Privacy Policy
Effective date: [EFFECTIVE DATE]
2.1 Controller
The controller responsible for your personal data is:
[PUBLISHER LEGAL ENTITY] · [PUBLISHER ADDRESS] · [CONTACT EMAIL]
This policy explains what personal data the App processes, why, on what legal basis, with whom it is shared, and your rights under the EU General Data Protection Regulation (GDPR) and Greek data-protection law.
2.2 Privacy by design — most data stays on your device
Diodia is built to keep data on your device. We do not operate user accounts, we do not ask for your email, and we do not store your routes, trips, or location on our servers. Your live location during a trip is processed on your device to trigger toll alerts and is not streamed to us. There is no cloud sync in this version.
2.3 What data we process, why, and on what legal basis
| Data | Purpose | Stored where | Legal basis (GDPR) |
|---|---|---|---|
| Coarse & precise location | Compute routes, match toll plazas on your route, and (Pro) trigger on-device proximity alerts | Processed on-device; live position not sent to our servers for alerts. Place/route queries are sent to Mapbox to compute a route (see §2.5). | Performance of the service you request (Art. 6(1)(b)); and our legitimate interest in providing the core calculator (Art. 6(1)(f)) |
| Background location (during an active trip only) | Keep proximity alerts working while the App is in the background so the alert can be spoken while you drive | On-device only | Performance of the Pro feature you activated (Art. 6(1)(b)) |
| Recent routes (max 3), settings, active-trip snapshot (self-expires ~6h) | Convenience; remember your recent trips and preferences | Local device storage (MMKV) only | Legitimate interest / performance of the service (Art. 6(1)(b),(f)) |
| Saved routes (if/when the Pro feature ships) | Let you save routes | Local device storage only — no server storage, no account | Performance of the service (Art. 6(1)(b)) |
| Purchase entitlement (that you unlocked Pro, one-time or subscription) | Unlock and restore your Pro features | Managed via RevenueCat; purchase/billing itself handled by Apple/Google | Performance of the contract (Art. 6(1)(b)) |
| Analytics events (no PII) | Understand feature usage to improve the App | PostHog — only if you consent; no event before consent | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Crash / error diagnostics (PII scrubbed) | Diagnose crashes and keep the App stable | Sentry | Legitimate interest in a stable, secure App (Art. 6(1)(f)) |
We do not show ads, do not use advertising identifiers, and do not track you across other apps or websites.
2.4 Location — clear disclosure
Diodia uses your location, including precise location, to calculate routes and toll costs and to power toll-proximity alerts. If you enable the Pro trip features, the App uses background location during an active trip so that it can speak a toll alert aloud even when your screen is off or the App is not in the foreground. Background location is used only while a trip is active and only to detect that you are approaching a toll plaza; it is processed on your device and is not transmitted to us. You can revoke location permission at any time in your device settings (this will disable routing and alerts).
2.5 Processors and third parties we share data with
We use the following service providers (“processors”) to run the App. We maintain data-processing agreements (DPAs) and records of processing with them as required by GDPR.
| Processor | Role | Data involved |
|---|---|---|
| Mapbox | Directions & geocoding (route computation) | Place/route queries (origin, destination, route geometry) are sent to compute routes and resolve place names |
| RevenueCat | Manages your Pro purchase entitlement | Purchase/entitlement identifiers; no name or email collected by us |
| Apple | App Store & in-app purchase processing | Handles your payment; subject to Apple's privacy policy |
| Google Play & in-app purchase processing | Handles your payment; subject to Google's privacy policy | |
| PostHog | Product analytics (consent-gated) | Non-identifying usage events; only if you consent |
| Sentry | Crash / error diagnostics | Diagnostic data with PII scrubbed |
We do not sell your personal data.
2.6 International transfers
Some processors (for example, US-based providers) may process data outside the European Economic Area. Where this happens, transfers are protected by an appropriate safeguard under GDPR — such as the processor's certification under the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
2.7 Retention
On-device data (recent routes, settings, saved routes) is kept on your device until you delete it or uninstall the App. The active-trip snapshot self-expires after approximately 6 hours.
Analytics and diagnostics held by our processors are retained for the standard periods set out in their policies and then deleted or aggregated.
Uninstalling the App removes locally stored data from your device.
2.8 Your rights
Under GDPR you have the rights to: access your data, request rectification or erasure, restrict or object to processing, data portability, and to withdraw consent at any time (without affecting processing already carried out).
Because Diodia keeps most data on your device, you exercise many of these rights directly: you can view, edit, and delete your recent/saved routes and settings in the App, and uninstalling the App erases local data. You can withdraw analytics consent at any time in the App's settings, which stops further PostHog events.
For data held by our processors, or for any other request, contact us at [CONTACT EMAIL]. You also have the right to lodge a complaint with a supervisory authority — in Greece, the Hellenic Data Protection Authority (HDPA) — or with the authority in your EU country of residence.
2.9 Children
Diodia is not directed at children and we do not knowingly collect data from children. The App is intended for adult drivers.
2.10 Security
We follow reasonable technical and organisational measures to protect data, including keeping location data on-device, scrubbing PII from diagnostics, and not collecting accounts or emails. No method of transmission or storage is completely secure.
2.11 Changes to this policy
We may update this Privacy Policy. Material changes will be reflected in the “Effective date” and, where appropriate, notified in the App.
2.12 Contact
[PUBLISHER LEGAL ENTITY] · [CONTACT EMAIL] · [PUBLISHER ADDRESS]