Shturman Privacy Policy
Effective date: 11 October 2026
Last updated: 14 October 2026
This is a translation of the Ukrainian text. If the two differ, the Ukrainian version applies.
1. Who is responsible for the data
Shturman is an app by Mavka Labs. Mavka Labs is responsible for the processing of data described in this policy. Questions about data: mavkalabs.support@gmail.com.
2. Summary
- There are no accounts, no ads and no tracking. Data is not sold, not passed to advertisers and not used to build profiles of people.
- Data about the user, the car and trips is stored on the phone.
- Trip records and the activity log are kept only with consent. Consent can be changed in the app's settings, where keeping records and the log can also be turned off.
- A trip record is transferred only by the user's own action: when they share the record or add a trip to a problem report (section 7).
- Crash reports (Firebase Crashlytics) are sent automatically. They contain no data about the user or the car (section 6).
- A problem report is sent only by the user themselves (section 7).
- The map, search and routing work through third-party open services. They receive only the data needed to show the map, download roads, find an address or plan a route (section 5).
3. How the app works
Shturman guides a car along a route when GPS is gone, drifting or showing the wrong place.
- With an OBD-II adapter, the app gets the speed from the car. The phone's gyroscope and compass show the direction of travel, the accelerometer shows stops and the phone's position in the holder, and the OpenStreetMap road map shows where the car can be. GPS is used to suggest the starting point and, on the road, as a backup — only after checking that it shows the true position.
- Without an adapter, the app estimates the speed automatically from the speed limits on the roads along the route (from OpenStreetMap), and the car's position moves along the route. The driver corrects stops, speed and position by hand. GPS is only shown on the map and does not change the car's position.
The app only reads data from the car and changes nothing in it.
4. Data on the phone
| Data | Purpose | Retention | Transfer |
|---|---|---|---|
| Sensor readings: gyroscope, accelerometer, compass, barometer | Direction of travel, stops, leaving the car | Not stored separately | Only in a trip record |
| Location data (GPS), if allowed | Starting point, showing the car on the map, checking GPS | Not stored separately | To the services in section 5 — only the points needed for a request |
| Car data from the adapter: speed, mileage, other readings | The car's true speed | Not stored separately | Only in a trip record |
| Car parameters: speedometer scale, car profile, compass position in the holder | Accurate speed and direction for this car | Until the app is deleted | No |
| Adapter address and name; the adapter's Wi‑Fi network name | Reconnecting to the adapter | Until the adapter is removed in the settings; after that only its address stays in the list of removed adapters, so the app does not connect to it by itself | Adapter name — only in a trip record |
| VIN | Identifying make, model and year; choosing commands for the car | The phone's secure storage (iOS Keychain, Android Keystore) | Never. It is not shown on screen and not written to the log or records; they hold only an irreversible fingerprint (the first 16 characters of an HMAC-SHA256 computed with a key that exists only on the phone) |
| Saved places: home, work, the car's location, recent places, destinations, stops; the number of arrivals at places | Guidance, resuming a trip | Until deleted | To the services in section 5 — only the points needed for a request |
| Settings: theme, last adapter, completed introduction, the speed for the no-adapter mode | Remembering choices | Permanently | No |
| Road cache | Guidance with a weak connection | Up to 90 days | No |
| Trip records (with consent) | Replaying a trip and finding guidance errors: the wrong road, a wrong turn, a lost connection to the adapter | Until deleted | Only by the user's action (section 7) |
| Activity log (with consent) | Finding errors outside a trip: adapter connection, starting point, the app closing | 30 days | No; actions during a trip and just before it are also in the trip record |
Contents of the activity log: app launches and closings; the car's position saved to resume guidance; the adapter's state, its name and connection errors; the car's speed once per second outside a trip record; car positions marked by the user, destinations and found places with their coordinates; guidance prompts with street names; where the dot was on the map and where GPS showed the car when the app was unsure of the car's position; position corrections by GPS; speed camera alerts; trip summaries; the car's make, year and platform, the VIN fingerprint; without an adapter — the driver's corrections (speed, pause, position); the phone's battery level and charging, the screen state.
Contents of a trip record: GPS points (coordinates, accuracy, speed, heading, altitude; on Android — satellite data); the route and the roads of the trip; the calculated position of the car; car data from the adapter; the phone's sensor readings and the list of its sensors; the car's make, year and platform, the VIN fingerprint; the same app actions as in the log, for the time of the trip and just before it.
A trip record shows where the user has been. Guidance works the same without records.
5. Third-party services
The services receive only the data needed to show the map, download roads, find an address or plan a route: no name, VIN or phone number. Each service sees the IP address and the request itself, and works under its own privacy rules.
| Service | Data | Purpose |
|---|---|---|
| OpenFreeMap (tiles.openfreemap.org) | The part of the map on screen | Showing the map |
| Shturman road files (tiles.shturman.mavkalabs.com; Cloudflare, Inc.) | The road files needed (they reveal the approximate area). Cloudflare may log requests; Mavka Labs does not see those logs | Downloading roads |
| Photon (photon.komoot.io; komoot GmbH) | The typed text (from three letters on) and the area, accurate to about a kilometre | Address suggestions |
| Nominatim (nominatim.openstreetmap.org) | The search query and a search area centred on the car's position; a point chosen on the map; the car's position while setting home or work | Finding an address; the address of a point |
| Overpass (overpass-api.de, overpass.openstreetmap.fr, overpass.kumi.systems, overpass.private.coffee) | The bounds of the area around the car or the route | Downloading roads when Shturman's road files are missing |
| OSRM (router.project-osrm.org), FOSSGIS (routing.openstreetmap.de, valhalla1.openstreetmap.de) | Start, destination and the car's heading; during a trip with a route — the car's position about every 5 minutes and when re-routing | Planning a route |
| Apple (App Store), Google (Google Play) | Installation, update and crash data under their own rules | Installation and updates |
When the services change, this policy is updated before the new version of the app is released.
6. Crash reports (Firebase Crashlytics)
When the app crashes or an error occurs, it sends a short report to Firebase Crashlytics (Google LLC). No separate consent is asked, because the reports contain no data about the user. Google processes them only for Mavka Labs under the Firebase data processing terms. The developer's debug builds send no reports.
Contents:
- a crash: the type and text of the error, where in the code it happened, the app and system version, the phone model, and the data Crashlytics collects itself, including the Crashlytics and Firebase installation IDs;
- the adapter did not connect: the step and the cause, Bluetooth or Wi‑Fi, the error text, whether a trip was under way;
- the connection to the adapter dropped: the connection state, the error text, Bluetooth or Wi‑Fi, the number and rate of readings before the drop;
- GPS corrected the car's position: the fact of the correction, the GPS state and how the app had been moving the dot before that.
Not sent: coordinates, GPS data (other than its state), the VIN, the car's speed, turns. Reports about the adapter do not include its name. Adapter addresses (MAC, UUID, IP) and numbers that look like coordinates are removed from error texts.
Purpose: stable operation and fixing errors. The reports are not linked to a person and are not used for ads, tracking or profiles.
Legal basis: Mavka Labs' legitimate interest in the app working without failures. Retention: 90 days, after which Google deletes the reports.
7. Problem report
A report is sent only by the user themselves — from the app's settings, or after a trip if something went wrong.
Contents: the chosen reasons, the user's text, the app version, the phone's operating system. If a trip is added to the report — its number and record (contents: section 4). Before sending, what the record contains is shown under the trip.
Without a record: a report from the app's settings can be sent without a trip. If there is no consent to records, no new records appear on the phone; existing ones remain until deleted.
Does not contain: the VIN. There is no account. The IP address is not stored.
Storage: Mavka Labs' private storage on Cloudflare (Worker, R2); Cloudflare, Inc. processes reports only for Mavka Labs.
Purpose: finding and fixing guidance errors. Legal basis: consent, given by sending the report; it can be withdrawn by asking for the report to be deleted. Retention: until the problem is dealt with, no longer than 12 months.
Rating the app: if after a trip the user answers that everything worked, the App Store or Google Play rating window opens. Mavka Labs receives nothing in this case.
8. Permissions
Any permission can be withdrawn in the phone's settings.
- Location (while using the app): starting point, showing the car on the map, checking GPS. During a trip the app also works with the screen off (on iPhone a blue indicator is shown, on Android a notification). The “Always” permission is not requested.
- Motion sensors (iPhone only): the barometer, to tell bridges and overpasses apart. On Android the barometer needs no permission.
- Bluetooth and local network: connecting to the adapter over Bluetooth, Bluetooth LE or Wi‑Fi. Bluetooth is not used to determine location. For a Wi‑Fi adapter, the app reads the name of the current network and can switch to the adapter's network; it does not change or remember other networks.
- Notifications (Android 13+): showing that guidance is running during a trip.
9. Storage and protection
- Data is stored in the app's storage on the phone, except the reports in sections 6 and 7.
- The activity log is deleted automatically: days older than 30 are deleted by the app at every launch.
- The VIN and the key of its fingerprint are not included in Android backups and do not move from an iPhone to another phone.
- iCloud and Google backups may contain places, trip records and the log. These backups are kept by Apple or Google; Mavka Labs does not see them.
- Exchange with the services in sections 5–7 is only over a secure connection (HTTPS). The app connects to a Wi‑Fi adapter directly, without the internet.
- The reports in sections 6 and 7 are stored on Google and Cloudflare servers, which may be outside Ukraine, including in the EU and the US. Both companies process them only for Mavka Labs, under contract and with protection no weaker than described here.
- Mavka Labs' servers hold no other user data.
10. Deleting data
- Trip records: in the app's trips section.
- Recent places: in the app's settings, places section.
- The car's location: from the car marker on the map.
- Adapter: in the adapter settings.
- Car parameters: together with the app.
- Activity log: automatically after 30 days; keeping it is turned off in the app's settings.
- All data on the phone: by deleting the app. On iPhone, the VIN in the secure storage is erased at the next installation.
- Backups: in the iCloud or Google settings.
- A problem report that was sent: a request to mavkalabs.support@gmail.com stating the date it was sent.
- A record that was shared: it is kept by the recipient; Mavka Labs cannot delete it.
11. Children
The app is intended for drivers and is not intended for persons under 18. Children's data is not knowingly collected.
12. Rights
Under the Law of Ukraine “On Personal Data Protection” (in the EU, under the GDPR), the user can find out what data is processed, request its correction or deletion, and withdraw consent. Most of this the user does on the phone themselves (section 10). Other requests: mavkalabs.support@gmail.com. Complaints: the Ukrainian Parliament Commissioner for Human Rights.
13. Map, sources and licences
- Map data: © OpenStreetMap contributors, Open Database License 1.0 (https://www.openstreetmap.org/copyright).
- Vector map: OpenFreeMap © OpenMapTiles.
- Shturman road files: a derivative database of OpenStreetMap, ODbL 1.0. A copy or a description of how it is produced — free of charge on request: mavkalabs.support@gmail.com.
- Speed cameras and speed limits: OpenStreetMap, ODbL 1.0.
- Search and routing: Photon (komoot), Nominatim, OSRM, FOSSGIS — on OpenStreetMap data.
- Open-source software: MapLibre Native (BSD-2-Clause), Flutter (BSD-3-Clause), Firebase Crashlytics (Apache 2.0), OBDb (CC BY-SA 4.0), vininfo (BSD-3-Clause), the Manrope font (SIL Open Font License 1.1). The full list of libraries and licence texts — in the app's settings, the about section.
14. Changes to this policy
Important changes are announced on this page and in the update notes in the store. The date of the last change is at the top.
Revision history:
- 14 October 2026. Added the no-adapter mode: the speed is estimated automatically. The contents and purpose of a trip record and of the activity log are described separately. Search services receive the car's position while home or work is set; routing services — the car's position during a trip with a route. The activity log is deleted after 30 days, at every launch. Added backups, deleting data, sources and licences, the offer of the road files under the ODbL. Crash reports are sent without separate consent. A problem report does not contain the adapter's name.
- 13 October 2026. Added crash reports (Firebase Crashlytics). The motion sensors permission on iPhone is used only for the barometer.
- 12 October 2026. The text rewritten in plainer language. Developer: Mavka Labs.
- 11 October 2026. First edition.