Privacy Policy

Last updated: September 3, 2026

1. Overview

Klomio ("the App") is a mileage tracking application developed and operated by Tienne Labs, based in the Netherlands. Tienne Labs is the data controller for any personal data processed through the App, as defined under the EU General Data Protection Regulation (GDPR).

Klomio is available as a native iOS app and as an Android app on Google Play. The App helps users log business and personal trips, track mileage, and generate reports for tax or reimbursement purposes.

Klomio is built with a privacy-first approach. All your data stays on your device. There are no user accounts, no cloud sync, no analytics, and no advertising. This policy explains what data the App handles, how it is protected, and what rights you have.

2. Data Collection and Storage

All data is stored locally on your device. Klomio does not operate servers that store your personal data.

The App stores the following data on your device:

• Trip records - date, time, distance, duration, start and end locations, trip type (business/personal), notes, and odometer readings
• Saved places - name, address, and geographic coordinates
• App settings - preferred units, mileage rates, default navigation app, theme preference, and notification preferences
• PIN hash - derived using PBKDF2 with 600,000 iterations. If you enable biometric unlock (Face ID or Touch ID on iOS, fingerprint or face unlock on Android), a copy of your PIN is also kept in the device's secure storage (iOS Keychain or Android Keystore), protected by your biometrics
• Subscription status cache - a local copy of your current subscription state, used to determine feature access

3. Legal Basis for Processing (GDPR Article 6)

Klomio processes personal data under the following legal bases:

• Consent (Article 6(1)(a)) - You explicitly grant permission for GPS location access through your device's system prompt. You can revoke this at any time in your device settings.
• Performance of a contract (Article 6(1)(b)) - Trip records and related data are processed to provide the core mileage tracking service you have chosen to use.
• Legitimate interest (Article 6(1)(f)) - App settings, PIN protection, and subscription status are processed to ensure the App functions correctly and securely.

4. Location Data

Klomio uses GPS location data to measure trip distance. Location data is:

• Used during active trip tracking, and, if you enable Automatic Trip Detection (Section 5a), in the background to recognise when a drive starts and ends
• Processed entirely on-device to calculate distance
• Stored as start and end coordinates on each trip record
• Coordinates are sent to Google (route distance) and Nominatim (address lookup) only during active trip tracking

A trip's start and end coordinates are saved. For trips tracked by GPS (manual tracking or auto-detect), the full route (the GPS track recorded during the drive) is also stored, encrypted, on your device, and is deleted when you delete the trip.

5. Background Location Access

When you start a trip, Klomio continues tracking your location in the background so you can use other apps (such as a navigation app) without interrupting the trip. This is powered by the @capacitor-community/background-geolocation plugin.

Background location access:

• Is active only during a trip you have started
• Stops automatically when you end the trip, close the App, or disable GPS on your device
• May have a minor impact on battery life during active tracking
• Is never used outside of an active trip, unless you turn on Automatic Trip Detection (Section 5a), which is optional and off by default

5a. Automatic Trip Detection (optional, off by default)

If you choose to enable Automatic Trip Detection, Klomio can recognise when you start and finish a drive, so your trips are logged without tapping Start. It is off until you turn it on, and you can turn it off again at any time in Settings, which stops all background activity.

While it is turned on, and only then, Klomio uses two kinds of information in the background:

• Your location - so the app can notice when you start or end a drive. This can happen while the app is closed, which is what lets it catch drives you would otherwise forget to log.
• Your phone's motion and activity - so the app can tell driving apart from walking and know when you have parked.

All of this stays on your device. Klomio has no servers and never sends your location or motion data anywhere. Each detected drive is saved for you to review, and you can approve or discard it. GPS runs only while a drive is actually happening.

6. Data Security and Encryption

Klomio takes the following measures to protect your data:

• AES-256-GCM encryption - Trip records, including their GPS routes, and app settings are encrypted at rest
• PBKDF2 key derivation - Your PIN is verified against a PBKDF2 hash with 600,000 iterations. If you enable biometric unlock, a copy of your PIN is stored in the device's secure storage (iOS Keychain or Android Keystore), protected by your biometrics
• Non-extractable keys - The key protecting your trip data is generated via the Web Crypto API and marked as non-extractable, preventing direct access to its key material
• Rate-limited PIN attempts - Repeated incorrect PIN entries trigger an HMAC-based lockout mechanism to prevent brute-force attacks
• Auto-lock - The App can be configured to lock automatically after a period of inactivity

7. Third-Party Services

Klomio integrates with the following third-party services. These are the only external services with which data may be shared.

Google Places API

When you search for an address or place in the App, your search query and approximate location are sent to Google's Places API to return address suggestions. This data is transmitted to Google servers in the United States and is subject to Google's Privacy Policy.

Google Directions API

When the App calculates a route distance, the start and end coordinates of the trip are sent to Google's Directions API. This data is transmitted to Google servers in the United States and is subject to Google's Privacy Policy.

Navigation Apps (Waze, Google Maps, Apple Maps)

When you choose to navigate to a destination, the App opens your selected navigation app and passes the destination coordinates. No other data is shared. This action is always initiated by you.

Apple StoreKit 2 (iOS)

On iOS, subscription payments are processed entirely by Apple through StoreKit 2. Klomio never receives, processes, or stores your payment information. All billing is handled by Apple and is subject to Apple's Privacy Policy.

Google Play Billing (Android)

On Android, subscription payments are processed entirely by Google through Google Play's billing system. Klomio never receives, processes, or stores your payment information. All billing is handled by Google and is subject to Google's Privacy Policy.

Capacitor Framework

Klomio uses the Capacitor framework to bridge between web technologies and native iOS and Android capabilities. Capacitor does not collect, transmit, or store any user data.

OpenStreetMap Nominatim

Klomio uses the Nominatim geocoding service (operated by the OpenStreetMap Foundation) to convert GPS coordinates into readable street addresses. When a trip starts or ends, your coordinates are sent to nominatim.openstreetmap.org to determine the nearest address. This data is subject to the OpenStreetMap Foundation Privacy Policy. Nominatim does not require an account and requests include only coordinates and a User-Agent header identifying the app.

8. International Data Transfers (GDPR Chapter V)

When you use address search or route calculation features, your data (search queries, approximate location, or trip coordinates) is transmitted to Google servers located in the United States. GPS coordinates are also sent to Nominatim servers (operated by the OpenStreetMap Foundation, based in the UK) for reverse geocoding.

The legal basis for transfers to Google is the EU-US Data Privacy Framework (DPF). Google LLC is a certified participant in the DPF, which the European Commission has recognized as providing adequate protection for personal data transferred from the EU to the US. Transfers to Nominatim (UK) are covered under the UK adequacy decision.

You retain all your rights under the GDPR regardless of where your data is processed.

9. Subscriptions and Payments

Klomio offers optional paid subscriptions. On iOS, payment processing is handled by Apple through StoreKit 2. On Android, it is handled by Google through Google Play's billing system. In both cases the platform is the merchant and Klomio never touches your payment details.

• Klomio never receives your credit card number, bank details, or your Apple ID or Google account password
• No payment information is stored by the App
• Subscription status is cached locally on your device to determine feature access
• To manage or cancel your subscription, go to Settings > Apple ID > Subscriptions on your iOS device, or open the Play Store app and go to Payments and subscriptions on Android

10. Data Storage Technologies

• Your data is stored in the app's sandboxed storage on your device; trip records and app settings are encrypted with AES-256-GCM

Klomio does not use cookies, tracking pixels, fingerprinting, or any analytics service. Your theme preference (light/dark) is stored locally as a non-personal configuration value.

11. Notifications

Klomio supports local notifications only. There is no push notification server.

• Weekly summary - A local notification summarizing your weekly mileage
• Trip reminders - Configurable reminders to log trips
• Detected-trip alerts - A local notification when Klomio detects a drive or has trips waiting in your review inbox (Automatic Trip Detection only)
• Recording and arrival prompts - The ongoing notice shown while a drive is being recorded, a round-trip merged notice, and a reminder to enter your odometer reading on arrival when odometer readings are enabled
• Getting-started nudges - Occasional local notifications after your first trip or after a quiet week

Notifications can include trip details such as a place name and a distance, so they may be visible on your lock screen depending on your device settings. All notifications are generated entirely on your device. No data is transmitted to deliver them.

12. Odometer Readings

Odometer readings are an optional feature. If you choose to record them:

• They are stored locally on your device, encrypted alongside the trip record
• They are never transmitted to any external service
• They are deleted when you delete the associated trip

13. Data Export and Portability (GDPR Article 20)

You can export your data at any time in the following formats:

• CSV - Trip data in a spreadsheet-compatible format
• PDF reports - Formatted trip reports for printing or sharing
• JSON backup - A complete export of all your data in a machine-readable format

All exports are generated entirely on your device and shared using your device's native share functionality.

14. Data Retention

• Trip records - Stored indefinitely until you delete them
• Saved places - Stored indefinitely until you delete them
• PIN and encryption keys - Stored until you reset the App. If you uninstall without resetting, the operating system may keep the App's secure-storage entries; these contain key material only, no trip data
• Pending trip cache - Used to recover an interrupted trip. Auto-resumed for up to 24 hours, then surfaced for your decision (save, discard, or defer) for up to 30 days, after which it is silently discarded
• Subscription status cache - Refreshed periodically from Apple's or Google's servers, depending on your platform

Klomio does not enforce automatic deletion of your trip data. You are in full control of when data is removed.

15. Your Data Rights (GDPR Articles 15-22)

As a user in the EU, you have the following rights:

• Right of access (Article 15) - Export all your data using the JSON backup feature in the App
• Right to rectification (Article 16) - Edit any trip record or saved place directly in the App
• Right to erasure (Article 17) - Delete individual trips and saved places, or use Reset all data in the App's settings
• Right to restrict processing (Article 18) - Disable specific features (such as location tracking or notifications) in your device or App settings
• Right to data portability (Article 20) - Export your data in CSV or JSON format
• Right to object (Article 21) - Disable background location tracking or notifications at any time
• Right to lodge a complaint - You may file a complaint with a supervisory authority (see Section 18)

Because all data is stored locally on your device, most of these rights can be exercised directly within the App without needing to contact us.

16. Data Deletion

You can delete your data in several ways:

• Individual trip deletion - Delete any single trip from within the App
• Bulk deletion - Use the "Reset all data" option in Settings to remove your trip records, saved places, and settings
• App uninstall - Removing the App from your device deletes your trips, places, settings, and the App's other stored files. The operating system may keep the App's secure-storage entries, which contain no trip data. To remove everything in one step, use Reset all data before uninstalling

Klomio runs no cloud, account, or sync service, so your trips are never uploaded to Klomio. On iOS, like other app data, they are part of your device's standard backup (iCloud or local) when you have device backups enabled; Apple encrypts that backup and you control it in iOS Settings. On Android, Klomio opts out of device backups, so the in-app Backup export is the only copy of your trips outside the phone. Deleting a trip in the App removes it from your device.

17. Children's Privacy

Klomio is designed for adults who track business mileage. We do not knowingly collect personal information from children. While Klomio uses third-party map services for address search and route calculation, queries are not associated with user identity (no account or user ID is transmitted), and all trip data is stored only on your device. If you believe a child has used the App, please contact us so we can advise.

18. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens (AP)
Website: https://autoriteitpersoonsgegevens.nl
Email: info@autoriteitpersoonsgegevens.nl
Phone: +31 (0)88 1805 250

You may also contact the supervisory authority in the EU member state where you reside or work.

19. Permissions Klomio Requests on iOS

Klomio requests the minimum set of permissions needed to provide trip tracking. You can grant or revoke any of these at any time in your device settings.

• Location While Using App - Used to measure GPS distance during a trip you have started.
• Location Always (optional) - Used to continue tracking when the App is backgrounded mid-trip (so you can use a navigation app or lock your screen without interrupting a trip) and, if you enable Automatic Trip Detection, to recognise when you start a drive (see Section 5a). You can decline it or revoke it any time in iOS Settings.
• Motion & Fitness (optional) - Requested only if you enable Automatic Trip Detection. Used on your device to tell driving from walking, so the app can recognise the start and end of a drive. This data stays on your device, is never stored in your records, and is never sent to Tienne Labs or anyone else. You can decline or revoke it any time in iOS Settings.
• Notifications (optional) - Used to surface local reminders (such as the weekly summary or trip-logging reminders). All notifications are generated on your device. No data is transmitted to deliver them.
• Face ID / Touch ID (optional) - Used to unlock the App without typing your PIN. Biometric data never leaves your device and is never sent to Tienne Labs or any third party.
• App Tracking Transparency - Klomio does not request tracking authorization because we do not perform any cross-app or cross-website tracking and do not share data with data brokers.

19a. Permissions Klomio Requests on Android

Klomio requests the minimum set of permissions needed to provide trip tracking on Android. The location, physical activity, and notification permissions can be granted or revoked at any time in your device settings. The foreground service permission is declared when the app is installed and has no separate settings toggle, and the battery exemption is a special app access you can reverse in settings.

• Precise and approximate location (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION) - Used to measure GPS distance during a drive that is being recorded. Android requests the two together and lets you choose approximate only, but measuring a drive needs precise location.
• Background location (ACCESS_BACKGROUND_LOCATION) (optional) - Requested if you enable Automatic Trip Detection, so the app can notice that a drive has started and record it while the app is closed (see Section 5a). You can decline it or revoke it at any time in Android settings.
• Physical activity (ACTIVITY_RECOGNITION) (optional) - Requested if you enable Automatic Trip Detection. Used on your device to tell driving apart from walking, so the app can recognise the start and end of a drive. This signal stays on your phone and is never sent to Tienne Labs or anyone else.
• Location foreground service (FOREGROUND_SERVICE_LOCATION) - Lets Klomio run a visible recording service while a drive is in progress. The service shows an ongoing notification for the whole session. After a trip saves it may stay up as a low-power departure watch until your next drive, always shown by its notification and switchable off in Settings. The watch sleeps until the phone's motion sensor reports movement and then takes a few location checks. At parking spots without usable Wi-Fi positioning it also checks every few minutes for at most 8 hours. After a false start anywhere, a short watch may run for up to ten minutes with one check a minute.
• Notifications (POST_NOTIFICATIONS) - Used for the ongoing recording notification during a drive and for local alerts such as the "Trip saved" notice and the weekly summary. All notifications are generated on your device, and no data is transmitted to deliver them.
• Battery optimisation exemption (optional) - On some phones the system puts background apps to sleep, which can stop automatic detection between drives. Klomio asks for this exemption during setup and shows a notice in the app when your phone is restricting it, so you can grant it then. You can reverse it at any time in Android settings.

20. Apple App Store and TestFlight

When you install Klomio from the App Store or TestFlight, Apple may collect crash logs, basic device information, and aggregated usage metrics. This data is governed by Apple's Privacy Policy. Tienne Labs does not access or receive this information directly, although Apple may share aggregated, non-identifying analytics with us through App Store Connect if you have not opted out of sharing diagnostics with developers in your iOS settings.

20a. Google Play

When you install Klomio from Google Play, Google may collect crash logs, basic device information, and aggregated usage metrics. This data is governed by Google's Privacy Policy. Tienne Labs does not access or receive this information directly, although Google may share aggregated, non-identifying statistics with us through the Google Play Console.

On Android, subscription payments are processed entirely by Google through Google Play's billing system. Klomio never receives, processes, or stores your payment information. No payment details are stored by the App. To manage or cancel your subscription, open the Play Store app and go to Payments and subscriptions.

21. Changes to This Policy

We may update this policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page and may notify you through a notice in the App. Your continued use of Klomio after changes are published constitutes acceptance of the updated policy.

22. Contact

If you have questions about this privacy policy or how your data is handled, contact us at:

Tienne Labs
Email: support@tiennelabs.com
Website: https://klomio.app