Kilòmetro · Privacy Policy

This page is a translation of the Italian original, made with an artificial-intelligence tool and reviewed by the Developer. In case of differences, the Italian text prevails and is available here: silverik.github.io/kilometro-site/privacy.html. Your rights do not change with the language.

Kilòmetro is an app for Android and iPhone for recording the expenses of one's own car, motorcycle or scooter. It is developed by Daniele Crucitti (hereinafter "the Developer"). This page explains which data the app processes and where they end up. In short: the data remain the User's, on their phone and, if they so choose, in their iCloud or their Google Drive. The Developer does not collect data on their own behalf and does not show advertising. The Developer's only service is the one that reads receipts, described further below: it is used only by those who activate that feature.

Data controller

The data controller is Daniele Crucitti, developer of the app, who can be contacted at puffettodigitale@gmail.com. No data protection officer has been appointed, as the legal conditions for one are not met (Art. 37 of Regulation (EU) 2016/679).

Data the app processes

• Car and expense data entered by the User: car name and number plate, kilometres, dates, amounts, litres, suppliers, notes and reminders.
• Google account (e-mail address and name), only if the User chooses "Sign in with Google": it serves to save the logbook in the User's Drive and to find it again on the User's other phones. On iPhone the User can instead use the iCloud of their own Apple ID: the app does not see who they are, it only uses the app's space in their iCloud.
• Receipt photo, only if the User uses "Read receipt": with Premium Cloud (cloud reading) the photo is sent to the Developer's service to be read and turned into the fields of the expense; with Basic (on-phone reading) it does not leave the device. In both cases it is discarded once read: it does not stay on the phone, it does not go into the User's cloud and the Developer does not keep it (details in the dedicated section).
• Location, only if the User grants it, at two moments: while viewing the price map, to centre it where the User is, and when recording a refuel, to suggest the nearest station among those on the map. In both cases the location is used on the spot and then discarded. To search for fuel stations the app sends to the price service of the country (MIMIT (the Italian Ministry of Enterprises and Made in Italy) for Italy, data.economie.gouv.fr for France, E-Control for Austria) and to the map servers (OpenFreeMap) the area of the map that the User is viewing, together with the phone's network address; when the map is centred on the User, that area corresponds to their area. The location is neither saved nor sent to the Developer. When the User starts navigation, the destination is passed to the chosen maps app.
• Device identifier generated by the app (a random code, not the IMEI or the advertising ID): it serves to reconcile the changes made from different phones.
• Diagnostic log: the app's errors are recorded in a file on the phone. It stays there until the User decides to share it with the Developer using the "Share log" button.

Where the data go

• On the phone, in a private database of the app. It works even without a network connection.
• In the User's Google Drive, if the User signs in with Google: the app creates the Kilòmetro folder and saves the logbook, the backup copies and the exported sheets there. It uses the drive.file permission: it sees and modifies only the files it created itself, not the rest of the User's Drive. The transfer takes place over an encrypted connection (HTTPS) directly between the User's phone and Google.
• In the User's iCloud (iPhone), if the User chooses iCloud in the More tab: the logbook is kept in the app's space in iCloud Drive, encrypted by Apple, and does not pass through the Developer.
• Nowhere else, with a single exception: the receipt photo, if the User uses Premium Cloud (below). The Developer does not use analytics, advertising or crash-reporting services.

Receipt reading

It is a subscription feature, in two variants. With Basic the photo is processed by the artificial-intelligence model built into the device's operating system: it does not leave the device, it does not reach the Developer or third parties and it is discarded as soon as the fields are ready. With Premium Cloud the receipt photo is sent over an encrypted connection to the Developer's reading service, which runs on Google Cloud in the Milan region, and from there to a third-party provider of artificial-intelligence services that turns it into the fields of the expense (date, amount, supplier, litres, price per litre). The Developer's service does not save the photo and does not write it to the logs. The artificial-intelligence provider (category of recipients: providers of artificial-intelligence services for reading text from images, based in the United States) processes it as a processor on behalf of the Developer, under its own terms: it may keep it for up to 30 days for security reasons (longer only in the event of abuse reports) and does not use it to train its own models; the Developer chooses only providers that guarantee these conditions. The transfer to the United States takes place on the basis of the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), included in the data processing agreement with the provider; the User may request a copy of them, and learn the name of the provider in use, by writing to the address at the bottom of this page. The receipt or invoice may contain personal data of the User or of third parties (for example name, tax code, number plate, address): they are read only to fill in the expense and are not kept; for third parties' data the legal basis is the legitimate interest of the Developer and of the User in recording the expense (Art. 6(1)(f)) and this page serves as the information notice under Art. 14(5)(b). Together with the photo the service receives the Apple or Google subscription receipt, which serves only to verify that the subscription is active and to count the readings (a maximum of 5 during the trial, then 15 per day). No other logbook data leave the phone. If the User does not activate the feature, none of this happens. For this reason the User must photograph only receipts: not identity documents, payment cards, people or other personal data.

If the User chooses a document (for example a receipt in PDF) instead of a photo, the App creates the image of its first page on the device and handles it like the photo described above: the document does not leave the device and the App keeps no copy of it.

Recipients and authorities

In addition to the providers indicated on this page, technical logs may be disclosed to judicial or police authorities only upon formal request and within the limits of the law (Art. 6(1)(c)). No data are sold or transferred to third parties for their own purposes.

Sharing

The logbook remains the User's: the app does not share it with anyone. Anyone who uses the same Google or Apple account on several phones sees and edits the same logbook, in real time; each entry bears the name of the account that created it. Revoking sharing or changing the password prevents future synchronisations but does not delete the copies already downloaded to other phones. Anyone who wants to pass it on to someone exports an Excel file and sends it personally. Anyone with write access sees the entries and the name of whoever added them. The User can revoke sharing at any time from Google Drive.

Use of Google data

The use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs are used exclusively to save and synchronise the User's logbook in the User's Drive.

Retention and deletion

Step-by-step instructions are on the Deleting data page. Retention periods:

• Logbook data on the device and in the User's cloud: until the User deletes them; the Developer has no copy of them.
• Receipt photograph: for the duration of the reading (seconds); it is not kept by the Developer.
• Reading counters of the service: for the duration of the subscription and up to 90 days after its expiry.
• Technical access logs of the service: 30 days.
• Diagnostic log and support e-mails sent by the User: for the time needed to resolve the problem, at most 12 months.

• Data on the phone are deleted by uninstalling the app or from Settings → Apps → Kilòmetro → Clear data.
• Data on Drive are deleted by deleting the Kilòmetro folder from the User's Google Drive; the app does not keep copies of them elsewhere.
• The User can disconnect the Google account from the app's More tab; they can revoke the app's permission from the security settings of the User's Google account.

Purposes and legal bases

• Operation of the app and of the logbook (vehicle and expense data, reminders): performance of the contract with the User (Art. 6(1)(b)). The data remain on the device and in the User's cloud space.
• Synchronisation on Google Drive or iCloud (account e-mail and name for Google Drive): performance of the contract, at the User's choice.
• Receipt reading (photograph, subscription receipt): performance of the subscription contract (point (b)).
• Price map and station suggested in the refuel form (location): the User's consent via the system permission (point (a)), revocable from the phone's settings.
• Technical support (diagnostic log sent by the User, e-mail): performance of the contract and the Developer's legitimate interest in resolving the reported problems (points (b) and (f)).
• Security and operation of the reading service (access logs, counters): the Developer's legitimate interest in preventing abuse and ensuring the service (point (f)).

The Developer does not use the data for advertising, profiling or automated decisions that produce legal effects on the User.

Technical logs

The Developer does not carry out any real-time monitoring of the use of the app and does not collect logs of the User's activities. Only the following technical logs exist.

• App diagnostic log: it is kept exclusively on the device and contains only technical information (app and operating system version, device model, date and time, error messages with the area of the app concerned). It does not contain the recorded expenses, the receipt photograph or the User's identity. The Developer receives it only if the User decides to send it with the "Send log by e-mail" feature, for the sole purpose of technical support; in that case the Developer processes the message and the sender's e-mail address for the time needed to resolve the problem and in any case for no longer than 12 months.
• Receipt reading service: it does not keep the photograph or the data read. It keeps only the reading counters, associated with a pseudonymous identifier derived from the subscription receipt (not with the User's name or e-mail address), and, in the event of an error, a technical message without the photograph or the data read. The platform hosting the service (Google Cloud, Milan region) generates the technical access logs typical of any internet service (date and time, outcome of the request, network address of the device), kept for 30 days solely for security and operational purposes, on the basis of the Developer's legitimate interest (Art. 6(1)(f) of Regulation (EU) 2016/679).

App permissions

• Internet: to communicate with Google Drive or iCloud, to download fuel prices from public services and, if the User uses Premium Cloud, to send the photo to the Developer's service.
• Notifications: for reminders about vehicle tax, roadworthiness inspection, insurance and servicing. Optional.
• Camera and gallery: only for receipt reading, when the User starts it; the photo is used for the duration of the reading and is then discarded.

Security

Communications between the app, the reading service and the providers take place over an encrypted connection (HTTPS/TLS). The reading service does not keep the photographs and accepts only requests accompanied by the app's key and by a valid subscription receipt. Access to the platform that hosts the service is reserved for the Developer. No system is absolutely secure: in the event of a personal data breach that presents a risk to the User's rights, the Developer notifies it to the Garante (the Italian Data Protection Authority) within 72 hours and, in the cases provided for, communicates it to the User (Arts. 33 and 34 of Regulation (EU) 2016/679).

User's rights

The User may at any time exercise the rights of access, rectification, erasure, restriction, portability and objection (Arts. 15-22 of Regulation (EU) 2016/679) and withdraw consent to location from the phone's settings, by writing to puffettodigitale@gmail.com; the Developer replies within 30 days. The reading service does not know the User's name: to exercise the rights over the reading counters the User must provide the Store's order or transaction identifier, because without it the Developer cannot link any data to the User (Art. 11). For data that are only on the User's device or in the User's cloud, the rights are exercised directly in the app or in the User's own Google or Apple account, because the Developer has no access to them. The User may also lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it) or with the authority of their own country.

Website

The website silverik.github.io/kilometro-site does not use cookies or analytics tools; the service that hosts it (GitHub Pages) records visitors' network addresses for security reasons, under its own policies.

Data of deceased persons

The Developer has no copy of the logbook. Family members may contact Google (inactive account management) or Apple (legacy contact), under Art. 2-terdecies of the Codice in materia di protezione dei dati personali (Italian Personal Data Protection Code).

Minors

The app may be used by anyone who is 14 years of age or older; the subscription to the reading service is reserved for adults or for the Store's parental controls. The Developer does not knowingly collect data of children under 14.

Changes

If this policy changes, the Developer updates this page and the date at the top, and the app notifies the User.

Terms of Use

The rules of the app and of the subscription to receipt reading (price, trial, renewal, cancellation, refunds, liability) are in the Terms of Use.

Contacts

For questions about privacy and to exercise the rights provided for in Articles 15-22 of Regulation (EU) 2016/679 (access, rectification, erasure, restriction, portability, objection) the User may write to puffettodigitale@gmail.com.