FrogPilot and Your Data

Why I Care

When people think about their driving data, they usually picture how they drive, like how fast they go or how hard they brake. That’s the least revealing part of it.

Before any filtering, the logs your comma device records as you drive also hold your car’s VIN (its vehicle identification number), your exact GPS position, the time, and video of the road. Line up a few weeks of those drives and they show where you live, where you work and what hours you keep, where you drop your kids off at school, and when you’re away from home and for how long.

Someone with that data knows when your house is empty and where your family will be, and once a copy of it gets out, it can’t be taken back. So I treat it like locking my doors or wearing a seatbelt, just a basic precaution that’s worth taking.

I’m one person working on FrogPilot, my version of comma’s openpilot driver assistance software, as a hobby, and I only want driving data to make FrogPilot better, like adding support for more cars, tracking down bugs, and tuning how they drive. I have no interest in keeping tabs on where anyone goes, which is why sharing is your choice, and FrogPilot works the same on your device either way.

That’s also why I’m writing this. Driving logs are filtered, but some of what’s shared can still show where a car has been, so here’s exactly what FrogPilot collects, why, how I protect it, and what I can’t remove, so you can decide for yourself.

The Short Version

• It’s your choice. “Share FrogPilot Data” stays off until you say yes. FrogPilot asks you up front, and you can change your answer anytime under Settings → Software → Share FrogPilot Data on the device or System Settings → DATA → Share FrogPilot Data in “The Pond”, the web page FrogPilot runs for controlling your device.
• What’s shared. With it on, your device sends FrogPilot filtered driving logs, learned speed limits with the exact spot and a photo of each sign, short speed limit sign clips that can show people and license plates, and usage stats.
• I don’t sell it. I don’t sell your data, share it with advertisers or data brokers, or show ads.
• What keeps going. Crash reports, device check-ins, and your device’s unfiltered uploads to comma or Konik don’t depend on that setting. Further down, I cover how to stop the ones you can.
• Lock The Pond. Until you turn on its “Pairing Code” setting, anyone on the same network as your device can open The Pond, so turn it on before your device joins a network you don’t fully trust.

What’s Shared and Why

With “Share FrogPilot Data” on, your device shares four kinds of data, and all of it reaches me linked to your FrogPilot device ID, which is separate from your comma or Konik device ID. Driving logs, learned speed limits, and speed limit sign clips only upload while your car is off and your device is on an unmetered connection like Wi-Fi. Usage stats go out each time your device checks in with my server, at startup and after each drive, on any connection.

Driving Logs

Your device shares a filtered log of each minute of driving once you turn sharing on, and drives from before that aren’t uploaded. These show how your car and FrogPilot behaved, like acceleration, braking, speed, steering, the lanes and road shape ahead, and map details such as speed limits and upcoming turns. They also keep your car’s firmware versions and its raw CAN data, which is the messages your car’s parts send each other.

I use them to fix bugs, tune how FrogPilot drives, and support more cars. Your device filters them first, as covered below.

Learned Speed Limits

The sign reader reads speed limit signs through the road camera, and “Speed Limit Filler”, which is on by default, uses it to fill in limits your map is missing or has wrong. With sharing on, your device shares each limit it learns, along with a cropped photo of the sign, which can show part of the road around it. Each one comes with the exact GPS position and direction you were heading when the sign was first seen, how far you drove with that limit, the month, and the road’s map ID. It also shares the roads where a sign matched your map, with the limit and the month, so I can measure the reader’s accuracy.

This is the one kind of data here that includes exact GPS on purpose, since a limit is no use without its place, so together these show roads you’ve driven and the month you drove them. I use them to improve speed limits for everyone using FrogPilot.

With sharing off, “Speed Limit Filler” still learns limits and uses them, and anything it learns that way stays on your device, even if you turn sharing on later.

Speed Limit Sign Clips

With sharing on, your device saves about 15 seconds of road camera video for one in ten of the limits the sign reader reads, for every new limit a Toyota or Lexus shows on its dashboard, and for every sign the reader isn’t sure of. Each clip comes with basic camera, device, and software details, how the camera is aimed, and the limit or the reader’s best guess.

The video is uploaded as recorded, so it can show identifiable places, license plates, and people. GPS coordinates and the recording time aren’t attached, though my server records when each clip arrived, and since both carry your device ID, a clip can be matched to that drive’s log. I use them to train and test the sign reader.

Usage Stats

Each check-in carries these.

• Your car’s details, without the VIN or firmware versions
• Your driving totals, like alerts, time and distance driven, and time driven by day, by night, and in different weather
• Your ratings of driving models, the AI that drives your car, and the curve speed FrogPilot has learned from your driving
• All of your FrogPilot settings, including any startup message you’ve typed, but not the keys you’ve added or The Pond’s pairing code
• Your nearest city of at least 50,000 people, or your region’s capital if it has none, with your state and country, worked out on your device

Your device keeps those totals whether or not you share, so your first check-in with sharing on includes earlier driving in its totals, though not the drives themselves.

I use them to see which cars, driving models, and features people use, so I know what to improve. FrogBot, my AI help assistant, can also answer questions about what FrogPilot drivers use, from totals of at least 20 devices each, rounded down to tens.

What Your Device Removes, and What It Can’t

Your device filters FrogPilot’s driving logs before they upload.

What’s Removed

• Account details, SSH keys, and every setting except which driving model you use
• Alert text, though which alerts showed stays in the log
• Altitude, exact GPS coordinates, GPS times, and heading
• Audio, camera footage, and driver monitoring data
• CAN messages from the start of each drive until your device has identified your car, since that’s when it reads the VIN
• Known GPS, clock, and VIN messages in raw CAN, on Chrysler, Ford, GM, Honda, Hyundai, Mazda, PSA, Rivian, Subaru, Tesla, Toyota, and Volkswagen cars, along with sister brands like Kia and Lexus
• Navigation routes, and road names and IDs
• The VIN field

I built that CAN list by scanning about 10,900 log segments from comma’s datasets, drives shared with me, and public routes.

What It Can’t Remove

Filtering lowers the risk, but it doesn’t make this data anonymous.

• Raw CAN. I keep it because it’s how I support more cars, but it’s whatever your car sends, and I can only remove what I’ve found. Brands not listed above get no CAN filtering beyond startup, and any car may carry GPS or VIN messages I haven’t found. Some clocks, odometers, and the car’s own compass headings stay, and on some cars so does seat occupancy. A few messages also mix GPS or the VIN with other data I can’t separate out, such as a map data message on some Volkswagens and VIN-carrying messages on some Chrysler, GM, Hyundai, and Subaru cars. Stored locations, like a saved charging spot, are also hard to find since they don’t change as you drive.
• The shape of your drive. Speed and steering over a drive, along with the map’s road types, speed limits, and upcoming turns, could be matched to roads on a map.
• When and how long. Each drive gets an ID that hides when it was recorded, but my server records when each file arrives, which is usually soon after the drive, and the number of files shows about how long you drove.
• Your car. Logs name your car’s firmware versions and model, and your device ID ties your drives together.

If any of that doesn’t sit right with you, turn “Share FrogPilot Data” off. That’s what it’s there for!

What Happens on My Server

Driving logs, sign clips, and sign photos upload straight to Backblaze, a cloud storage company, where they’re encrypted and aren’t public. My server only approves each of those uploads and never opens the file, so nothing on my end re-checks what your device filtered. Learned speed limits and usage stats go through my server to my database. Here’s how long the main things stay, and the privacy policy has the rest.

• Driving logs, sign clips, and sign photos. Deleted from storage within 9 days of upload.
• Learned speed limits. One list per device, replaced at each upload.
• Usage stats. One copy per device, replaced at each check-in.

At your device’s next check-in after you turn sharing off, my server deletes its copies of your learned speed limits and usage stats, and the times your device checked in on earlier days. Files already in storage age out on the schedule above, or you can email privacy@FrogPilot.com and I’ll delete them sooner. Anything recorded while sharing was on that hasn’t uploaded yet stays on your device, and goes out if you turn sharing back on.

Who Can See It

That’s mostly me, but here’s who else.

• AI tools. I use Anthropic’s Claude Code and OpenAI’s Codex for FrogPilot work, with model training turned off on my accounts. They work on driving logs copied to my computer and help review still frames from sign clips, so parts of both can reach Anthropic and OpenAI.
• My computer. I copy the driving logs a task needs and delete them when it’s done. Sign photos I pick for speed limit work stay up to 7 days after upload. Shared sign clips are copied there too while I work on the sign reader, and deleted when that work is done, except the ones I pick to train and test it, which stay up to 90 days.
• My own drives. My own devices upload complete drives, with video and unfiltered logs, and I keep them for a year. That needs a file only my devices have and a setting on my server, so yours can’t.
• People helping label signs. Signed-in helpers see small crops showing only a sign, with no device ID, place, or time.
• Shared comma devices. If you share your device with my comma account, I can see its drives on comma’s site, including GPS positions and VINs. That’s separate from “Share FrogPilot Data”, and it only happens if you set it up. To undo it, email me and I’ll remove it.
• The Pond. Until you turn on FrogPilot → Maps and Navigation → NAVIGATION → Pairing Code, which is off by default, anyone on the same Wi-Fi as your device, or on your Tailscale private network if you’ve set one up, can open “The Pond”. It shows your drives, camera footage, and location, and can change your settings, unlock your doors, and run commands on the device. While you’re driving, everything locks except navigation, which still shows your saved places and the car’s recent position.

What Keeps Going With Sharing Off

Things You Can Turn Off

• comma or Konik uploads. Just like openpilot, your device uploads unfiltered drive logs, with your GPS position, VIN, and the time, plus low-resolution road video, to comma, or to Konik, an alternative to comma’s service, if you use it. To stop them, turn on FrogPilot → System Settings → DEVICE CONTROLS → Device Settings → Disable Uploads, which needs Tuning Level (how many settings FrogPilot shows) at Advanced or higher with “Device Settings” on. Uploads start again if you later lower Tuning Level or turn off “Device Settings”. That also stops FrogPilot’s driving logs, learned speed limits, sign clips, and sign photos, while usage stats only stop with “Share FrogPilot Data”. Your device still stays connected to their service, which can ask it for files, live data, and a camera snapshot, and registering with them sends your device’s IMEI, its cellular modem’s ID, and serial number.
• Issue reports. These only go out when you send one. A report includes your Discord name, your settings, the latest error log, and the logs of the drive you pick, your most recent one by default, as recorded, with exact GPS, the VIN, and a road snapshot about every 5 seconds. Picking “Not during a drive” sends no drive logs, and “Full details” adds road video.
• Location features. Setting a destination sends your position and destination to Mapbox with your own key, or to comma without one. “Weather Condition Offsets” is off by default, and when it’s on it sends your location, rounded to about 1 km, to my server, which asks OpenWeather and doesn’t store it. If you add your own OpenWeather key, your device asks OpenWeather directly with the same rounded location and only uses my server if that fails. If you add your own Mapbox key, “Use Mapbox as Fallback”, which is on by default, sends exact GPS points to Mapbox about every 5 seconds under your account until you turn it off.

Things You Can’t Turn Off

• Crash reports. FrogPilot installed from my GitHub sends errors to Sentry, a crash reporting service, with your comma or Konik device ID and software details, and Sentry sees your IP address. It also tells Sentry, with the same ID, each time FrogPilot starts. Error messages aren’t filtered, so they can contain parts of commands or settings.
• Device check-ins. Your device registers with my server after each update, with its public key and build details, so FrogPilot’s online features work, and checks in at startup and after drives. With sharing off, a check-in only tells me your device ID and the time, and my server keeps only that day’s. My server logs also keep a scrambled form of your IP address and your network provider for up to 90 days.
• Downloads. Maps come from a community server, and driving models, themes, and updates come from GitHub and GitLab. Those services see your IP address and what you download, so the map server can tell roughly where you are. While a speed limit feature is on, your device also asks my server for the latest sign reader model.

Check My Work

You don’t have to take my word for most of this! FrogPilot’s code is public, so you can read what your device filters and sends in the driving log filter, map program, sign clips, “Speed Limit Filler”, and usage stats. My server’s code isn’t public, so that part you do have to take my word for.

I can miss things. If you ever spot something FrogPilot collects that it shouldn’t, or a filter that isn’t doing its job, please let me know in the Discord or at privacy@FrogPilot.com. You can also email me for a copy of what I have from your device, or to have it deleted.

A Caution for Any Fork

This goes for every fork you might install, including mine. A fork, a modified version of openpilot like FrogPilot, has the same access openpilot has to your cameras, your car’s data, and your GPS position, so it’s worth a quick look before you install one.

Start with the code. If a fork keeps its code closed, that’s a big red flag, since nobody outside it can check what it does with all that data before it leaves your car, and you shouldn’t have to just hope it’s fine! If you can read it, check that sharing is off until you say yes, and that the fork says plainly what it collects, who gets it, and for how long, in a way that matches the code. If it doesn’t, ask the developer, since that’s a fair question to ask anyone holding your data!