Privacy Policy

1. Who we are

This website and the Signumb software are published by an independent open-source project, not a registered company. There is no company legal name, registry code, VAT number, or registered office. “We” means the project maintainers.

Harshy SDK source: github.com/vkrv/harshy-sdk. Contact: GitHub issues.

For personal data inside a host application that embeds the Harshy SDK, the host (the app publisher) is the controller. We do not operate a Signumb collection API.

2. Scope

This policy covers:

• this website (pages and edge logs);
• the Harshy SDK (on-device GPS/IMU analysis and local session export);
• the Signumb app on Android and iOS.

It does not cover third-party sites we link to (including GitHub), or the map provider Signumb contacts when you open a saved route.

3. Harshy SDK — on-device

The Harshy SDK records location and motion on the phone while a trip is started, derives events and a score, and can write a local session document. Signumb does not require an account, and does not upload trips to a Signumb server.

• Trip files stay on the phone. Signumb does not upload them to a server we operate.
• UploadAdapter lets the host app POST session JSON to a URL the host chooses — that transmission is the host’s processing, not ours.
• Possible-impact and phone-handheld are on-device events. Possible-impact is not crash verification and is not used to notify emergency services.

Location and motion permissions are requested by the host (or Signumb) through the operating system. Capture starts in start() and stops in stop(). Background collection is only while a trip runs, subject to OS rules.

4. Signumb app

Signumb keeps trips and settings on the phone. Opening a route map requests map tiles for that trip from the map provider. The app may send crash reports so failures can be fixed. A crash report is not your trip file.

Downloading a route JSON is a user-initiated export off the device. We do not receive that file.

5. This website

If you only browse, processing is limited to:

• Cloudflare edge logs typical of any Worker (IP address, user agent, URL, timestamp) to operate, secure, and debug the site. We do not use advertising cookies or third-party marketing pixels on this site.

This site does not run a waitlist, account system, or newsletter. We do not sell personal data. We do not profile visitors for advertising.

If you open a GitHub issue or otherwise contact the project on GitHub, GitHub is the controller for that processing under GitHub’s own terms and privacy policy.

6. Cookies

This site is not designed to set tracking cookies. Cloudflare may set strictly necessary cookies or equivalent for security and bot management. You can block cookies in your browser; the pages still render.

7. Recipients and transfers

Hosting is Cloudflare Workers (edge compute and static assets). Cloudflare, Inc. and its EU entity process requests as infrastructure. That can involve transfers outside the EEA under Cloudflare’s applicable safeguards (including Standard Contractual Clauses).

8. Retention

Edge logs follow Cloudflare’s retention for Workers observability, then are deleted or aggregated. On-device Harshy SDK sessions remain on the handset until the host or user deletes them; we cannot erase what we never received.

9. Your rights

If you are in the EEA/UK, you may request access, rectification, erasure, restriction, objection, and portability for personal data we actually hold. In practice this site does not keep a user database. You may complain to a supervisory authority in your country. Use GitHub issues for requests about this website.

We cannot fulfil an erasure request for trip files that exist only on your phone or in a host’s systems we do not control. Ask the host app publisher for those.

10. Children

Signumb is a driving app. We do not knowingly collect data from children.

11. Automated decisions

The on-device score and events are heuristics for driving quality. They are not intended as solely automated decisions with legal or similarly significant effects under GDPR Art. 22. Hosts must not use possible-impact as a crash confirmation.

12. Changes

Updates will be posted on this page and the “Last updated” date will change.

13. Contact

GitHub issues on the Harshy SDK repository.