Privacy Policy
Summary
Pothole Reporter uses a project service for shared vision, tender resolution, nearby deduplication, a general pothole map, and aggregate impact counts. It has no advertising network or app account system.
Notifications: if you allow them, the app reminds you of potholes you found and have not yet sent, and shows messages from the project. The reminder is scheduled on your phone. For messages, the app asks the project service about once an hour whether there is anything new; that request carries no installation ID or other identifier, and every phone receives the same answer.
In both vision modes, an accepted pothole's exact coordinates and small metadata, including an image hash and pseudonymous installation ID, go to the project service. If that upload fails, the exact accepted-metadata request is queued on the device and retried when the app starts or reconnects until you delete the local report. Shared mode routes selected images through that service to its configured detector (OpenAI by default, or an in-house YOLO gateway) without project-service retention. Personal mode sends your key and images directly to OpenAI; your key never goes to the project service.
Scope and controller
This policy applies to the Pothole Reporter Android app and its project pages. “The project” below means the Pothole Reporter open-source project identified by that name in its store listing and source repository.
The project service receives the limited central records described below. Full local reports, complaint drafts, evidence photos, drive tracks, and saved video remain on your device unless you choose to email, share, or export them. The service publishes canonical detected road-damage coordinates, public pothole numbers, and grouped report counts on the general map. It does not publish reporter names, contact details, photos, installation IDs, or request IDs. A public report count records accepted app reports; it does not prove that a user pressed Send in their email app.
Data the app handles
| Data | What happens | Purpose |
|---|---|---|
| Road photos and video frames | A manual photo, or one still selected from Drive Mode, saved drive video, or an imported road video, is resized for each vision request. In shared mode that image passes through the project service to its configured detector and is not retained by the project service. The default detector is OpenAI; an operator may instead configure an in-house YOLO gateway for detection. In personal mode the image goes directly from the app to OpenAI. Images are not blurred first and may contain faces, number plates, people, vehicles, or shopfronts. The complete video and its audio are not uploaded. | Assess visible road damage and create an editable local report. |
| Imported videos and optional GPS sidecars | Videos chosen in the app remain at their original location and are sampled locally. Android retains read access to selected media while it is needed. A video shared in from another app may be copied temporarily to bounded app-private cache because the sender's grant can expire. An optional timestamped GPX file is parsed locally to associate sample times with coordinates; the GPX file itself is not uploaded. Without a matching track or explicit current-location choice, imported frames have no location. | Accept recorded road footage without uploading the complete recording or inventing where it was captured. |
| Precise location and drive motion data | The app reads latitude and longitude and may retain a local drive track with accuracy, speed, heading, and timestamps. For each accepted detection it sends exact coordinates, observation time, accuracy, heading, and speed to the project service. The canonical detected road-damage coordinates are displayed on the general map. Coordinates can also go to OpenStreetMap Nominatim and Karnataka GIS endpoints; viewing the map requests OpenStreetMap tiles. | Resolve a tender and jurisdiction, map detected road damage, deduplicate nearby observations, and choose the correct email recipient. |
| OpenAI API key | A key is optional. If you choose personal mode, it is stored in the app's local WebView storage and sent directly to OpenAI in the authorization header. It is never built into the app or sent to the project service. Shared mode does not need your key. | Let you choose between project-funded shared vision, when credits are available, and usage billed to your own OpenAI account. |
| Road address, jurisdiction, and procurement match | After a vision verdict accepts road damage, exact coordinates and optional address or local-government hints are sent to the project service for tender resolution in both vision modes. Rejected photos do not use the project tender endpoint. Undamaged photos do not use it either. The service may use published geospatial and procurement sources and OpenAI to adjudicate a probable match. Footpath-, drain-, utility-, and other non-road-only works are excluded even when their street or ward matches. | Offer an optional, reviewable contract reference. A match is not proof of responsibility or warranty. |
| Pseudonymous service identity and request metrics | The app creates a P-256 signing key on the device and registers its public key. The private key does not leave the device. The service assigns an installation ID, records request IDs, route, outcome, vision mode, and timestamps, and computes aggregate active-installation and request counts. In personal mode, every vision attempt also sends a small signed activity event containing only the provider and manual-or-drive mode; it contains no image, coordinates, verdict, or API key. | Reject forged writes, make retries idempotent, diagnose requests, and count aggregate usage and impact without an app account. |
| Accepted pothole metadata | The project service stores an observation ID, exact coordinates, time and motion metadata, damage type, size, a one-way image hash, detector provenance, jurisdiction hints, deduplication result, and sighting count. It does not receive the complaint text or your name. | Count distinct road-damage locations and observers, merge nearby reports, and display the general map. |
| Tester feedback | Only when you press Send on the feedback screen, the app sends your star rating, your text (at most 2,000 characters), how you are testing (bike, car, on foot, or other), the app version, the phone model and Android version, and an optional email, signed with the installation ID. The project service stores these with the installation ID, a request ID, and the time. A message that cannot be sent is kept on the device and retried when the app connects. Nothing is sent automatically, and no photo, location, report, or API key is included. | Understand what testers hit on real phones and fix it. The optional email is used only to reply to that message. |
| Name, settings, reports, labels, photos, footage, and drive summaries | These are stored on the device. A failed accepted-pothole metadata request, without a photo, name, complaint text, or API key, is also kept in a local retry queue. Your name is placed in the complaint signature. Settings include language, model, image detail, recording, frame-saving, and debug choices. | Run the app, preserve history, allow review, and prepare complaint drafts. |
| Official handoff text and evidence | The offered app or portal opens only after you choose it. A Google Play fallback receives no report attachment. A WhatsApp action places complaint text in a link but does not press Send. Share creates compressed image copies and report text in app cache and invokes Android's share sheet. Call opens the dialler. Email hands an editable draft and attachment to your email app. | Let you review and complete a complaint yourself in an external official channel. Opening any channel is not treated as a submission. |
| Email draft and attachment | When you choose Email, the recipient, subject, complaint body, and road photo are handed to your email app. A probable tender number is added only when a match was found. Email is the app's only complaint-filing option; neither the app nor project service submits a complaint to a government API. The email provider may sync a draft under its own terms. Pothole Reporter does not press Send. | Let you review, edit, and choose whether to send a complaint. |
| Saved or exported evaluation files | If you enable frame saving, analysed frames and a model-verdict manifest are written to the device's Documents area. If you export labelled data, a ZIP is handed to Android's share sheet and goes only to the destination you choose. | Let you inspect model output and build a human-labelled evaluation set. |
External recipients
- Pothole Reporter project service: the pseudonymous installation public key and ID, signed-request metadata and request IDs, accepted pothole metadata and exact coordinates, tender-resolution inputs, deduplication outcomes, and any tester feedback you send. Shared-mode selected images pass through this service to its configured detector without being retained by the project service.
- OpenAI: selected images and prompts when you use personal mode, and shared detection images when the project service is configured to use OpenAI. OpenAI also receives tender-adjudication inputs from the project service and, in personal mode, your API credential directly from the app. Vision requests use non-retaining API settings, but that does not override OpenAI's security, abuse-monitoring, or legal obligations. See OpenAI's privacy policy.
- OpenStreetMap services: coordinates sent to Nominatim for reverse geocoding and map-area requests sent to the tile service. See the OpenStreetMap Foundation privacy policy and Nominatim policy.
- Karnataka GIS/KSRSAC: coordinates sent to government map endpoints to check municipal, gram-panchayat, and national-highway layers.
- Your email and sharing providers: data is transferred only when you open a complaint draft or use Android's share sheet. Their own policies and retention rules apply.
Like other internet services, these recipients can receive an IP address and standard connection metadata. They may process data outside your state or country, including outside India. The project does not control their independent retention or legal obligations.
Permissions
- Camera captures a manual road photo or Drive Mode road frames. On Android, a visible foreground-service notification allows a drive you started to continue while another app is shown.
- Precise or approximate location locates and routes a report and records observations while Drive Mode is active.
- Internet reaches the external services described above.
The app does not request Android background-location permission. Browser Drive Mode stops when the page leaves the foreground; native Android Drive Mode can continue through its visible foreground service until you stop it. Mount the phone before moving and do not interact with it while driving.
Retention and deletion
- Drive recording is off by default. If you enable it, clips are written to app-private storage on the device.
- Picked imported videos are read from their existing location. Temporary copies created for Android Share imports are removed when analysis consumes or discards them and are automatically pruned after 24 hours. One shared clip is capped at 512 MiB, all pending shared clips at 768 MiB, and at least 256 MiB of device free space is reserved.
- Reports, report photos, drive summaries, and recorded footage remain in app-private storage until the app deletes them automatically or you delete them.
- A failed project-service upload for an accepted pothole stays in the device's retry queue and is attempted again when the app starts or connectivity returns. Deleting that local report, or using Delete all app data, also deletes its pending retry. Deletion cannot recall an observation that the project service already accepted.
- Tester feedback you sent is kept by the project service until the project deletes it; it has no automatic expiry. To have it removed, email contact@aiengg.dev with the approximate time you sent it. Feedback still waiting on the device is removed by Delete all app data, and the app tries to send it first.
- A successful tender-resolution response, including its resolved road address, is retained by the project service for idempotent retry for no more than 24 hours. Scheduled pruning removes older tender replay records.
- With Debug mode off, successfully analysed drive footage is deleted after analysis completes without failed frame requests. Debug mode keeps it. You can also delete footage from History.
- Delete all app data clears local reports, photos, drive summaries, app-held footage, the API key, sender name, settings, and the app's
Documents/pothole-framesfolder. - Deleting local app data does not delete previously accepted pothole observations, aggregate request metrics, request IDs, or deduplication records from the project service or remove a coordinate already included in the general map.
- The project service does not persist the selected images relayed for shared vision. The configured detector and other external recipients apply their own security, abuse-monitoring, legal, and operational retention rules; the project must review this policy before enabling a backend with materially different handling.
- Files already exported, shared, attached, copied elsewhere, or sent are outside the app's control and must be deleted from their destination separately.
- Data already processed by OpenAI, OpenStreetMap services, Karnataka GIS, Telangana GIS, GitHub Pages, Google Play, WhatsApp, an email or sharing provider, or an official complaint service is subject to that recipient's retention and deletion process.
The app creates no Pothole Reporter account, so there is no profile to delete. Because the service identity is pseudonymous, the project may not be able to identify a particular installation after local data is erased. Android backup is disabled for the app.
Security and your choices
Internet calls in the current app use HTTPS. A dashcam's local rtsp:// stream is commonly unencrypted, so use the dashcam's own trusted Wi-Fi and a camera password where supported; the app never places that address or password in Drive status or logs. Each downloaded pack has a version, expected byte length, and SHA-256 checksum pinned in a local manifest. The complete download is verified before parsing or caching. If required routing data is unavailable, malformed, or different from the pinned checksum, authority routing stops; failure of optional project/procurement data only omits candidate context. Highway matching also refuses weak GPS, ambiguous parallel references, and conflicting driving direction. State/UT and exact municipal polygon routes never fall back to a place name; enclave territories retain their own pinned boundaries. The specific My Cure route requires a successful official Telangana GIS check and excludes an accuracy envelope intersecting Secunderabad Cantonment. Detection, geocoding, Karnataka GIS, and exact CURE checks still require their own network services.
Local app data is protected by Android's device and application storage controls, but the app does not add separate at-rest encryption to the OpenAI key or dashcam RTSP address and credentials stored in WebView storage. Local RTSP is also normally unencrypted in transit, so use only a trusted dashcam Wi-Fi. Protect your device, use revocable credentials with appropriate limits, and revoke them if the device or a credential may be compromised.
- You can deny camera or location permission, but the corresponding capture or routing feature will not work.
- You can choose shared vision or personal OpenAI-key vision. Central tender resolution and accepted-pothole deduplication, map, and impact records operate in both modes after consent.
- You can choose whether to enable drive recording, Debug retention, or saved analysis frames in Settings.
- You decide whether to edit, share, export, open an official channel, or send any draft or dataset. No complaint is submitted automatically.
- Review every AI verdict, recipient, and probable contract match before acting on it.
Children, changes, and contact
Pothole Reporter is a civic-reporting tool and is not designed for children. It does not create user profiles or knowingly operate a child-directed service.
If this policy or the app's data flows change, this page will be updated and its effective date will change. Material new collection should be disclosed in the app before it begins.
For a private privacy question or request, email contact@aiengg.dev. For a non-sensitive public bug, you may instead open a GitHub issue. Do not put an API key, precise location, unredacted report photo, or other sensitive information in a public issue.