Privacy Policy
Whellz processes all personal data exclusively on your device. The developer has no access to your data at any point. No data is transmitted to external servers, sold, or shared with any third party.
1. Controller (Art. 13 para. 1 lit. a DSGVO)
The controller responsible for data processing within this application is:
Ufuk Emre Fakioglu
hello@whellz.app
2. Data We Process (Art. 13 para. 1 lit. c DSGVO)
The following categories of personal data are processed exclusively on your device:
- Precise GPS coordinates (latitude and longitude) recorded during active trips
- Speed in km/h, derived from GPS or, when connected, OBD2 sensor data
- Timestamps for trip start, trip end, and individual location waypoints
- Accelerometer event counts: harsh acceleration events, harsh braking events, and cornering events, each stored as an integer count per trip
- Trip classification labels assigned by you: Business, Personal, Medical, or Unclassified
- Derived, on-device usage patterns computed from your own trips: frequently visited start and end areas (grouped by an approximate radius), time of day, and repeated routes, used only to suggest a trip type for a new trip
- When connected, the connected car audio device name, read locally to match a drive to a vehicle in your garage
None of the above data is transmitted to or stored on any server operated by the developer or any third party. When you export your trip log as a CSV file, that export is initiated exclusively by you and sent directly to the destination you select, for example email, iCloud Drive, or another cloud storage service you designate.
3. On-Device Processing Only
All personal data listed in Section 2 is stored and processed exclusively on your device using Apple's on-device frameworks (CoreLocation, CoreMotion, SwiftData). The developer has no access to your personal data at any point, whether directly or through a backend service or intermediary.
Speed camera proximity data is sourced from OpenStreetMap and evaluated locally on your device within a defined geographic radius. No device identifier, location, or personal information is transmitted as part of this lookup.
To make trip logging faster, Whellz analyzes your own trips on your device to learn usage patterns, for example which areas you start and end in, at which times of day, and which routes you repeat. It uses these patterns only to propose a trip type (for example Business or Personal) for a new trip. Any such classification is only a suggestion: you always confirm the trip type yourself, and the app never sets it on your behalf. This analysis runs entirely on your device, is never transmitted to any server, and is derived from your stored trips. Deleting your trips removes the basis for these suggestions.
4. Legal Basis (Art. 13 para. 1 lit. c DSGVO)
Processing is carried out on the following legal bases:
- Art. 6 para. 1 lit. b DSGVO: processing is necessary for the performance of the contract between you and the developer. Trip logging, speed measurement, and route recording are the core functions of the app, which you request by using it.
- Art. 9 para. 2 lit. a DSGVO: your explicit consent, obtained in-app via a dedicated consent modal, for the processing of health-related data when you use the Medical trip classification (see Section 5).
5. Health Data: Medical Trip Classification (Art. 9 DSGVO)
Whellz allows you to classify trips as "Medical." The combination of a GPS route and a medical classification label may constitute health data within the meaning of Art. 9 para. 1 DSGVO and Recital 35, as it may reveal information about your health or medical situation.
Processing of such special-category data requires explicit consent under Art. 9 para. 2 lit. a DSGVO. Before you can use the Medical classification for the first time, the app displays a dedicated consent modal that reads: "Recording trips as Medical may constitute health data (Art. 9 DSGVO). This data is stored only on your device. I consent." You must affirmatively tap "I consent" to proceed. If you do not provide consent, the Medical classification option remains unavailable.
Your consent timestamp is stored locally on your device. You can withdraw consent at any time by deleting all Medical-classified trips and resetting the consent flag in app settings. On-device-only storage limits practical exposure, but does not remove the legal obligation to obtain consent prior to processing.
6. Your Rights (Art. 15-22 DSGVO)
You hold the following rights under the DSGVO. Because the developer holds no personal data, all rights are exercised directly by you within the app. No data subject request needs to be submitted to the developer:
- Right of access (Art. 15): all personal data is accessible to you at any time within the app.
- Right to rectification (Art. 16): you can edit trip details, classification labels, and any other stored fields within the app.
- Right to erasure (Art. 17): you can delete individual trips or all app data at any time. See Section 7 for retention obligations that may apply to Business trips.
- Right to restriction of processing (Art. 18): you can pause or stop recording at any time, and revoke location access in iOS Settings.
- Right to data portability (Art. 20): you can export your complete trip log as a CSV file at any time via the Trip Log screen.
- Right to object (Art. 21): you can revoke location access at any time in iOS Settings, which prevents further data collection.
For any questions about your rights or this policy, contact hello@whellz.app.
7. Data Retention and the Paragraph 147 AO Obligation
Whellz does not apply automatic deletion to any trip records. You control when records are deleted.
If you use Whellz to maintain a Fahrtenbuch under paragraph 6 para. 1 no. 4 sentence 3 EStG, your Business-classified trip records may be subject to a 10-year retention obligation under paragraph 147 AO. Before you delete any trip classified as Business, the app will display a warning reminding you of this statutory obligation. You are solely responsible for compliance with applicable tax retention law.
8. Cookies, Analytics, and Third-Party SDKs
Whellz contains no cookies, advertising SDKs, analytics platforms, crash reporting tools, or behavioral tracking of any kind. No third-party code within the app collects or transmits data about you, your device, or your usage behavior.
9. App Store Privacy Nutrition Label
This app is currently categorized as "Data Not Collected" in the Apple App Store privacy nutrition label, which accurately reflects the on-device-only architecture described in this policy.
If crash reporting, analytics, or any other data collection mechanism is added in a future version of the app, this privacy policy and the App Store privacy nutrition label will be updated prior to that version's submission to the App Store.
10. Supervisory Authority (Art. 13 para. 2 lit. d DSGVO)
You have the right to lodge a complaint with the data protection supervisory authority competent for the controller:
Bayerisches Landesamt fur Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
www.lda.bayern.de
Changes to This Policy
If this policy is updated in a material way, the revised version will be published at this URL with an updated effective date. Where required by law, you will be notified within the app before the change takes effect.