In plain words. Cellgrade has no account, no advertising, no analytics and no tracking. What it reads from your car stays on your phone, with three exceptions, each of which you start yourself: when you buy a battery report, the app sends the report's grades and figures to our signing service (without the car's identification number); when you choose to send a scan of your car, we keep that scan until you take it back; and the app downloads the list of supported cars, which sends nothing about you. If a scan earns a reward, the app also collects the reward code for you. The first eleven characters of your car's identification number are in any scan you send. The full number is only included if you switch that on.
1. What the app stores on your phone
The app keeps, on your device: readings from your vehicle, the history of those readings, grades, insights, alerts, the certificates you have bought and their signatures, the receipts for scans you sent, a log of the conversation with your adapter, your settings, and your purchase entitlements. You can delete readings and history in the app. Deleting the app deletes everything it stored.
Your phone's own backup. Some of this is included in your phone's backup, which is yours and which we never see: Apple's iCloud or computer backup on iPhone, and your Google account's backup or a transfer to a new phone on Android. On both, the app's backup holds your certificate credits and the store's proofs of those purchases, the certificates you have bought, each car's reading history, the receipts for scans you sent, any reward code you have not yet redeemed, your reminders and your settings. On iPhone only, the backup also holds any scan still waiting to be sent (which contains the full identification number if you switched that on for it) and the signatures of the certificates you have bought. On Android those two files are left out. The log of the conversation with your adapter, and the logged drives, charges and parks the app uses for grades, are never included on either. Cellgrade Pro is never restored from a backup; it comes back from the App Store or Google Play. Apple and Google hold backups under their own privacy terms, and a backup is not deleted when you delete the app.
2. What leaves your phone, and when
Our server is a small service we run on Cloudflare (sections 2.2, 2.4, 2.5 and 2.6). Apart from the app stores (section 2.1), it is the only place the app sends anything. Nothing is sent while the app is closed. While it is open, three things can happen without a tap: a scan you already chose to send that could not go at the time is sent again (2.4), an owed reward code is collected (2.5), and the list of supported cars is refreshed (2.6).
2.1 The app stores. When the app opens, it asks Apple's App Store or Google Play which products are for sale, at what price, and whether you already own Cellgrade Pro. Purchases are made through the store under the store's own privacy terms. We do not receive your name, email address or payment details from the store.
2.2 Signing a battery report ("certificate"). When you buy a certificate, the app sends our signing service:
- a cryptographic digest (a one-way fingerprint) of the report;
- the grades on the report, and its measurement and analysis lines as label-and-value pairs (for example "Lowest cell, 3.61 V");
- when the measurement was taken, the ambient temperature on the report, the app version, and how many of the test's steps were completed;
- the store's proof of purchase: which product you bought and the store's own evidence of the transaction (on iPhone, Apple's signed transaction; on Android, the Google Play purchase token, which our service checks with Google).
It does not send the vehicle identification number, the car's make or model, the odometer reading, the adapter, or anything that identifies you or your phone.
A report made from the app's simulated adapter can also be bought and signed, but only after you confirm it. Whether the reading was simulated is written inside the report itself, so it is covered by the digest and the signature. It is not sent to us as a separate field. The signed report says "DEMONSTRATION READING — not a vehicle record" on the document, the PDF and the verification page, and it contains no data from your car or any other real vehicle, only the simulated adapter's example readings.
The service uses the figures only to refuse to sign a report that is impossible (for example a battery at 400% health), and does not store them. It does store, for five years, the store's transaction identifier (on Google Play, the order number, or a one-way hash of the purchase token if there is no order number), the digests of the reports signed with that purchase and the signatures issued. That record stops one purchase being used for more reports than were paid for, and lets a report that lost its signature be signed again with the same date.
2.3 Sharing a report. A certificate's QR code and PDF contain the whole report, including the vehicle identification number if you chose to include it. Sharing them is your choice and is not a transfer to us. Anyone who scans the QR code checks it in their own browser. The verification page sends nothing to us.
2.4 Sending a scan ("Add my car"). If you choose to send a scan, the app first shows you, field by field, exactly what the file contains. The list is generated from the file itself. The file contains:
- Your car: its name, model year and engine as the app identified them, which batteries it has, and its vehicle identification number (VIN). By default the VIN is cut to its first eleven characters (manufacturer, model, body, model year and plant) and the last six are masked everywhere in the file, including in the raw replies and in the log. If you switch on "include the full number", all seventeen characters are sent.
- What you typed, if anything, in three optional boxes: what the car's own displays say about the battery, the mileage as you read it off the dashboard, and what you think Cellgrade got wrong.
- Your adapter: the name it advertises, the identity and firmware string it reports (for example "ELM327 v2.2"), the protocol, whether it is Bluetooth or Wi-Fi, and the voltage it measures at the port.
- The scan: which identifiers the app asked the car's modules for and the raw replies they gave, which of the app's vehicle data maps were tried and what came back, and whether each battery reading passed the app's checks.
- The adapter log: a timestamped record of every command the app sent to the adapter and every reply, for the current session.
- Whether the readings came from a car or from the app's simulated adapter. Scans from the simulated adapter are refused, both by the app and by our server.
The app does not ask the car for its odometer, and the file contains no Bluetooth address, no device name you chose, no phone or install identifier, no advertising identifier, no location and nothing from any other app. The raw module replies are whatever the car's modules answered to the identifiers asked, so they may contain other technical data the car reports about itself.
The request also names which store your phone uses (App Store or Google Play), so that a reward code, if the scan earns one, is for the right store. If the scan cannot be sent at the time, for example because there is no signal, the exact file you reviewed is kept on the phone and sent automatically the next time the app opens or comes back to the screen with a connection. Until then you can delete it without sending it: in Settings, Help, "Scans waiting to send" (shown only while a scan is waiting), or on the last step of Add my car, tap "Discard this scan". It is deleted from your phone and not sent. Deleting the app also deletes it.
What you send is used to build and improve vehicle data maps. It may be published as part of a data map, under an open licence, in a form that does not include your vehicle identification number or anything you typed.
What we keep, and for how long, is in section 5.
"Report a problem" does not use our server. It opens an email to info@froggyeye.com in your own mail app, with the report written into the body and no attachment: what you typed (what went wrong, what the dashboard says, the mileage), the car's name, its identification number with the last six characters removed, the app version, whether the readings came from a real adapter or the simulator, the adapter's name and firmware, the result of the app's checks, the data maps tried, and the last 12 lines of adapter traffic (each cut to 90 characters, identification number removed). You see all of it before you send, and nothing goes anywhere unless you press send. We hold what you email as a support email (section 2.7).
2.5 Collecting a reward code. If a scan you sent earns the Cellgrade Pro reward while we have no code left to give, the reward is recorded as owed. While it is owed, the app asks our server for it when the app opens and each time it comes back to the screen, sending the scan's identifier, the claim token our server gave your phone with the reward, and which store your phone uses. The claim token is derived from the scan's identifier with the same server-only secret key, and our server does not store it; only your phone keeps a copy. It stops once a code arrives or you own Pro.
2.6 The list of supported cars. The app downloads the current list if its copy is more than a day old, when a screen that shows whether your car is supported needs it (Home, the Cellgrade Pro sheet and the list of cars), or when you pull to refresh the list. The request carries nothing about you, your car or your phone. After you send a scan, the app also asks for the entry for that car model. That request names the model, which our server already has from the scan.
2.7 Support email. If you email us, we keep that email to answer it.
2.8 What every request reveals. Like any internet request, each request to our server reaches Cloudflare with your phone's IP address. Cloudflare keeps short-lived request logs for us, with the time, the address requested and the result, for no more than seven days. They do not contain what you sent. Our server keeps IP addresses in memory for a short time to limit how often one address can call it, and does not write them to storage, with one exception described in section 5 (reward codes).
3. What we do not do
We do not use analytics, crash reporting, advertising identifiers, tracking, fingerprinting, or third-party SDKs that collect data. We do not sell data or share it with anyone for their own use. We have no account system, and we do not try to find out who sent a scan.
4. Permissions
- Bluetooth: to talk to the OBD adapter, only while the app is open.
- Location (Android 11 and earlier only): those versions of Android require it before an app can search for Bluetooth devices. Cellgrade never reads your location. It is not requested on Android 12 or later, or on iPhone.
- Local network (iPhone): to reach a Wi-Fi adapter.
- Camera: only when you choose to scan a certificate's QR code. Frames are decoded on the phone and no image is kept or sent.
- Notifications: only if you turn on battery alerts or the 12-month re-test reminder. They are created on the phone.
5. Legal basis and retention
We process the data in section 2 because you ask us to (signing a report you bought, keeping a scan you chose to send), and for our legitimate interests in keeping accurate vehicle data maps, preventing certificate fraud and preventing abuse of the free Pro reward. When you redeem a reward code, Apple or Google handle the redemption under their own privacy terms; we are not told who redeemed it.
- Signing records (section 2.2): kept for five years, then deleted automatically.
- Scans you sent (section 2.4): kept until you withdraw them. Data already included in a published map cannot be recalled.
- Receipts for scans: for each scan we keep a receipt: an identifier for the scan (a one-way hash of its contents), the first eleven characters of the VIN, which car model and data map it was for, when it arrived, whether it was accepted, and whether it earned the free Cellgrade Pro reward. The reward is a one-time App Store offer code or Google Play promo code that you redeem with the store yourself. The app does not unlock anything itself, and the store does not tell us who redeemed a code. We keep a record of which code was allocated to which scan, so that one scan collects one code at most. The receipt of a scan that earned a reward, whether the code has been sent or is still owed, also holds keyed hashes of the IP addresses the reward was sent to, three per scan at most: an HMAC-SHA-256 under a secret key that only our server holds, shortened to 32 characters. Without that key a hash cannot be turned back into an IP address. It is kept only for the rules that let a lost reply be sent again without one code being handed out without limit. No other record of a reward holds anything about your IP address. We still treat these hashes as personal data.
- Withdrawing deletes the scan itself: the readings, the adapter log and anything you typed. We keep the receipt and the code allocation, marked withdrawn. The receipt is the only proof that a withdrawal was authorised when there is no account, it lets us recognise the same scan if it is sent again, and a code you were given is not taken back when you take the data back. We keep receipts for as long as the vehicle data maps are maintained.
- Request logs (section 2.8): no more than seven days.
- Support emails: two years.
Who processes it for us. Cloudflare, Inc. runs our server and stores what it keeps, and may process it outside the UK under the safeguards in its data processing terms. Apple and Google process purchases under their own privacy policies. When our server checks an Android purchase it sends Google the purchase token.
6. Your rights, and how to delete a scan
Under UK GDPR you can ask what we hold about you, ask for it to be corrected or deleted, object to processing, and complain to the Information Commissioner's Office (ico.org.uk).
- To delete a scan: in the app, go to Settings, Your contributions, and tap "Take this scan back" on it. The app sends the scan's receipt to our server, which deletes the scan straight away. If the app cannot reach the server, or you no longer have the phone, email info@froggyeye.com with the scan's reference (shown against each scan in Your contributions). If the app cannot reach the server, it offers to write that email for you. Because we hold no account, the reference is how we find a scan. We cannot search by name or email.
- For anything else, contact info@froggyeye.com.
7. Children
The app is not directed at children under 16.
8. Changes
We may update this policy. The effective date at the top shows the current version, and the app tells you when it changes.