Koda — Privacy Policy

Last updated 30 September 2026

Koda is a professional tool for automotive locksmiths. It holds a catalogue of vehicle key and transponder data, and lets locksmiths correct and add to that data for each other.

Anyone can create their own Koda account, free. This policy explains what Koda stores, why, who can see it, and how to get it removed.

Who we are

Koda is operated by MBM Koda. For any question about this policy or about your data, contact support@kodadb.com.

How you sign in

Koda offers three ways to create an account and sign in:

Email and password — handled by Google Firebase Authentication on our behalf. We never see or store your password.
Sign in with Google — Google confirms who you are and tells us your email address and your name. We do not receive your Google password, and Koda has no access to your Google account beyond that.
Sign in with Apple — Apple confirms who you are and tells us your email address. Apple sends your name only the first time you authorise Koda, which is why we sometimes ask you to type it.

Hide My Email. If you use Apple's private relay, we receive an address ending @privaterelay.appleid.com rather than your real one. Koda works normally and mail we send reaches you through Apple. We record that the address is a relay so we can explain it on your profile, rather than appearing to have invented it. Your real address is never shared with us.

Signing in with Google or Apple does not give Koda access to your contacts, files, photos or anything else in those accounts. We receive only what is listed above, and only to identify your Koda account.

What we collect

What	Why
Email address	Signing in, resetting a password, and contacting you about your account.
First and last name	Identifying you on your profile and next to what you contribute.
Username (your public handle)	Shown next to work you contribute, so other locksmiths know who wrote it.
Country	Key and lock data differs by market. Your country is shown alongside your contributions so a reader knows which market the advice came from.
Phone number, business name, website, bio (all optional)	Your professional profile. Each of these has its own privacy switch — see Your profile is yours to control below.
Photos you choose to upload	A profile picture, and photos attached to notes you write about a vehicle. Only images you explicitly select are uploaded.
Your contributions — notes, key and transponder values, remote entries, likes, reports	This is the shared catalogue. It is the purpose of the app.
Device identifier	An identifier for the device you sign in on. It is not currently used to restrict anything — Koda is free — and it exists so an account cannot be shared widely if that changes across many phones.

What we do not collect

No location. Koda does not request or collect GPS or any device location. "Country" is a field you select, not a position we read.
No advertising, and no advertising identifiers. Koda contains no ads and no ad networks.
No third-party analytics or tracking. There is no analytics SDK, no behavioural tracking and no crash-reporting SDK in the app.
No card details. Payments are handled entirely by Stripe. Koda never sees or stores a card number.
No contacts, no microphone, no camera roll scanning. The app can open your photo library only when you tap to add a picture, and receives only the images you pick.

What is public, and what is not

Koda is a shared professional catalogue, so some things are visible to other locksmiths by design. This is the part worth reading carefully.

Visible to other signed-in locksmiths

Your username, and the country on your profile
Notes, values, remote entries and replies you contribute, with your username attached
Your profile picture, if you set one
Any profile field you have switched to public

Never shown to other locksmiths

Your email address
Your device identifier
Any profile field you have kept private
Reports you file about another person's note — these are visible only to Koda's own moderation staff, never to the person reported

Your profile is yours to control. Phone number, business name, website and bio each have an individual privacy switch. Switched off, the field is not shown to other users — it is withheld at the source, not merely hidden in the app.

Who else processes your data

Koda uses a small number of service providers. We do not sell personal data, and we do not share it for advertising.

Provider	What it handles
Google Firebase (Google LLC)	Sign-in, database, file storage and server functions. This is where your account and contributions are stored.
Stripe	Reserved for future paid features. Koda is free and Stripe is not currently used; if that changes, Stripe would handle card details directly and Koda would receive only whether a subscription is active.
Brevo	Sending account emails, such as a password reset.
Cloudflare R2	Hosting vehicle images in the catalogue.

Data is stored on servers operated by these providers, which may be outside your country. They are bound by their own contractual and legal obligations to protect it.

How it is protected

The offline catalogue on your device is stored in an encrypted database, and its key is held in your device's own secure keystore.
Traffic between the app and our servers is encrypted in transit.
Access to stored data is restricted by server-side security rules, so one locksmith cannot read another's account, and reports about a note are not readable by other users.

How long we keep it

Your account — for as long as it exists. You can delete it yourself at any time from Settings in the app.
Your contributions — these form the shared catalogue that other locksmiths rely on, so they are kept as part of it. See below for what happens when you delete your account.
Reports about notes — once a report is decided, the copy of the reported text is deleted. Only the fact of the decision is kept.

Your rights, and how to use them

Seeing or correcting your data

Your profile is editable in the app at any time. For anything else, email support@kodadb.com and we will provide a copy of what we hold about you.

Deleting your account

You can request deletion of your Koda account and its personal data at any time, whether or not you still have the app installed:

In the app — Settings, then Delete account.
By email — write to support@kodadb.com from the address on your account, asking for deletion. We will action it within 30 days.

What deletion removes, and what it does not. Deleting your account removes your personal details — name, email, phone, profile fields, profile picture and device identifier.

Technical corrections you contributed to the shared catalogue — a transponder value, a blade reference, a remote entry — remain, because other locksmiths depend on them at a vehicle and removing them would degrade the data everyone relies on. They are disconnected from your identity so they are no longer attributable to you.

Withdrawing consent and complaints

You may contact us to object to how your data is handled. If you are in a region with a data protection authority — such as the EU, the UK or Australia — you also have the right to complain to it.

Children

Koda is a professional tool for working locksmiths and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes to this policy

If this policy changes in a way that materially affects you, we will tell you in the app or by email. The date at the top of this page always shows the current version.

Contact

Questions, requests or complaints: support@kodadb.com