Privacy Policy

Last updated: April 30, 2026

1. Overview

Klomio ("the App") is a mileage tracking application developed and operated by Tienne Labs, based in the Netherlands. Tienne Labs is the data controller for any personal data processed through the App, as defined under the EU General Data Protection Regulation (GDPR).

Klomio is available as a native iOS app. An Android version is planned for a future release. The App helps users log business and personal trips, track mileage, and generate reports for tax or reimbursement purposes.

Klomio is built with a privacy-first approach. All your data stays on your device. There are no user accounts, no cloud sync, no analytics, and no advertising. This policy explains what data the App handles, how it is protected, and what rights you have.

2. Data Collection and Storage

All data is stored locally on your device. Klomio does not operate servers that store your personal data.

The App stores the following data on your device, encrypted with AES-256-GCM:

• Trip records - date, time, distance, duration, start and end locations, trip type (business/personal), notes, and odometer readings
• Saved places - name, address, and geographic coordinates
• App settings - preferred units, mileage rates, default navigation app, theme preference, and notification preferences
• PIN hash - derived using PBKDF2 with 600,000 iterations; your PIN is never stored as plaintext
• Subscription status cache - a local copy of your current subscription state, used to determine feature access

3. Legal Basis for Processing (GDPR Article 6)

Klomio processes personal data under the following legal bases:

• Consent (Article 6(1)(a)) - You explicitly grant permission for GPS location access through your device's system prompt. You can revoke this at any time in your device settings.
• Performance of a contract (Article 6(1)(b)) - Trip records and related data are processed to provide the core mileage tracking service you have chosen to use.
• Legitimate interest (Article 6(1)(f)) - App settings, PIN protection, and subscription status are processed to ensure the App functions correctly and securely.

4. Location Data

Klomio uses GPS location data to measure trip distance. Location data is:

• Used only during active trip tracking
• Processed entirely on-device to calculate distance
• Stored as start and end coordinates on each trip record
• Coordinates are sent to Google (route distance) and Nominatim (address lookup) only during active trip tracking

Only the start and end coordinates of a trip are saved. The intermediate GPS points used during tracking are discarded after the distance calculation is complete.

5. Background Location Access

When you start a trip, Klomio continues tracking your location in the background so you can use other apps (such as a navigation app) without interrupting the trip. This is powered by the @capacitor-community/background-geolocation plugin.

Background location access:

• Is active only during a trip you have started
• Stops automatically when you end the trip, close the App, or disable GPS on your device
• May have a minor impact on battery life during active tracking
• Is never used outside of an active trip

6. Data Security and Encryption

Klomio takes the following measures to protect your data:

• AES-256-GCM encryption - All locally stored data (trips, places, settings) is encrypted at rest
• PBKDF2 key derivation - Your PIN is hashed with 600,000 iterations using PBKDF2; the original PIN is never stored
• Non-extractable keys - Encryption keys are generated via the Web Crypto API and marked as non-extractable, preventing direct access to key material
• Rate-limited PIN attempts - Repeated incorrect PIN entries trigger an HMAC-based lockout mechanism to prevent brute-force attacks
• Auto-lock - The App can be configured to lock automatically after a period of inactivity

7. Third-Party Services

Klomio integrates with the following third-party services. These are the only external services with which data may be shared.

Google Places API

When you search for an address or place in the App, your search query and approximate location are sent to Google's Places API to return address suggestions. This data is transmitted to Google servers in the United States and is subject to Google's Privacy Policy.

Google Directions API

When the App calculates a route distance, the start and end coordinates of the trip are sent to Google's Directions API. This data is transmitted to Google servers in the United States and is subject to Google's Privacy Policy.

Navigation Apps (Waze, Google Maps, Apple Maps)

When you choose to navigate to a destination, the App opens your selected navigation app and passes the destination coordinates. No other data is shared. This action is always initiated by you.

Apple StoreKit 2

Subscription payments are processed entirely by Apple through StoreKit 2. Klomio never receives, processes, or stores your payment information. All billing is handled by Apple and is subject to Apple's Privacy Policy.

Capacitor Framework

Klomio uses the Capacitor framework to bridge between web technologies and native iOS capabilities. Capacitor does not collect, transmit, or store any user data.

OpenStreetMap Nominatim

Klomio uses the Nominatim geocoding service (operated by the OpenStreetMap Foundation) to convert GPS coordinates into readable street addresses. When a trip starts or ends, your coordinates are sent to nominatim.openstreetmap.org to determine the nearest address. This data is subject to the OpenStreetMap Foundation Privacy Policy. Nominatim does not require an account and requests include only coordinates and a User-Agent header identifying the app.

8. International Data Transfers (GDPR Chapter V)

When you use address search or route calculation features, your data (search queries, approximate location, or trip coordinates) is transmitted to Google servers located in the United States. GPS coordinates are also sent to Nominatim servers (operated by the OpenStreetMap Foundation, based in the UK) for reverse geocoding.

The legal basis for transfers to Google is the EU-US Data Privacy Framework (DPF). Google LLC is a certified participant in the DPF, which the European Commission has recognized as providing adequate protection for personal data transferred from the EU to the US. Transfers to Nominatim (UK) are covered under the UK adequacy decision.

You retain all your rights under the GDPR regardless of where your data is processed.

9. Subscriptions and Payments

Klomio offers optional paid subscriptions. All payment processing is handled exclusively by Apple through StoreKit 2.

• Klomio never receives your credit card number, bank details, or Apple ID password
• No payment information is stored by the App
• Subscription status is cached locally on your device to determine feature access
• To manage or cancel your subscription, go to Settings > Apple ID > Subscriptions on your iOS device

10. Data Storage Technologies

• Data is stored in the app's sandboxed storage on your device, encrypted with AES-256-GCM

Klomio does not use cookies, tracking pixels, fingerprinting, or any analytics service. Your theme preference (light/dark) is stored locally as a non-personal configuration value.

11. Notifications

Klomio supports local notifications only. There is no push notification server.

• Weekly summary - A local notification summarizing your weekly mileage
• Trip reminders - Configurable reminders to log trips

All notifications are generated entirely on your device. No data is transmitted to deliver them.

12. Odometer Readings

Odometer readings are an optional feature. If you choose to record them:

• They are stored locally on your device, encrypted alongside the trip record
• They are never transmitted to any external service
• They are deleted when you delete the associated trip

13. Data Export and Portability (GDPR Article 20)

You can export your data at any time in the following formats:

• CSV - Trip data in a spreadsheet-compatible format
• PDF reports - Formatted trip reports for printing or sharing
• JSON backup - A complete export of all your data in a machine-readable format

All exports are generated entirely on your device and shared using your device's native share functionality.

14. Data Retention

• Trip records - Stored indefinitely until you delete them
• Saved places - Stored indefinitely until you delete them
• PIN and encryption keys - Stored until you reset the App or uninstall it
• Pending trip cache - Used to recover an interrupted trip. Auto-resumed for up to 24 hours, then surfaced for your decision (save, discard, or defer) for up to 30 days, after which it is silently discarded
• Subscription status cache - Refreshed periodically from Apple's servers

Klomio does not enforce automatic deletion of your trip data. You are in full control of when data is removed.

15. Your Data Rights (GDPR Articles 15-22)

As a user in the EU, you have the following rights:

• Right of access (Article 15) - Export all your data using the JSON backup feature in the App
• Right to rectification (Article 16) - Edit any trip record or saved place directly in the App
• Right to erasure (Article 17) - Delete individual trips, saved places, or all data at once using the App's settings
• Right to restrict processing (Article 18) - Disable specific features (such as location tracking or notifications) in your device or App settings
• Right to data portability (Article 20) - Export your data in CSV or JSON format
• Right to object (Article 21) - Disable background location tracking or notifications at any time
• Right to lodge a complaint - You may file a complaint with a supervisory authority (see Section 18)

Because all data is stored locally on your device, most of these rights can be exercised directly within the App without needing to contact us.

16. Data Deletion

You can delete your data in several ways:

• Individual trip deletion - Delete any single trip from within the App
• Bulk deletion - Use the "Clear all data" option in Settings to remove all trip records, saved places, and app data
• App uninstall - Removing the App from your device deletes all associated data

Klomio does not maintain cloud backups. Once data is deleted from your device, it cannot be recovered.

17. Children's Privacy

Klomio is designed for adults who track business mileage. We do not knowingly collect personal information from children. While Klomio uses third-party map services for address search and route calculation, queries are not associated with user identity (no account or user ID is transmitted), and all trip data is stored only on your device. If you believe a child has used the App, please contact us so we can advise.

18. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens (AP)
Website: https://autoriteitpersoonsgegevens.nl
Email: info@autoriteitpersoonsgegevens.nl
Phone: +31 (0)88 1805 250

You may also contact the supervisory authority in the EU member state where you reside or work.

19. Permissions Klomio Requests on iOS

Klomio requests the minimum set of permissions needed to provide trip tracking. You can grant or revoke any of these at any time in your device settings.

• Location While Using App - Used to measure GPS distance during a trip you have started.
• Location Always (optional) - Used only to continue tracking when the App is backgrounded mid-trip, so you can use a navigation app or lock your screen without interrupting the trip. Tracking stops automatically when the trip ends.
• Notifications (optional) - Used to surface local reminders (such as the weekly summary or trip-logging reminders). All notifications are generated on your device. No data is transmitted to deliver them.
• Face ID / Touch ID (optional) - Used to unlock the App without typing your PIN. Biometric data never leaves your device and is never sent to Tienne Labs or any third party.
• App Tracking Transparency - Klomio does not request tracking authorization because we do not perform any cross-app or cross-website tracking and do not share data with data brokers.

20. Apple App Store and TestFlight

When you install Klomio from the App Store or TestFlight, Apple may collect crash logs, basic device information, and aggregated usage metrics. This data is governed by Apple's Privacy Policy. Tienne Labs does not access or receive this information directly, although Apple may share aggregated, non-identifying analytics with us through App Store Connect if you have not opted out of sharing diagnostics with developers in your iOS settings.

21. Changes to This Policy

We may update this policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page and may notify you through a notice in the App. Your continued use of Klomio after changes are published constitutes acceptance of the updated policy.

22. Contact

If you have questions about this privacy policy or how your data is handled, contact us at:

Tienne Labs
Email: support@tiennelabs.com
Website: https://klomio.app