Privacy policy

Last updated: 5 November 2026 · Codeo Solutions Limited

This privacy policy covers the Fahrtenbuch app for iPhone and Android and this website. It explains which personal data we process, why, on what legal basis and for how long. The German version is the original; this English version is provided for convenience.

1. Who is responsible for my data?

The controller under the General Data Protection Regulation (GDPR) is:

Codeo Solutions Limited
Gallants Farm, Gallants Lane
East Farleigh, Maidstone ME15 0LF
United Kingdom
Email: info@codeo.com.tr

For any privacy question or to exercise your rights, write to info@codeo.com.tr. We answer in English or German.

2. The short version

• You need an account to use Fahrtenbuch. You sign in with Apple, with Google or with a code sent by email. We do not store a password.
• Your logbook (vehicles, trips, corrections, odometer readings and, if you enter them, fuel or electricity notes, receipts and drivers’ names) is stored in your account on Microsoft Azure servers in the EU (region North Europe, Ireland) and synced between your phones. The app records trips even without internet; they are synced later.
• The app uses your location only during a trip that you start with “Start trip”, until you end it with “End trip”. The individual GPS points stay on the phone.
• The address for a GPS position is looked up by your operating system’s address service (Apple on iPhone, Google on Android). For this, coordinates go to Apple or Google, not to us (section 3.3).
• Optionally, the app can read a photo of the vehicle registration certificate or the car, of the odometer, of the trip computer or of a receipt. The photo goes to OpenAI, also outside the EU, only to be read, and we neither store nor log it (section 3.8).
• The trip reminder is optional and off until you turn it on. What the phone notices for it stays on the phone (section 3.10).
• For support, authorised staff can see an account’s email address, sign-in method, dates and counts, never the contents of a logbook. Access and actions are logged (section 3.11).
• Your phone may include the app’s data in a backup that you set up yourself (iCloud, Google). We have no access to it (section 3.9).
• You can delete your account in the app at any time; your data is then deleted from the server immediately.
• Google ads only with your consent where required (section 3.12). No third-party analytics, only anonymous counters of our own (section 3.14). No crash reports to third parties, no sale of data.

3. What data does the Fahrtenbuch app process?

3.1 Account and sign-in

You need an account to use Fahrtenbuch. There is no password; we do not store a password from you. You sign in in one of three ways:

• Email and code: you enter your email address and receive a 6-digit code that is valid for 10 minutes. We store your email address, and the code only as a hash. The email with the code comes from the sender “Fahrtenbuch” <DoNotReply@7eec93ce-601a-456b-ae5b-9bc6f6246b21.azurecomm.net>; we send it through Microsoft Azure Communication Services with its data location in the EU.
• Sign in with Apple: on iPhone the app opens Apple’s own sign-in sheet; on Android, signing in with Apple runs in the phone’s browser. Apple gives us an identifier for your Apple Account and an email address. If you choose “Hide My Email”, this is a relay address created by Apple. We do not ask for your name. Where Apple provides a token for it, we store it so that we can revoke the link to your Apple Account with Apple when you delete your account.
• Sign in with Google: signing in runs in the phone’s browser. Google gives us an identifier for your Google Account and your email address.

When you sign in with Apple or Google, Apple or Google processes the sign-in as an independent controller under its own terms and privacy policy. We store your email address and the provider’s identifier so that we can recognise you and assign your logbook to your account.

We keep sign-in sessions for signed-in devices. Session keys are stored on the server only as hashes, and on the phone in the protected keychain (iOS) or keystore (Android).

3.2 Location during a trip

When you tap “Start trip”, your phone records your location by GPS until you tap “End trip”. So that no kilometres are missing, recording continues when you use another app or the phone is locked. Location access “While Using the App” (iPhone) or “Allow only while using the app” (Android) is enough for this; the app does not ask for “Always”. While a trip is running, your phone shows it: on Android with a persistent notification, on the iPhone with the location indicator in the status bar. Fahrtenbuch does not record your location outside of a trip.

From the route the app calculates the distance and the start and end point. The individual GPS points of the route stay on the phone and are not sent to our server. The distance and the start and end point are part of your logbook (section 3.4) and are synced with your account.

If you tap “Use current location” for Home or Work in the settings, the app gets your location once to fill in the address. These two addresses stay on the phone.

3.3 Address lookup

To turn coordinates into an address (and back), the app uses the operating system’s address service: Apple’s on iPhone, Google’s on Android. The coordinates or the address you type are sent to Apple or Google for this. Apple and Google process this data under their own privacy policies and may process it outside the EU. We receive no other data about you from Apple or Google. The address lookup is a service of your operating system, not our own: the requests and the answers do not reach us. It needs an internet connection; without one, the app saves the coordinates without a street address.

3.4 Vehicles and logbook

The app keeps vehicles, trips, corrections and odometer readings in its database on your phone and syncs them with your account. It records trips even without an internet connection; they are sent as soon as the phone has a connection again. We store on our server:

• Vehicles: identifier, name, number plate, type of use, drive (for example petrol or electric, if you enter it) and whether you archived a vehicle; if you enter them, also the default driver, list price, purchase date and one-way distance to work. Each vehicle has its own logbook.
• Trips: start and end time, start and destination address with coordinates, distance, category (business, private, commute), purpose, business partner, detour note.
• Fuel or electricity note (optional): for a trip you can note how much fuel (in litres) or electricity (in kWh) was used. This is your own entry; we store it with your logbook like the other trip data.
• Driver (optional): the name you give for a vehicle or a trip; it appears on the report. If you enter another person’s name, please let them know.
• Receipts (optional): receipt date, type, amount, quantity and note that you enter or confirm after a photo. We do not store the photo itself.
• Corrections, voided trips and split trips with the reason and, for a split, the place of the stop that you enter.
• Odometer readings that you enter, or confirm after a photo, in the odometer check.
• Integrity and sync data: when an entry reached our server, how far the phone’s clock differed from the server’s clock, and notes such as “time adjusted” or “synced late”. These make your logbook traceable and support syncing between your phones.

The logbook is append-only: entries are added, never changed, and all entries are linked with checksums. This also applies to the database on the phone. The time of an entry is first recorded by your phone’s clock; when syncing, our server also notes when the entry reached it.

3.5 Data on your phone

On your phone there are:

• your logbook with vehicles, trips, corrections and odometer readings (there is also a copy in your account on our server),
• the GPS points of the trip in progress,
• your home and work addresses,
• your tax advisor’s email address,
• app settings.

This data is removed when you delete the app from your phone. Your logbook in your account remains (section 8). For backups made by your operating system, see section 3.9.

3.6 Exports you share

The app creates monthly reports as PDF or CSV on the phone. In the CSV file, a fuel or electricity note, if you entered one, appears in the “Verbrauch” column. You decide who receives a report through your phone’s share sheet, for example your tax advisor. We do not receive that message. The recipient is responsible for the data they receive.

3.7 Server logs (website and app)

When your browser opens this website, our hosting provider Microsoft processes the request including your IP address and the time. We keep and evaluate no access logs of the website ourselves. Requests from the app to our server are logged. We use these logs to run the service securely, find errors and prevent abuse, for example by limiting sign-in attempts. Logs of our own server are deleted after 30 days at the latest. To limit sign-in attempts we also count requests per email address and per IP address. Both are held only as an encrypted check value, not in plain text, and a count lapses 24 hours after it begins at the latest and is deleted after that.

3.8 Fill in from photo (optional)

The app can read a photo of the vehicle registration certificate or the car, of the odometer, of the trip computer or of a receipt to suggest values. When you use this feature (for example “Fill in from photo” or “Photograph the odometer”) and take or choose a photo, the app sends exactly that one photo to our server. The server has it read by OpenAI, solely to recognise make, model, number plate and drive (from the vehicle registration certificate or the car), the odometer reading (from the dashboard) values from the trip computer, or the date, amount, quantity and issuer of a receipt. The app shows you the values it found; only what you check and accept is saved.

The photo is neither stored nor logged on our server, and it is not used to train AI models. OpenAI processes it as our processor, also outside the EU, in particular in the United States. To prevent abuse, OpenAI may keep requests for up to 30 days and review them. A vehicle registration certificate can show your name and address; if you would rather not send that, type the values in. We only store how many photos your account had read on a day (at most 20 per day). The app uses the camera and photo library only at the moment you use this feature; you can always type the values in instead.

3.9 Operating-system backups and changing phones

Your phone may include an app’s data in a backup that you set up yourself: on iPhone in the iCloud backup or a backup on a computer, on Android in the automatic backup (Auto Backup) of your Google Account. Fahrtenbuch’s database may be part of it and can be restored on a new phone. These backups are held by Apple or Google under their terms; we have no access to them and do not receive them. You control whether and how your phone backs up in the phone’s settings.

On a new phone you get your logbook by signing in to your account. Entries that the old phone could not sync yet are, until then, only on that phone. Please also export important reports as PDF or CSV and keep them.

3.10 Trip reminder (optional)

The trip reminder asks “Start trip?” when the phone notices a car journey. It is marked as beta and stays off until you turn it on in the settings. Only then does the app ask for the permission it needs, after explaining what for. You can turn the reminder off again at any time. It does not need or ask for “Always” location access.

• On Android, with the “Physical activity” permission, the app uses the activity recognition of Google Play services on your phone. The app only learns that you got into or out of a vehicle, and then shows a notification. What Google processes for this is governed by Google’s terms.
• Car by Bluetooth (Android only, optional): with the “Nearby devices” permission, the app reads the list of devices paired with your phone so that you can choose your car, and notices when that device connects. It stores the chosen device’s name and Bluetooth address on the phone.
• On iPhone, with the “Motion & Fitness” permission, the app asks the operating system when it is opened whether the iPhone noticed a car journey in the last few minutes. The answer is not stored.

The app does not send any of this to us, and it is not part of your logbook. On the phone the app also keeps whether the reminder is on, when it last reminded you and whether a trip is running. The reminder records nothing: a trip only begins when you tap the notification or run a Shortcuts action you set up yourself. Deleting your account in the app turns the reminder off and removes your chosen car.

3.11 Support access and action log

For support and operation, individually authorised staff of Codeo Solutions Limited can open an admin area after signing in. There they can see for an account:

• the internal identifier and the email address,
• the sign-in method (Apple, Google or email code),
• when the account was created and last used,
• the number of vehicles, trips and active sessions, and the number of photos read today.

They also see totals for the whole service, such as new accounts and entries per day. This area never shows the contents of a logbook: no addresses, coordinates, purposes, business partners, number plates or receipts, and no individual trips.

In the admin area, staff can end all sessions of an account, reset the day’s photo count and delete an account; to delete it they have to type its email address again.

This is recorded in an action log: every action on an account, including a refused or failed deletion, opening and searching for an account, and opening the account list. An entry holds the email address of the person acting, the type of action, the time and, where a particular account is concerned, its internal identifier. The email address of the account concerned and the search text are not in it. If an account is deleted, these entries remain with the identifier. We delete entries older than 24 months when a new entry is written.

3.12 Advertising (Google AdMob)

From version 1.1.0, the app can show ads from Google AdMob: a full-screen ad after you have ended a trip yourself and the trip is saved, and a banner on the "Trips" and "Reports" pages. No ad appears during a running trip or in forms, and a banner does not appear on the home page. We decide on our server which of these ads are switched on and how often the full-screen ad may appear. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google is an independent controller for this processing; Google's privacy policy applies.

What Google receives: your phone's advertising ID (on iPhone only if you allow tracking), your IP address and an approximate location derived from it, device type, operating system, language and app version, and which ads were shown and tapped.

What Google does not receive for this: your trips, addresses, GPS points, trip purposes, business partners, number plates, receipts, your email address or your account ID.

Consent: before the first ad, the app asks for your consent in a dialog from Google where that is required, and on iPhone then with Apple's tracking question. No ad is requested before that. If you refuse, you see non-personalised ads or no ads; the app works the same either way.

Withdrawing consent: you can change or withdraw your consent at any time, with effect for the future: in the app under Settings → Ads → "Privacy choices for ads", on iPhone also under Settings → Privacy & Security → Tracking, on Android under Settings → Privacy → Ads. After the "Remove ads" purchase the app shows no more ads.

3.13 "Remove ads" purchase (RevenueCat)

Apple or Google handle the one-time "Remove ads" purchase; we never see payment details. To check the purchase we use RevenueCat, Inc. (USA) as a processor.

What RevenueCat receives: a random ID the app creates for this, the store's purchase data (product, transaction number, time, price and currency), operating system, app version, country and your IP address. RevenueCat receives neither your email address nor your name nor your account ID, and nothing from your logbook.

On the phone, the app remembers only whether the purchase exists, so that ads stay away without internet too. This is not part of your logbook: it is not in its entries, exports or sync.

3.14 Anonymous counters

From version 1.1.0 the app reports each of these steps once: installed, setup finished, location or notifications allowed or refused, sample viewed, first and second trip. All we do is raise a counter per day, step, operating system and app version. These are anonymous counters: no user, install or device id, no cookie, and your IP address is not stored for this or written to our server logs. Only the phone remembers which steps it has reported. The reports also work without signing in and have no link to your account or logbook.

4. What we do not do

Fahrtenbuch contains no third-party analytics and no third-party crash-reporting software; for Google ads, section 3.12 applies. We ourselves do not sell data, build profiles or make automated decisions within the meaning of Article 22 GDPR. This website sets no cookies, loads no fonts or scripts from other servers and contains no tracking pixels.

5. On what legal basis do you process my data?

Tax record-keeping duties, such as § 147 of the German Fiscal Code (Abgabenordnung), apply to you as the taxpayer, not to us. We keep your data until you delete your account; afterwards we cannot restore your logbook. Please export your reports and keep them, above all before deleting your account.

6. Who receives my data?

The recipients and services involved are:

• Microsoft runs the website for us as a processor (Azure Static Web Apps), the servers (Microsoft Azure, region North Europe, Ireland) and sends the sign-in emails (Azure Communication Services, EU data location), under Microsoft’s Data Protection Addendum.
• OpenAI reads photos for us as a processor (section 3.8), under OpenAI’s Data Processing Addendum.
• Apple, if you use Sign in with Apple, and for address lookup on iPhone. For the sign-in, Apple is an independent controller (section 3.1).
• Google, if you use Sign in with Google, and for address lookup on Android phones. For the sign-in, Google is an independent controller (section 3.1). If you turn the trip reminder on, its activity recognition runs through Google Play services on your phone (section 3.10).
• Google Ireland Limited for advertising in the app, as an independent controller and only after your consent (section 3.12).
• RevenueCat, Inc. checks the "Remove ads" purchase as a processor (section 3.13).

If you have set up a backup of your phone, it is held by Apple or Google (section 3.9). Beyond this we only pass on data where the law requires us to.

7. Is my data processed outside the EU?

Your account and your logbook are stored in the EU (Microsoft Azure, region North Europe, Ireland). Codeo Solutions Limited is based in the United Kingdom and accesses the systems from there where needed for operation and support. The European Commission has decided that the United Kingdom ensures an adequate level of data protection (adequacy decision). Microsoft delivers this website over its worldwide network, so a request from your browser may also be processed outside the EU, under Microsoft’s Data Protection Addendum and the standard contractual clauses it contains. Photos you have read go to OpenAI and may be processed in the United States (section 3.8). For processing by Apple and Google during address lookup, see section 3.3; for the sign-in, section 3.1.

Google and RevenueCat may process data in the United States. The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework where the company is certified under it, otherwise the Commission's standard contractual clauses.

8. How long do you keep my data?

We keep no logs of the website ourselves (section 3.7). For the other data, these periods apply:

• Account, vehicles and logbook: until you delete your account. This includes your email address, the identifier from Apple or Google, your trips including optional fuel or electricity notes, and the integrity and sync data. Deleting the account in the app removes this data from the server immediately and ends all sessions; if you signed in with Apple, we also revoke the link to your Apple Account. The data disappears from our backups within 7 days.
• Sign-in codes: valid for 10 minutes, useless afterwards.
• Sessions: at most 30 days without renewal; ended immediately when you sign out or delete your account.
• Server logs: at most 30 days.
• Admin area action log: 24 months; we delete older entries when a new entry is written (section 3.11). Deleting your account does not change this; an entry then holds only the account’s identifier, not its email address.
• Photos for filling in: not stored. A day’s photo count is deleted with the first photo on a later day. So that a new account does not get around the daily limit, we also count per inbox, held only as an encrypted check value. That count stays after an account is deleted until that moment.
• Data on the phone: until you delete the app or delete your account in the app (operating-system backups aside, section 3.9).
• Advertising and purchase: Google decides how long it keeps data from advertising (see its privacy policy). The purchase data at RevenueCat stays as long as the purchase exists and legal retention duties run.
• Anonymous counters: 13 months; the daily rows are then deleted.

How to delete your account is explained on the Delete account page.

9. What are my rights?

Under the GDPR you have the right to

• access your data (Art. 15),
• have incorrect data rectified (Art. 16) – in the logbook this is done as a correction with a reason, so the history stays traceable,
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20) – you can export your logbook as CSV or PDF yourself at any time,
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21),
• withdraw consent with effect for the future (Art. 7(3)), for example by removing location access in your phone’s settings or changing your ad consent in the app (section 3.12).

To do so, write to info@codeo.com.tr.

We do not hold data that is only on your phone and not in your account, such as the GPS points of a trip in progress or your home and work addresses. For that data we cannot give access or correct or delete anything. You control it yourself: you export reports in the app, and you delete the data on the phone by deleting the app.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority for our seat is the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, ico.org.uk. If you live in Germany, you can also contact the data protection authority (Datenschutz-Aufsichtsbehörde) of your federal state.

10. Do I have to provide data?

You need an account to use Fahrtenbuch. Without an email address or a sign-in with Apple or Google you cannot create an account or use the app. Without location access the app cannot record trips. There is no legal obligation to give us data.

11. Children

Fahrtenbuch is not directed at children under 16.

12. Security

Your data is in the app’s database on your phone and in your account on the server. Protect the phone with a screen lock and keep the operating system up to date. The connection between app and server is encrypted (HTTPS). We store sign-in codes and session keys only as hashes. On the phone, session keys are kept in the operating system’s protected storage. Only you, as the owner of a vehicle, can read or add to its logbook. The admin area for support shows no logbook contents, and access to it is logged (section 3.11).

13. Changes to this policy

When the app or the law changes, we update this privacy policy. The date at the top shows the current version. We announce significant changes in the app.