1. Controller
Hereinafter "we" or "provider".
2. Overview
Exoda Car Control is an independent third-party app for Volvo vehicle owners. The app allows you to retrieve vehicle status, charging information, and other vehicle functions via the official Volvo API. The app complements Volvo's services and has no commercial connection to Volvo Car Corporation.
3. What data is processed?
3.1 Volvo account credentials (OAuth)
- When signing in, an access token and a refresh token are generated via the official Volvo OAuth process.
- We store only these tokens locally on your device (iOS Keychain / Android Keystore).
- Your Volvo account username and password are never captured or stored by the app.
3.2 Vehicle data
- After successful sign-in, vehicle data is retrieved via the Volvo API, e.g.: vehicle status (locked/unlocked, windows, doors), state of charge, odometer reading, and location (if released by the user).
- This data is processed and displayed exclusively locally on your device.
- Only vehicles for which you are authorised via your Volvo account are retrieved.
3.3 Technical data
The app uses a Firebase Cloud Function as an OAuth redirect endpoint (authCallback).
This function merely forwards the OAuth response parameters (authorisation code, state) via HTTP
redirect to the app. No data is stored or logged server-side in this process.
4. Purpose of data processing
Data is processed exclusively for the following purposes:
| Purpose | Legal basis (GDPR) |
|---|---|
| Authentication with the Volvo account | Art. 6(1)(b) (contract performance / use of the app) |
| Display of vehicle status and data | Art. 6(1)(b) |
| OAuth redirect via Cloud Function | Art. 6(1)(f) (legitimate interest) |
5. Sharing with third parties
No personal data is shared with third parties.
- Vehicle data is not transmitted to, sold to, or shared with third parties.
- Communication takes place exclusively between your device and the official Volvo API servers.
- The OAuth redirect function runs on Google Cloud (Firebase) but does not process personal data permanently (see Section 3.3).
6. Data processors / sub-processors
| Service | Provider | Purpose | Location |
|---|---|---|---|
| Firebase Cloud Functions | Google Ireland Ltd. | OAuth redirect (no data storage) | EU (europe-west1) |
| Volvo API | Volvo Car Corporation | Vehicle data retrieval | EU |
Processing by Google takes place on the basis of Google Cloud Terms of Service and data processing
agreements (Art. 28 GDPR). The server location is europe-west1 (Belgium).
7. Retention periods
- OAuth tokens: Stored locally on the device for as long as the app is used. Deleted on sign-out or uninstall.
- Vehicle data: Held only in working memory at runtime and not stored permanently.
- Server-side: No personal data is stored server-side.
8. Your rights (Art. 15–22 GDPR)
You have the right to:
- Access (Art. 15) to the data stored about you
- Rectification (Art. 16) of inaccurate data
- Erasure (Art. 17) – by signing out in the app or uninstalling, all local data is removed
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Objection (Art. 21) to processing
- Lodge a complaint with a supervisory authority (Art. 77) – in Germany, for example, with the competent state data protection authority
To exercise your rights, please contact us by e-mail at the address above.
9. Data security
- Tokens are stored in platform-native, encrypted storage (iOS Keychain, Android Keystore).
- All communication with the Volvo API and Firebase takes place exclusively over HTTPS/TLS.
- OAuth authentication uses PKCE (Proof Key for Code Exchange) to protect against authorisation code interception.
10. No tracking or analytics services
The app uses no tracking tools, analytics services, advertising networks, or cookies.
11. Minors
The app is not intended for persons under the age of 16. No data from minors is knowingly collected.
12. Changes to this privacy policy
We reserve the right to update this privacy policy as needed, e.g. when features are extended or legal requirements change. The current version is always available in the app and on this page.
13. Contact
For questions about data protection, please contact: