Privacy policy

Who’s responsible

FrogPilot is a hobby project developed and run by FrogsGoMoo, an individual in the United States. FrogsGoMoo decides how the data in this policy is used and is responsible for it, which makes him the “controller” under the EU and UK General Data Protection Regulation (GDPR). In this policy, “we” and “us” mean FrogsGoMoo.

For any privacy question or request, email privacy@frogpilot.com.

The short version

• We don’t sell your data, show ads, or use cookies.
• The website counts visits without cookies, and its own code and logs never store your IP address.
• If you subscribe to the blog by email, you only get the categories you pick, and every email has a link to change them or unsubscribe.
• Your device registers with FrogPilot’s server so it can use FrogPilot’s online features.
• Driving logs, speed limit sign clips, and usage stats are only shared if sharing is turned on, and you can turn it off anytime.
• Official FrogPilot builds send crash reports, tagged with your comma device’s dongle ID. There’s no switch to turn them off.
• You can ask to see or delete your data by email.

On the website

The website has no accounts. Its only form is the blog’s email sign-up.

• Hosting. Vercel hosts the website. Like any web server, it receives your IP address, your browser’s user agent, and the pages you ask for, and it can use your IP address to limit abusive traffic. The website’s own logs don’t record IP addresses, and Vercel keeps those logs for 30 days. The legal basis is our legitimate interest in delivering the website and keeping it working and secure.
• Links. Links to Discord, GitHub, and other sites take you to services with their own privacy policies.
• View counts and the drive’s miles. To count each reader once a day, the website uses a hashed form of your IP address, which our database deletes after the next day (24 to 48 hours), keeping just the totals. The miles visitors watch on the home page’s drive are counted the same way. The legal basis is our legitimate interest in showing accurate counts.
• Blog emails. If you subscribe to new blog posts by email, we receive your email address and the categories you pick, and email you a link to confirm. Nothing else is sent until you use it, and the link works for two days. To limit abuse of the sign-up, the request is kept with a hashed form of your IP address, and deleted within three days. Once you confirm, Resend, our email provider, keeps your address and categories and emails you when a post is published in one of them. Every email has a link to a page where you can change your categories or unsubscribe. If you unsubscribe, Resend keeps your address marked as unsubscribed so you aren’t emailed again, unless you ask us to delete it. Our emails don’t track whether you open them or click their links. The legal basis is your consent.

Cookies, browser storage, and analytics

The website doesn’t use cookies.

It remembers your theme, time of day, light mode, and animation choices in your browser’s local storage, and the home page keeps a copy of its cabin picture in your browser’s session storage for the rest of your visit. These stay in your browser and are never sent to us. You can clear them anytime in your browser’s settings.

Every page loads Cloudflare Web Analytics, which records the page you visit, the site that linked you there, your browser, operating system, device type, and country. Cloudflare says it doesn’t use cookies, local storage, or fingerprinting for this. Per Cloudflare’s documentation, it keeps the detailed data for about a week and summaries for up to six months. The legal basis is our legitimate interest in understanding, in total, which pages people read.

The website works the same way whether or not your browser sends a Do Not Track signal, and it doesn’t track you across other sites.

On your device

Your comma device talks to FrogPilot’s server at api.frogpilot.com. Some of this is always on, and the rest only happens when you turn on a feature or send something yourself.

Registration (always on)

When FrogPilot first runs, and again after each software update, your device registers with our server. This happens whether or not you share data, because it’s how your device signs in to FrogPilot’s online features. Without it, those features don’t work.

Your device sends its comma device public key (the same key comma’s servers know your device by), its device type, its operating system version, details of the FrogPilot build it runs (such as the version, branch, commit, and where it was installed from), and a sign-in token it creates (see the code).

We store a device ID based on the public key, the public key, sign-in details (which show when your device last checked in), the device type, whether it runs a modified or forked build, and when it registered.

Our server may look up the repository, branch, and commit your device reports on GitHub. GitHub receives only those names, never your device ID or IP address.

The legal basis is our legitimate interest in running FrogPilot’s online services, signing devices in, and preventing abuse.

Check-ins (whether or not you share)

Once you’ve answered FrogPilot’s question about sharing data, or used the Share FrogPilot Data switch, your device checks in at startup and after each drive (see the code). On the comma four, which doesn’t ask and has no switch, it doesn’t check in. With sharing off, a check-in carries no stats, settings, or location, and it tells our server to delete any usage stats and Speed Limit Filler data it holds for your device. We record the time of each check-in and whether it carried stats. The legal basis is our legitimate interest in running the service.

Usage stats (only if you share FrogPilot data)

Sharing is off until you say yes, either when FrogPilot asks during setup or with “Share FrogPilot Data” in the Software settings, and you can turn it off there anytime. On the comma four, FrogPilot doesn’t ask and has no Share FrogPilot Data switch, so sharing stays off.

With sharing on, each check-in carries usage stats (see the code).

• All of your FrogPilot settings, including any startup message text you’ve typed.
• Driving model scores and calibration details.
• Driving totals, such as time and distance driven, time on each driving model, how often each kind of alert appeared, the cruise speeds you used, time driven by day, by night, and in different weather, and the current month. Your device keeps these totals whether or not you share, so the first upload after you turn sharing on includes driving from before.
• Your car’s details as openpilot sees them, without the VIN or your car’s firmware versions.
• Your nearest large city, state, and country, worked out on your device. Never your exact location.

We keep one copy per device and replace it each time. We use it to see which cars, features, and driving models people use, so we can decide what to improve and fix. The legal basis is your consent.

Driving logs (only if you share FrogPilot data)

After you turn sharing on, your device uploads a log of each minute of driving, only while your car is off and only over unmetered Wi-Fi or Ethernet (see the code). Drives recorded before you turned sharing on aren’t uploaded.

Logs are filtered on your device first (see the code). Camera footage, audio, driver face data, exact GPS coordinates, altitude, heading, GPS times, the VIN field, road names and IDs, and many other kinds of data are removed. Driver monitoring is cut down to your awareness level and whether your car is right-hand drive.

We work to remove personal data we don’t need before it leaves your device. If you spot something we should be removing but aren’t, email privacy@frogpilot.com and we’ll fix it.

What’s left records how your car and FrogPilot behaved, such as speed, steering, acceleration, braking, and the lanes and road shape ahead, along with map details such as speed limits, hazards, and the type of road. Logs also keep your FrogPilot settings (including startup message text), your car’s firmware versions, and your car’s raw CAN bus messages after startup. On some cars, those messages can include GPS position, the VIN, the odometer reading, the date and time, or seat occupancy. Speed and steering over a drive could also be matched to roads on a map.

Each drive gets an ID that doesn’t reveal when it was recorded, but our storage and logs record when each file arrived, which is usually soon after the drive. Logs are linked to your device ID.

We use driving logs to improve steering, acceleration, and braking, support more cars, and find and fix problems. The legal basis is your consent.

Speed limit sign clips (only if you share FrogPilot data)

On supported cars, when the dashboard shows a new speed limit, your device saves about 10 seconds of road camera video and uploads it on the same terms as driving logs (see the code). The video is uploaded as recorded and can show license plates, people, and identifiable places. Each clip comes with the speed limit, camera calibration, and basic device, camera, and software details, and is linked to your device ID. No GPS coordinates or recording time are attached, though our storage records when each clip arrived. We use clips to train FrogPilot’s speed limit sign reader. The legal basis is your consent.

Speed Limit Filler (only if you share FrogPilot data)

If you use Speed Limit Filler, your device uploads its speed limit corrections, each with a road ID from OpenStreetMap, the direction of travel, and where the limit came from. Coordinates are removed, but road IDs still show roads you’ve driven (see the code). Corrections your device collected while sharing was off aren’t uploaded. We keep one list per device and replace it each time. The legal basis is your consent.

Weather (only if you turn on Weather Presets)

Weather Presets is off unless you turn it on. When it’s on, your device rounds its GPS location to about 1 km and sends that to our server every 15 minutes or 20 km. Our server asks OpenWeather for the weather and doesn’t log or store your location. It keeps only the weather answer, for 15 minutes. It also records when your device last asked. The legal basis is providing the feature you turned on.

If you entered your own OpenWeatherMap key, your device asks OpenWeather directly first, sending the same rounded location under your own OpenWeather account about every minute. If that request fails, your device sends it to our server instead, as above.

Issue reports (only when you send one)

When you send an issue report from your device, it includes your Discord username, your message, the end of the latest error log, all of your FrogPilot settings (including startup message text), the name your device gave the drive you picked, if you picked one, and a report ID, linked to your device ID (see the code). We use it to look into the problem and follow up with you on Discord. The legal basis is your consent, which you give by sending the report.

Theme submissions (only when you send one)

When you submit a theme from The Pond, we receive the theme’s name, your Discord username, and the theme’s files, linked to your device ID. They’re stored privately until we review them. If a theme is accepted, we may publish it for other FrogPilot users, as our terms of use describe. A published theme shows whatever creator name you put in the theme itself. Your Discord username stays private, and we use it only to reach you. A published theme stays published after its submission is deleted, so ask us if you’d like it taken down. The legal basis is doing what you asked, reviewing and possibly sharing your theme.

Crash reports (official builds, always on)

Official, unmodified FrogPilot builds send a crash report to Sentry when FrogPilot hits an error or crashes (see the code). A report includes the error message, where in the code it happened, your comma device’s dongle ID (or your Konik ID if you use Konik), the FrogPilot branch and commit, your device type, and when FrogPilot was installed and updated. Reports of native crashes also include the crash’s stack trace, the program’s command line, and parts of its environment, and failed commands send their error output. Error messages aren’t filtered and can contain parts of commands or settings. Sentry also sees your device’s IP address. There’s currently no switch to turn crash reports off. The legal basis is our legitimate interest in finding and fixing bugs in driver-assistance software.

Security and abuse prevention (always on)

Every request to api.frogpilot.com is logged, but our logs never record your IP address, precise location, report text, or stats. They hold a hashed form of your IP address, your network provider, your device ID, details of the request, and the software details your device reports (a repository name can include a GitHub username). Logs of uploads also keep your car’s model and the drive or clip ID, and some logs can record your country and your device’s user agent.

To prevent abuse, we keep records of problems linked to hashed IP addresses and device IDs, and can limit or ban a device or network, automatically or by hand. These limits only affect access to FrogPilot’s online services. A ban on an IP address keeps that address while it’s in force, and Cloudflare receives it to apply the ban. Cloudflare also sees your IP address when it carries your device’s requests.

The legal basis is our legitimate interest in keeping FrogPilot’s services secure and available.

Emails you send us

Email to frogpilot.com addresses passes through SimpleLogin, an email forwarding service, on its way to our inbox. We use your email to answer you. The legal basis is our legitimate interest in replying, and, for privacy requests, our legal obligation to handle them.

Services your device contacts directly

Your device also contacts other services directly. We don’t receive this data, and each service’s own terms and privacy policy apply.

• comma or Konik. Like openpilot, FrogPilot uses comma’s services, or Konik’s if you turn that on. By default, your device uploads drive logs, which include GPS position, and low-resolution road camera video to them. Those logs also include some FrogPilot settings, such as your device’s last known GPS position, your time zone, and any startup message text. “Disable Uploads” in FrogPilot’s Device settings stops these uploads.
• GitHub and GitLab. Your device downloads updates, themes, and driving models from GitHub and GitLab, which see your IP address and what’s downloaded.
• Map downloads. Your device automatically downloads map data for the area around its last known position (about 100 km), and any regions you pick, from map-data.pfeifer.dev, a community server, which sees your IP address and the map areas it downloads (see the code). It checks every hour while it’s on an unmetered network, and refreshes the data once it’s about four weeks old. There’s no switch to turn this off.
• Mapbox. If you enter your own Mapbox key, your device sends pairs of exact GPS points, with their times, to Mapbox about every 5 seconds while driving, under your own Mapbox account (see the code).
• OpenWeather. If you enter your own OpenWeatherMap key, as described above.
• Tailscale. If you install Tailscale from The Pond, your device connects to Tailscale’s service.

Who receives data

We use these services to run FrogPilot, and each gets only what it needs.

• Backblaze stores driving logs and speed limit sign clips, and sees your device’s IP address when it uploads.
• Cloudflare runs our device server, its logs, and the website’s analytics, and sees the IP addresses and requests it carries.
• GitHub gets the repository, branch, and commit names we check.
• OpenWeather gets rounded locations from our server, without your device ID or IP address.
• Resend sends the blog’s emails and keeps subscribers’ email addresses and categories.
• Sentry stores crash reports.
• SimpleLogin forwards emails sent to frogpilot.com addresses.
• Supabase hosts our database and stores theme submissions.
• Vercel hosts the website and sees visitors’ IP addresses and requests.

We don’t sell or rent personal data, and we don’t share it with advertisers or data brokers. We’d only disclose it to anyone else if the law requires it.

International transfers

We’re in the United States, and so are most of the services above. Our database, log archive, file storage, crash reports, and website functions are stored or run in the US, although Cloudflare handles requests at locations around the world. OpenWeather is based in the United Kingdom.

If you’re in the EU, the UK, or elsewhere, your data is transferred to the United States, and each provider’s own terms apply to how it handles it.

How long we keep data

• Abuse-prevention records. Up to 30 days.
• Bans. Deleted 90 days after they end. A blocked IP address is cleared once its ban ends. A permanent device ban keeps the device ID for as long as the ban lasts.
• Blog email subscriptions. A sign-up request is deleted within three days. A confirmed subscription is kept until you ask us to delete it, and after you unsubscribe, only to keep you from being emailed again.
• Check-in history. Deleted at your device’s next check-in after you turn sharing off, except for that day’s check-in times (in UTC), which go later. Every check-in time is deleted after 90 days.
• Crash reports. Deleted by Sentry after 30 days.
• Driving logs and speed limit sign clips. Deleted automatically within 9 days of upload.
• Emails. As long as we need them to answer you, and for privacy requests, as a record of how we handled them.
• Issue reports. 90 days.
• Server logs. 7 days, plus an archived copy for 90 days.
• Sign-in and upload records. Within 9 days.
• Speed Limit Filler data. Replaced at each upload, and deleted at your device’s next check-in after you turn sharing off.
• Theme submissions. Unfinished uploads are deleted once they’re a week old. Finished submissions are deleted a week after we approve them. Ones we don’t approve are deleted 90 days after they were sent.
• Usage stats. Replaced at each check-in, and deleted at your device’s next check-in after you turn sharing off.
• Weather. Your location isn’t kept. Weather answers are kept for 15 minutes.
• Website visit codes. 24 to 48 hours. Vercel’s logs are kept for 30 days.
• Your device’s record. Kept while your device keeps checking in. After 12 months without a check-in, the device and all its data are deleted. A device that’s blocked or banned keeps its public key and sign-in details for as long as the block or ban lasts, which can be permanent.

A device that stops checking in keeps its data until the 12-month deletion. Server logs aren’t changed when other data is deleted, and expire on their own. Cloudflare can restore our device server’s records for 30 days after they change, and deleted data can remain in our database provider’s backups until they’re replaced.

Your rights

Wherever you live, you can ask us to

• tell you what data we hold about you and give you a copy,
• correct data that’s wrong,
• delete your data,
• stop or limit using your data, including objecting to uses based on our legitimate interests, and
• give you the data you shared with us in a common, machine-readable format.

Where we rely on your consent, you can withdraw it anytime. Every blog email has a link to unsubscribe. Turning off “Share FrogPilot Data” stops new uploads, and your device’s next check-in deletes your stored usage stats, Speed Limit Filler data, and check-in history. To delete driving logs and clips you’ve already uploaded, or anything else, email us. Withdrawing consent doesn’t affect what we did before.

If you’re in the EU or UK, you can also complain to your local data protection authority.

California privacy rights

We offer California residents these rights whether or not California’s privacy law applies to FrogPilot.

• Authorized agents. Someone can make a request for you with your signed permission. We’ll confirm the request with you directly.
• Global Privacy Control. Since we don’t sell or share personal information, there’s nothing to opt out of, so browsers that send a Global Privacy Control signal are already treated the way it asks.
• Sensitive information. Your location, rounded to about 1 km, which your device sends only when you turn on Weather Presets. We use it only to fetch the weather and don’t keep it, so there’s no other use to limit. Turning off Weather Presets stops it.
• What we collect and why. Identifiers (your device ID, comma public key, dongle ID, Discord username, and email address if you write to us or subscribe to the blog) to run FrogPilot’s online services, respond to you, and prevent abuse. Internet activity (pages visited, request logs, and hashed IP addresses) to run and secure the website and the services and to count visits. Approximate location (your nearest large city and roads you’ve driven) and vehicle and driving data, only if you share FrogPilot data, to improve FrogPilot. Road video in speed limit sign clips, only if you share FrogPilot data, to train the speed limit sign reader. Crash details to fix bugs.
• Where it comes from. Directly from you, your device, and your browser. We don’t buy data or get it from other sources.
• Who receives it. The service providers listed above, for hosting, storage, crash reporting, weather, and email. We don’t sell or share personal information as California law defines those terms, and we don’t use it for advertising.
• Your rights. You can ask what personal information we collect, use, and disclose, and ask us to correct or delete it, and we won’t treat you differently for asking.

Making a request

Email privacy@frogpilot.com and tell us what you’d like us to do. We’ll reply within one month.

FrogPilot has no accounts, so we find your data by what ties it to you, and confirm the request is yours before sending or deleting anything.

• For your device’s data, send your FrogPilot device ID, shown in the description of “Share FrogPilot Data” in the Software settings, or your comma device’s public key, which we use to work out the device ID. The public key is in /persist/comma/id_rsa.pub on your device, which you can read over SSH. If you can’t get it, tell us and we’ll help.
• For issue reports and theme submissions, send your Discord username, and confirm the request from that Discord account.
• For blog emails, write from the address you subscribed with.
• Crash reports are deleted by Sentry after 30 days and can’t be removed individually before then.

If we can’t confirm a request is yours, we won’t send or delete any data, and we’ll tell you why. A device that still runs FrogPilot registers again at its next check-in, which starts a new device record. Server logs expire on their own within 90 days.

Children

FrogPilot is made for licensed drivers. It isn’t directed at children, and we don’t knowingly collect personal data from anyone under 16. If you think a child has sent us personal data, email privacy@frogpilot.com and we’ll delete it.

Changes to this policy

This policy takes effect on [date to be confirmed].

When FrogPilot’s data practices change, we’ll update this page and its “Last updated” date. For significant changes, we’ll also post on the FrogPilot blog. Before FrogPilot starts collecting a new kind of data, for example if it adds accounts or a FrogBot chat assistant, we’ll update this page first.

Contact

Email privacy@frogpilot.com with any question about this policy or your data.