Privacy policy

This policy explains what data is processed when you use the canfiti mobile app for Android and iOS (the “app”) and the canfiti.ru and canfiti.com websites (the “website”), why it is needed and how you can control it. Data of customers of the sensor shop is processed under a separate shop privacy policy (in Russian).

1. Data controller

• Individual Entrepreneur Alexey Sergeevich Medvedev (Russian Federation)
• INN (taxpayer number): 450139339867
• OGRNIP (registration number): 319450100008987
• Email for questions about the app, the website and personal data: app [at] canfiti.com

2. What data is processed

Without an account

The app works without registration. The following is sent to the app server (gate.canfiti.com):

• technical data: a random installation ID the app creates on first launch, the app version, the operating system type and the IP address;
• ELM327 adapter connection log: adapter name and ID, connection type, connection steps and errors, signal strength, phone model and manufacturer, operating system version;
• vehicle unit communication log: the app’s commands and the units’ replies in the sections you open — including the VIN, unit part numbers and software versions, tire pressure sensor IDs, mileage, parameter values and changed settings.

The logs help us find the causes of connection errors and add support for new units and vehicles. The VIN and unit numbers describe the vehicle, but together with the installation ID or an account they may identify you, so we treat them as personal data.

If you sign in

Signing in with an email address is optional and needed to buy a subscription. We process your email address, the name you entered and information about sessions on your devices: sign-in time, IP address, app details. After you sign in, logs and orders are linked to your account.

Subscription and payments

Subscription status, plan, payment method, auto-renewal state and payment history. You enter card numbers and account details on the Paygine payment page or confirm them in your bank’s app — we never receive or store them.

What stays on your phone

Settings (units, theme, language), the last connected adapter, session keys in the phone’s secure storage, the debug log shown in the app and the contents of scanned QR codes.

Google Firebase services

• Firebase Analytics — usage statistics: launches, sessions, screens viewed, the successful sensor registration event (without the VIN). Events include the app instance ID, phone model, operating system version, language and approximate region based on the IP address, and on Android also the device advertising ID. You can reset or turn off the advertising ID in Android settings.
• Firebase Crashlytics — crash reports: where the error occurred in the code, phone model, operating system and app versions.
• Firebase Remote Config (Android) — the app receives settings, for example whether certain features are enabled.

Your email address, name, VIN and vehicle communication logs are not sent to Firebase.

3. Phone permissions

• Location (Android) — without it Android does not allow scanning for Bluetooth adapters or connecting to Wi-Fi adapters. The app does not determine, store or transmit your coordinates.
• Bluetooth and nearby devices — finding and connecting to the adapter. For other devices found during the scan, only their number is sent to the server.
• Local network (iOS) — connecting to a Wi-Fi adapter.
• Camera — scanning QR codes. Images are not stored or transmitted.

You can revoke permissions in your phone settings, but without Bluetooth — and on Android without location — the app cannot connect to the adapter.

4. Who receives data

• Google LLC (Firebase services) — to the extent described in section 2. This is a cross-border transfer of data to the United States.
• The Paygine payment service, the bank and NSPK (Russia’s Faster Payments System) — when you pay for a subscription: payment number and amount, account email.
• An email service — for sign-in code emails and subscription notifications.
• A hosting provider whose servers in Russia run the app server and the website.
• Yandex LLC — Yandex Metrica data on the website, if you agreed to it (section 9).
• Government authorities — only upon a lawful request.

We do not sell data or share it for advertising.

5. Purposes and legal grounds

• Running the app, preventing abuse, diagnosing connection errors, supporting new vehicles, usage statistics and crash reports — the controller’s legitimate interests (Art. 6(1)(7) of Russian Federal Law No. 152-FZ “On Personal Data”).
• Account, subscription, payments and related notifications — concluding and performing a contract with you, including the public offer (Art. 6(1)(5)).
• Accounting and tax records of payments — compliance with legal obligations (Art. 6(1)(2)).
• Website visit statistics — your consent (Art. 6(1)(1)).

We do not process special categories of personal data or biometric data.

6. Retention

• connection and vehicle communication logs — 1 year;
• sign-in code request records — 1 year;
• account and sessions — until the account is deleted; an unused session expires after 90 days;
• subscription and payment data — 5 years, as required by accounting law;
• server technical logs — 14 days;
• Firebase and Yandex Metrica data — under Google’s and Yandex’s rules.

When the period ends, data is deleted or anonymized.

7. Where data is stored and how it is protected

The app server and the website are located in Russia. Data is exchanged only over HTTPS, session keys are kept in the phone’s secure storage, a sign-in code is valid for 10 minutes and card data never passes through our server. Only the controller has access to data on the server.

8. Your rights

You have the right to:

• find out what data about you is processed, why and who receives it;
• request that it be corrected, blocked or deleted;
• withdraw your consent and object to processing;
• file a complaint with Roskomnadzor, the Russian data protection authority (rkn.gov.ru), or a court.

Write to app [at] canfiti.com, preferably from your account email if you have one. We reply within 10 business days. This period may be extended by another 5 business days, in which case we will tell you why.

Deleting your account. In the app: “Profile” → “Delete account”, or by email from your account address. Your email address, name and all sessions on all devices are deleted, subscription auto-renewal is turned off and any paid subscription time is lost. Logs, orders and payments are unlinked from the account and kept within the periods in section 6; we will delete the logs on request.

9. The canfiti.ru and canfiti.com websites

The website itself does not set cookies. Your browser stores only the chosen theme, language and your cookie banner decision — these values are not sent to us.

Yandex Metrica loads only if you click “Accept” in the banner. It sets its own cookies and collects the IP address, browser and device details, pages viewed and the referrer, on-page actions including session replay (Webvisor), and link clicks, including to app stores. This helps us understand which pages are useful. Yandex terms: yandex.com/legal/confidential.

You can change your decision at any time with the “Cookie settings” link at the bottom of the website or by clearing the website data in your browser.

The website links to third-party resources such as app stores and DRIVE2. We are not responsible for how they process data.

10. Children

The app and the website are intended for vehicle owners and are not designed for people under 18. If you learn that a child has given us their data, write to us and we will delete it.

11. Changes to this policy

A new version is published on this page with its date at the top. If a new purpose requires consent, we will ask for it separately.

12. Language of this policy

This policy is a translation of the Russian version published at canfiti.ru/privacy. In case of any discrepancy, the Russian version prevails.