Privacy Policy

Last updated 12 October 2026

In short: we keep only what the service needs to work — your e-mail, your password (stored hashed, never in plain text), the adapters and history tied to your account, and basic security logs. We do not sell your data, and we show no advertising.

1. Who this applies to

This policy describes how the AiR-DiaG service handles personal data of people who create an account and use it.

2. What we collect

E-mail address — to create your account, sign you in, and send the one-time confirmation code.
Password — stored only as a salted scrypt hash; we never store or see it in plain text.
Device IDs you register, and the diagnostic data you create (scans, fault codes read, live-data snapshots, history).
Community texts you submit (fault-code descriptions) — these are shown to other users.
AI analyses you request — the fault codes, make, model and year, the symptoms you typed, the model's answer and your feedback on it (helped / the actual cause). Kept to apply the daily limits, to reuse the answer for the same scan, and, after review, to improve later analyses.
Technical logs — IP address, timestamps, sign-in attempts, and pass-thru / on-site-approval events, kept to run and secure the service (for example, to stop password guessing and to record who authorised a protected operation).

3. E-mail confirmation

When you register we send a one-time code to your e-mail so you can confirm it is yours. Disposable or temporary e-mail providers are blocked, so that an account can be tied to a real address. We use your e-mail to run the service, not for marketing.

4. How we use your data

We use it only to provide and secure the service: to create and authenticate your account, link your adapters, show your own history, prevent abuse, and keep a record of protected operations. We do not use it for advertising or profiling.

5. Sharing

We do not sell your personal data and do not share it with third parties for their own purposes. We may share data only where needed to operate the service (for example, the e-mail provider that delivers your confirmation code) or where required by law. Content you contribute to the community (fault-code texts) is visible to other users of the service.

AI analysis. When you press "Analyse with AI", the scan result is sent to an AI model: make, model and year, the modules found, their fault codes with our descriptions, and the symptoms you typed. The VIN, your e-mail and account data are not sent. Depending on the setting, the model runs on our own server or at a cloud AI provider (Anthropic, Claude API), which processes the request under its data-processing terms. Do not type personal data into the symptoms field. If you send feedback on an analysis (helped / the actual cause), it may be used, after review by the administrator, to improve later analyses of similar codes, without any link to your account being shown.

Other languages. When you choose a language other than English, fault descriptions, fault types and the wording of AI reports are translated by the same AI model and kept on our server for everyone who reads that language. Only these texts are sent - no VIN, no account data, not the symptoms you typed.

6. Cookies

We use a single session cookie (HttpOnly) to keep you signed in. We do not use advertising or third-party tracking cookies.

7. Storage and security

Data is stored on our server with access controls and file permissions, passwords are hashed, and the connection uses HTTPS. No system is perfectly secure, but we take reasonable measures to protect your data.

8. Retention and your rights

We keep your data while your account exists. You can ask us to show, correct or delete your personal data, and to close your account; where the GDPR applies, you have these rights by law. Some security logs may be kept for a limited time after deletion where needed to protect the service or to meet a legal obligation.

9. Contact

For any privacy request, contact the AiR-DiaG operator. See also our Terms of Service.