Scan, or similar diagnostic operation, the app may collect diagnostic information directly from your vehicle through a compatible Bluetooth OBD-II adapter. This information may include:

• Vehicle Identification Number (VIN)
• Vehicle year, make, and model (when available)
• Vehicle engine information and OBD-II protocol
• Diagnostic Trouble Codes (DTCs)
• Live sensor data
• Engine operating parameters
• Readiness monitor status
• Freeze frame data
• Diagnostic session metadata

By default, this information is stored locally on your device.

Vehicle Lookup

When MechaOBD connects to your vehicle, it reads the Vehicle Identification Number (VIN) and sends it to the U.S. National Highway Traffic Safety Administration’s public vPIC service to identify the year, make and model. This happens automatically as part of connecting, and the VIN is the only information sent. vPIC is operated by NHTSA, not by MechaOBD, and is subject to its own policies. No other diagnostic data is transmitted during this lookup.

Device Identifier

The first time MechaOBD contacts our service, the app generates a random identifier and stores it in your device’s Keychain. It is sent with each diagnostic report request so our service can apply usage limits and track reports you have purchased.

This identifier is created by the app, is not your device’s advertising identifier, and is not linked to your name, email address, or Apple Account. It is not used for advertising or tracking. This identifier may persist if you delete and reinstall the app. It is not derived from a hardware identifier, is not shared with third parties for their own purposes, and is used only to provide the service, prevent abuse, and maintain device-scoped report credits. Report credits remain with the device on which they were purchased.

AI Diagnostic Reports

If you purchase and request a Diagnostic Report, the app sends the capture to the MechaOBD service hosted on Cloudflare, which relays it to the Anthropic Claude API for report generation. The capture includes the full VIN, year, make, model, engine and OBD-II protocol, together with the trouble codes and sensor readings from the capture.

This transmission occurs only after you explicitly initiate the request.

MechaOBD does not continuously upload diagnostic information and does not perform background uploads of vehicle data.

The VIN is not used to identify you, is not linked to an account, and is not used for advertising or tracking. Demo Mode transmits no vehicle or diagnostic data to NHTSA vPIC, the MechaOBD service, or Anthropic.

Local Storage

Diagnostic sessions, reports, application settings, and other app data are stored locally on your device unless you choose to export or share them.

You may delete this data at any time. In Past Reports, opening a report reveals a Delete button that removes that report and the vehicle data behind it. Settings ▸ Your Data ▸ Delete All Diagnostic Data removes every capture, report and diagnostic log stored on the device at once. Uninstalling the app also removes everything MechaOBD has stored. Reports you have already saved or shared as PDFs are yours and are not affected.

Bluetooth Permissions

MechaOBD requests Bluetooth access solely to communicate with compatible Bluetooth OBD-II adapters.

Bluetooth is not used for advertising, tracking, or unrelated device discovery.

Internet Connectivity

Internet access is required only for features that depend on online services, including vehicle identification lookups, AI-generated diagnostic reports, and future cloud-based functionality.

Most diagnostic functions remain available without an internet connection.

Purchases

MechaOBD Diagnostic Reports are sold as an in-app purchase. Payment is handled entirely by Apple—MechaOBD never receives or stores your payment card, billing address, or Apple Account details.

When a purchase completes, the app sends Apple’s signed transaction record to our service, which verifies it with Apple and records that one report has been paid for against the device identifier described above. We store the Apple transaction identifiers, and enforce the original transaction identifier as unique, to prevent a purchase from being redeemed more than once. These identifiers identify the transaction, not you.

Data Sharing

We do not sell, rent, or trade your personal information or vehicle diagnostic data.

We may share information only in the following circumstances:

• With Cloudflare, which hosts the MechaOBD service that receives and relays a requested Diagnostic Report capture.
• With the Anthropic Claude API, which receives the report capture described above to generate the requested Diagnostic Report.
• With email and service providers as needed to deliver and respond to Help Center requests.
• With the U.S. National Highway Traffic Safety Administration’s public vPIC service, which receives your VIN to identify your vehicle.
• With Apple, which processes in-app purchases and provides the transaction record our service verifies.
• When required by applicable law or legal process.
• To protect the rights, safety, or security of MechaOBD, our users, or others.

Our service providers are authorized to process data only for the purpose of providing the requested service.

Analytics and Tracking

MechaOBD does not use advertising networks or third-party advertising trackers.

If anonymous analytics or crash reporting are introduced in a future version, this Privacy Policy will be updated before those services are enabled.

Data Security

We use reasonable administrative, technical, and organizational measures to protect information processed by MechaOBD.

When diagnostic data is transmitted to our online services, it is sent using encrypted connections (HTTPS/TLS).

While we strive to protect your information, no method of electronic transmission or storage can be guaranteed to be completely secure.

Data Retention

Vehicle diagnostic data stored locally remains on your device until you delete it.

Diagnostic Report request payloads and generated report text are not retained by the MechaOBD service. The service streams the request to the AI provider and stores no request body, vehicle data, diagnostic readings, or report text in a database, object store, or application log.

The MechaOBD service retains a metadata-only record of each Diagnostic Report request indefinitely. This record may include the random device identifier, timestamp, served model, completion and HTTP status, token counts, computed cost, provider request ID, capture ID, submitted payload size, and app version. It contains no VIN, other vehicle data, diagnostic readings, or report text, and is not linked to your name or contact information.

Cloudflare observability is enabled for service reliability, but MechaOBD application error messages do not log request bodies, VINs, diagnostic readings, or report content. Any retention by the AI provider is governed by that provider’s applicable terms and policies.

Help Center messages may be retained for as long as reasonably necessary to respond to your request, maintain support records, improve service reliability, and meet legal obligations.

Children’s Privacy

MechaOBD is not directed to children under the age of 13, and we do not knowingly collect personal information from children.

If we become aware that personal information has been collected from a child in violation of applicable law, we will take reasonable steps to delete it.

Your Choices

You may:

• Use MechaOBD without creating an account.
• Decide whether or not to generate AI Diagnostic Reports.
• Delete any saved report, or all stored diagnostic data, from within the app.
• Decline Bluetooth or network permissions, understanding that certain features may not function without them.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or business practices.

When material changes are made, the updated Effective Date will be revised. Continued use of MechaOBD after changes become effective constitutes acceptance of the updated Privacy Policy.