Privacy Policy

Last updated: August 24, 2026  |  Version 2.0

SftyFrst ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

a. Information You Provide

  • Account information: Name, email address, password, and age category when you create an account.
  • Family member linkage: When an account holder invites a family member, we collect the relationship data needed to link accounts.
  • Contact submissions: Name, email, subject, and message content when you contact us through our website or app.

b. Information Collected Automatically

  • Vehicle diagnostic data: OBD2 readings including vehicle speed, engine RPM, fuel level, coolant temperature, and diagnostic trouble codes (DTCs) collected through your paired OBD2 adapter.
  • Location data: GPS coordinates collected during trips to calculate distance and trip duration.
  • Trip records: Per-point GPS coordinates and OBD2 readings (vehicle speed, RPM, fuel level, engine load, coolant temperature) recorded during each trip and stored in Firebase/Firestore on US-based servers.
  • Device information: Device type, operating system, app version, and unique device identifiers used for pairing with the OBD2 adapter.
  • Usage data: How you interact with the Service, including pages visited, features used, and session duration.

c. Information from Third Parties

  • Firebase: We use Google Firebase for authentication, data storage, and analytics. Google's privacy policy is available at policies.google.com/privacy.

2. How We Use Your Information

  • Provide, operate, and maintain the Service.
  • Calculate driving scores and generate safety reports for account holders and family members.
  • Send trip summaries, alerts, and notifications to linked accounts.
  • Generate driving safety summaries (if requested by you).
  • Improve our Service and develop new features.
  • Communicate with you about updates, support, and promotional content (you may opt out at any time).
  • Comply with legal obligations applicable to our Service.

3. Minor Users and Guardian Consent (Ages 14–17)

SftyFrst does not knowingly collect personal information from users under the age of 14. If we become aware that a user under 14 has provided personal information, we will delete it promptly. Users under 14 may not use the Service. This section describes how we handle data for users aged 14–17 who use the Service with guardian consent.

SftyFrst's web portal is restricted to users 18 and older. Household member accounts for users aged 14–17 are available exclusively through the mobile application, which includes a full guardian consent verification flow. This design ensures that no minor creates an account without a guardian's involvement.

  • Age gate: Users under 14 cannot create an account. Web accounts are restricted to users 18 and older. Users aged 14–17 may create accounts through the SftyFrst mobile app only, where verifiable guardian consent is collected before account activation.
  • Guardian consent: A guardian must create their own account and explicitly link their household member's account before any data is collected.
  • Guardian access: Guardians have full access to their household member's data (under 18), including the right to review, modify, or delete it at any time through the family dashboard.
  • Data minimization: We collect only the data necessary for driving safety monitoring. We do not sell minor user data to third parties.
  • No behavioral advertising: We do not serve targeted ads to minor users based on their personal information or driving behavior.

Guardians may revoke consent, request deletion of their household member's data, or unlink accounts at any time by contacting us at support@sftyfrst.app.

3b. Adult Family Member Data

Family plan subscribers may invite adult family members (age 18 or older) to link their accounts for household safety monitoring. Adult family members are not subject to COPPA — their data is governed by this Privacy Policy and applicable state privacy laws including the California Consumer Privacy Act (CCPA).

Consent and Monitoring

Adult family members must actively accept an invitation and create their own account before any monitoring begins. Monitoring of an adult family member requires their explicit agreement at account linking. An adult family member may withdraw from monitoring at any time.

Data Removal for Adult Family Members

When an adult family member is removed from a Family plan — whether by the account holder or by the member themselves — the following data is deleted:

  • Trip history associated with the removed member
  • Driving scores and behavior analytics
  • Vehicle associations and OBD2 adapter pairings

The following data is retained in anonymized or aggregate form and is not deleted:

  • Anonymized aggregate statistics that do not identify the individual
  • Backup copies subject to the applicable retention policy

The account holder's own data is not affected by the removal of a family member. To request removal of your data as a family member, contact us at support@sftyfrst.app.

4. Data Security

  • Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.3.
  • Field-level encryption: GPS coordinates and account details (email, display name) are encrypted using AES-256-GCM before storage in our database.
  • Encryption at rest: All remaining trip data, including OBD2 readings, is protected by Firebase's built-in encryption at rest.
  • Key management: Encryption keys are managed per-device. Data is encrypted on your device before being transmitted to our servers.
  • Access controls: Firestore security rules restrict data access to authenticated users only. Minor user data is accessible only to the minor and their linked guardian account.

Data Storage Location

All personal data collected through SftyFrst services is stored on servers located in the United States:

  • Primary storage: Google Cloud us-central1 (Iowa) and us-east1 (South Carolina) via Firestore nam5 multi-region
  • Analytics data: USA only; aggregated data, no individual PII stored separately.

We use Google Analytics 4 (GA4, Measurement ID: G-9HB07TZHWW) to collect anonymized data about website visits including page views, session duration, device type, and approximate geography. GA4 is operated by Google LLC. See Google's privacy policy at policies.google.com/privacy.

  • Payments: Stripe (AWS USA; card details never stored by SftyFrst directly)

No system is completely secure. While we use industry-standard protections, we cannot guarantee absolute security of your data.

In the event of a data breach affecting your personal information, we will notify affected users via email within 72 hours of becoming aware of the breach, as required by applicable law. We will include in our notification: the nature of the breach, the data affected, steps we have taken to address it, and recommended actions you can take to protect yourself. To report a suspected security issue, contact us at support@sftyfrst.app.

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:

  • With your consent: When you explicitly authorize the export of your driving data.
  • Service providers: With trusted third-party services that help us operate the Service (Firebase, hosting providers). These providers are bound by contractual obligations to protect your data.
  • Legal requirements: When required by law, court order, or government request.
  • Safety and enforcement: To protect the rights, property, or safety of SftyFrst, our users, or the public.

6. Data Retention

  • We retain your account data as long as your account is active.
  • Free tier: Last 15 trips (hard cap).
  • Advanced, Family, and Family Plus plans: Last 25 trips in-app. 24 months via web dashboard.
  • Family Elite plan: Unlimited trip history via web dashboard.
  • Trip data is deleted when you delete your account.
  • When you delete your account, we will delete or anonymize your personal data within 30 days, subject to legal retention requirements.

7. Your Data Rights

Under the California Consumer Privacy Act (CCPA), you have the following rights regarding your personal data:

  • Right to Access: Request a copy of all personal data we hold about you.
  • Right to Deletion: Request permanent deletion of your personal data. Some data may be retained as required by law or for fraud prevention. You can submit a deletion request at any time through our account deletion page.
  • Right to Correction: Request correction of inaccurate personal data.
  • Right to Opt-Out: Opt out of any sale or sharing of your personal data. SftyFrst does not sell personal data.

To exercise any of these rights, send an email to support@sftyfrst.app with the subject line “CCPA Request”. We will respond within 45 days.

To withdraw your consent for analytics cookies, clear the sftyfrst_consent key from your browser's localStorage, or contact us and we will reset your consent preference. You may also manage cookies through your browser settings.

8. Children Under 14

SftyFrst does not permit users under the age of 14 to create accounts or use our Service. We do not knowingly collect personal information from users under 14. If we learn we have collected data from a user under 14, we will delete it immediately. If you believe we have inadvertently collected such data, contact us at support@sftyfrst.app.

9. Third-Party Links

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies.

9b. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to improve your experience on our website, analyze usage patterns, and serve relevant content. You can control cookie preferences through your browser settings or by using the cookie consent banner.

For full details on cookies and tracking technologies we use, see our Cookie Policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. For account holders, we may also send an in-app notification or email.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us:

12. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Florida, without regard to its conflict of law provisions. Any disputes arising under this policy shall be subject to the exclusive jurisdiction of the courts located in the State of Florida.