Privacy policy
Glovebox ("we", "us", "the app") is an offline-first car management application published by Demesugh Aber ("the publisher"). This policy explains what data Glovebox collects, where it lives, who can see it, and what rights you have.
- Your vehicle data, logs, photos and service-centre contacts live on your device. If you have iCloud enabled, an encrypted copy syncs to your own private CloudKit container — only you can access it.
- We do not sell your data. We do not embed third-party advertising or analytics SDKs.
- We use Apple's MetricKit to receive anonymous crash and performance reports so we can fix bugs.
- VIN look-ups send the VIN (and nothing else) to the US National Highway Traffic Safety Administration's public vPIC API.
- Sign in with Apple and Sign in with Google receive only your email and display name from Apple or Google — never your password.
- You can delete your account and all associated data from inside the app at any time (Settings → Delete account & all data).
When you sign in, we receive — with Sign in with Apple: the email and full name you choose to share (if you use Apple's "Hide my email" feature, we only ever see the relay address); with Sign in with Google: the email and display name from your Google account, returned via the OAuth 2.0 openid, email and profile scopes.
We store these locally in UserDefaults so we can show your name and email in Settings and on the About screen. We never receive your password.
You create the following yourself, and it stays on your device plus your iCloud (if iCloud sync is on): vehicle information (make, model, year, plate, colour, odometer); log entries (fuel stops, services, repairs, costs, notes); maintenance items (oil change intervals, insurance renewal dates and the like); service-centre contact details (name and phone number); and your currency, distance unit and notification preferences.
Apple's operating system periodically delivers anonymous performance and crash reports to Glovebox via the MetricKit framework. These reports are generated and aggregated by iOS itself; we receive them only after Apple has stripped personal identifiers. We use them solely to diagnose crashes and performance regressions.
Glovebox records timestamped events (e.g. "log saved", "paywall shown") in a local file at Application Support/Glovebox/analytics.log.jsonl. These events include the event name and a handful of contextual values (e.g. log type, currency code); they do not include your name, email or any vehicle identifiers tied to your identity; and they are never transmitted off your device.
Glovebox includes a generic "analytics sink" interface for future integration with services such as Sentry or TelemetryDeck. No such sink is active at the time of this Privacy Policy. If we ever enable one, we will update this document and the App Privacy nutrition label before that release ships. You can view and clear these events from Settings → Data & Offline → Diagnostics.
Subscriptions and one-time purchases are processed by Apple StoreKit. Glovebox receives the transaction outcome (success, pending or failed) and the product identifier — never your payment instrument. Apple's own privacy policy covers their handling of the transaction.
When you scan or type a VIN, Glovebox sends the 17-character VIN to the US Department of Transportation's free vPIC API. It returns make, model, year and similar specifications. No identifying information about you is sent.
Receipt scanning, VIN scanning and odometer scanning all run entirely on-device using Apple's VisionKit framework. Images are processed in memory, OCR'd and discarded. They are never uploaded.
Glovebox schedules maintenance reminders as local notifications via the UNUserNotificationCenter framework. They run on your device and are never delivered through a remote push server.
| type | location | encrypted at rest |
|---|---|---|
| vehicles, logs, maintenance | swiftdata store on device | yes (ios file protection) |
| same, when icloud is on | your private cloudkit container | yes (apple end-to-end) |
| account email, preferences | userdefaults on device | yes (ios file protection) |
| analytics events | application support/glovebox/analytics.log.jsonl | yes |
| metrickit payloads | apple os, then delivered to glovebox | aggregated by apple |
We do not operate our own server. Glovebox has no backend database — your data either lives on your device or in iCloud, which is your property under Apple's terms.
| party | what they receive | why |
|---|---|---|
| apple | storekit transactions, sign in with apple credentials, icloud sync, metrickit | required platform services |
| oauth 2.0 sign-in handshake | only when you tap "continue with google" | |
| nhtsa vpic api | the vin you scanned | public-data look-up |
No advertising networks. No third-party trackers. No marketing pixels.
- Access your data — open the app and view everything you've recorded.
- Export your data — Settings → Data & Offline → Export log book. Generates CSV and PDF.
- Delete your data — Settings → Delete account & all data. Removes all SwiftData records, preferences, scheduled notifications and the analytics log. CloudKit-mirrored copies follow automatically.
- Request a copy — email us at support@demesughaber.com and we'll respond within 30 days.
Under the EU GDPR, the Nigerian NDPR and similar regulations you may also have rights of correction, restriction or portability. Contact us to exercise them.
We retain your data only while your Glovebox account exists. Deleting the account inside the app purges everything immediately. We have no "recently deleted" backup we can restore from — the deletion is final on purpose.
MetricKit payloads delivered to us are kept for 90 days for diagnostic purposes and then discarded.
Glovebox is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has signed in to Glovebox, email us and we will delete the account.
We may update this policy as the app evolves. Significant changes will be announced via an in-app notice the next time you launch Glovebox. The "Last updated" date at the top of this document always reflects the current revision.
Email support@demesughaber.com ↗
PUBLISHER: DEMESUGH ABER, ABUJA, NIGERIA — GLOVEBOX.DEMESUGHABER.COM/PRIVACY