Privacy notice

About this notice

1. MQBone is made by MQBau Engineering of Australia ("MQBau", "we", "us", "our"). We're responsible for the personal information described in this notice.
2. This notice covers the MQBone app for iPhone, iPad and Mac, including CarPlay, Siri, ECU Controls, Advanced Diagnostics and Tuner PINs; this website at mqbone.app; MQBadapter, our OBD-II adapter, and orders for it; and portal.mqbone.app, for tuners and for website purchases (together, "MQBone").
3. It doesn't cover Apple, your tuner, the community Discord, your email provider or anyone else who runs their own service under their own privacy policy.
4. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. "Personal information" means information about an identified or reasonably identifiable person. A VIN, together with your account, can be personal information, and we treat it as such.
5. Questions about this notice or about information we hold go to support@mqb.au.
6. Using MQBone means you agree to our terms of use. This notice explains how we handle information under them.

Information that stays on your devices

1. Most of what you create in MQBone stays on your devices and isn't sent to MQBau, except as described in this notice. This includes:
   1. datalogs: the CSV files you record or import, including position and speed if the log contains them;
   2. scan and fault-code history, and Advanced Diagnostics scan reports and module backups;
   3. imported PID files;
   4. flash settings, counters and recent files; and
   5. diagnostic traces of flash and unlock operations. A copy is also sent to us (clause 11).
2. There's no MQBau server backup of this data. Deleting the app or its data removes it, and we can't restore it. You're responsible for copying out anything you want to keep.
3. If you share a log or file from the app, it goes where you send it, under that service's terms.

iCloud sync

1. If you're signed in to iCloud, MQBone syncs some data through Apple's iCloud key-value storage to your other devices on the same Apple Account:
   1. your saved vehicles, including their VINs, with their name, model, gearbox and part numbers;
   2. each vehicle's logger, gauge and CarPlay setup;
   3. your Home layout, theme and accent colour; and
   4. the last adapter you used and its Auto-Connect setting.
2. This data is held by Apple in your iCloud account. MQBau can't see it. Logs, scan history, imported PID files and diagnostic traces aren't synced.
3. To stop syncing, turn off iCloud for MQBone in your device's iCloud settings. Removing a vehicle in the app, or using Reset MQBone, removes it on every device on that Apple Account. Apple's privacy policy covers how iCloud stores it.

Permissions the app asks for

1. Each permission is optional and is asked for by the system when a feature needs it. Declining one turns that feature off. The rest of the app keeps working.
   1. Bluetooth: to connect to the MQBau adapter. Without it the app can't connect to a vehicle.
   2. Location: for Home widgets (weather and motion) and for logging parameters such as position and GPS speed. Location is used on your device and saved only into logs you record. It isn't sent to MQBau.
   3. Motion: for the Motion widget and selected logging parameters, on your device only.
2. The weather widget asks Apple's weather service (WeatherKit) for conditions at your location. Apple handles that request under its own policy.
3. You can change any permission later in Settings for MQBone, or on a Mac in System Settings → Privacy & Security.
4. Siri. If you use Siri, Apple handles your voice request under its own terms. MQBone receives only the action you asked for, such as "switch to map 2".
5. CarPlay. CarPlay shows the app on your car's screen. It doesn't send anything extra to MQBau.

Your MQBone account

1. MQBone uses Sign in with Apple in the app and at portal.mqbone.app. That site has the tuner portal and the pages for buying and managing website purchases. This website has no sign-in.
2. From Apple we receive an identifier for your Apple Account, and your name and email address if you choose to share them. The email may be an Apple private relay address. We store your email only if Apple says it's verified.
3. We use this to create and hold your MQBone account and the activations linked to it. We also keep a sign-in credential from Apple, encrypted, so we can revoke it with Apple when you delete your account.
4. If you use a private relay address, email us from an address you can receive replies at when you need support.

Purchases

1. Apple takes payment for in-app purchases. We receive purchase information from Apple, such as the product bought, transaction identifiers, whether a purchase is completed, pending or refunded, and for a subscription its renewal and expiry dates, so the app can grant and keep the matching activation.
2. We never receive your full card or bank details. In-app purchases are paid to Apple. Activations, Advanced Diagnostics subscriptions and MQBadapter bought on our website are paid to Stripe (clause 7). portal.mqbone.app sends you to Stripe to pay and never sees your card details.

Buying on our website (Stripe)

1. When you buy a VIN activation or an Advanced Diagnostics subscription on our website, the Buy button takes you to portal.mqbone.app, where you sign in with Apple, and then to a checkout page run by Stripe on Stripe's own website. MQBadapter's Buy button goes straight to Stripe. Stripe collects your payment details, name, email address, shipping and billing address, and phone number if you give it, and handles them under its privacy policy. Stripe may set its own cookies on its checkout page.
2. From Stripe we receive your order: your name, email address, shipping and billing address, phone number if given, what you ordered, the amount and tax, the payment status and Stripe's reference numbers. We don't receive your full card number.
3. Your activation or subscription is linked to the MQBone account of the Apple Account you signed in with, not to an email address. We give Stripe an identifier for that account (and, for an activation, the VIN you entered) so the payment can be matched to it. Stripe asks for an email address for your receipt. We don't use it to link your purchase.
4. MQBone TestFlight beta. If you buy from the beta app, we record a link between your beta account and the Apple Account you signed in with, so your purchases work in both apps. Deleting either account removes the link.
5. Subscriptions. To renew a subscription each year, Stripe keeps your payment method on file. We never see or store it. From Stripe we receive the subscription's status, renewal date, payments and cancellation, so we can turn Advanced Diagnostics on or off and email you about renewals and price changes.
6. We use this to grant activations and subscriptions, to confirm, pack and deliver MQBadapter orders, keep you updated about it, handle faults, returns, refunds and guarantee claims, prevent fraud, and keep the tax and accounting records the law requires.
7. For MQBadapter orders, we give your name, shipping address, phone number and email address to the delivery carrier that takes your parcel, so they can deliver it and contact you about it.
8. We don't use your order details for marketing, and we don't add you to a mailing list. If we ever offer one, you'll have to opt in.

MQBadapter

1. MQBadapter passes messages between your car and MQBone. It doesn't keep a record of your driving or your vehicle's data.
2. To be found by your devices, MQBadapter advertises over Bluetooth with a name like MQBau_XX:XX:XX, made from part of its Bluetooth address. Nearby Bluetooth devices can see this name while it's powered.
3. MQBadapter's firmware updates are downloaded through our servers, which receive the request like any other request to our backend (clause 14).
4. The adapter's details, such as its type and firmware version, are included in diagnostic traces (clause 11).

Vehicle information we receive

1. When a VIN is activated, and when a new recording, a flash, an unlock or a recovery is prepared, the app sends us the VIN and controller information, such as controller identifiers and software identification. We use it to check your account and activation and to prepare the correct operation for that controller.
2. We store the VIN and the controller's original part number, software, bootloader and hardware versions, when we first saw it, and whether it was unlocked.
3. Activation records are kept against your account so your purchases can be recovered and support can help you.
4. VIN and controller details also come up when you ask us for support, or when we look into a purchase or activation problem for you.

Advanced Diagnostics

1. Advanced Diagnostics needs an active subscription. When you open it, the app checks your subscription with your MQBone account.
2. Advanced Diagnostics uses our online diagnostics service while you're signed in. It sends the identification each module reports, such as its part number and software and hardware versions, and the fault codes it reads, so the service can return the matching descriptions and coding data.
3. Scan reports and module backups stay on your device (clause 2).

Diagnostic traces

1. Each flash, unlock, recovery and adapter firmware update records a trace of the messages exchanged with the controller. It's redacted: flash file contents, security seeds and keys are never written. Traces are kept on the device, the last ten at a time, under Settings › Data › Diagnostic Traces, where you can share or clear them.
2. When you flash, unlock or update an adapter, the app sends us a technical log of that operation (controller and adapter details, the VIN and the messages exchanged, without your tune file or security keys). We use it to find and fix problems.
3. Each log also includes the app version, device model and operating system version, and the result of the operation, so we can tell which setups have problems.
4. We keep these logs for 30 days, and they're erased if you delete your account.

Tuner PINs and remote tunes

If your tuner sends you a PIN

1. To make a PIN, your tuner has added you to their client list in the tuner portal, with a name, your vehicle's VIN and any notes they keep, and has uploaded a tune for that VIN. Your tuner is responsible for having your permission to do so.
2. When you enter the PIN we record that your account claimed it, and each flash or recovery attempt made with it. Your tuner can see when the PIN was claimed and used.
3. The tune is sent to the app encrypted and kept in memory only for the flash. It isn't stored on your device or in iCloud. The app uses Apple's App Attest to confirm each request comes from a genuine copy of MQBone. Its key stays on the device and is removed when you sign out or delete your account.

If you're a tuner

1. We store your account, your client list (name, VIN and notes for each client), the tune files you upload, encrypted, the PINs you issue and the history of each PIN's use.
2. You're responsible for your clients' information: having their permission to hold their details and upload a tune for their vehicle, keeping your notes accurate and appropriate, and complying with privacy law in how you collect and use it.

The portal

1. portal.mqbone.app is where tuners and MQBau work, and where website purchases are made and managed. Tuners sign in with Apple and apply for a tuner account, and MQBau approves each one. Buyers sign in with Apple only to buy or manage a purchase.
2. The portal sets two cookies. Both are strictly necessary for signing in, restricted to the portal, sent securely and unreadable by scripts in your browser:
   1. Sign-in flow cookie: set only while you're signing in with Apple, to tie Apple's answer back to the request that started it. It lasts at most five minutes.
   2. Session cookie: keeps you signed in. Behind it, the portal keeps your sign-in tokens (encrypted), your name and your email address, until you sign out or the session expires after 30 days.
3. While you buy, the portal keeps your choice (product, VIN and any link from the beta app) in your browser's session storage for up to 30 minutes. It's removed when you close the tab.
4. MQBau staff use the portal to run the service and help with support. They can see accounts, vehicles, activations, diagnostic traces and an audit log of changes. Access is limited to people MQBau authorises.

This website and our servers

1. mqbone.app has no sign-in and sets no cookies. It has no analytics, advertising or tracking, and loads nothing from third parties. The MQBadapter Buy button takes you to Stripe's own website. The activation and subscription Buy buttons take you to portal.mqbone.app and then to Stripe (clause 7).
2. Cloudflare serves the website, the portal and our backend, and sees normal request data, such as your IP address, browser or app version, and the time of each request. Our servers keep short-lived technical logs of requests and errors for security and troubleshooting.
3. The email links on this site open your own mail app. Nothing is sent until you press Send.
4. Crash reports. If you've chosen in your device's settings to share analytics with app developers, Apple may give us crash and energy reports for MQBone. They don't identify you to us.

Email and community

1. If you email support@mqb.au, we keep your message, any attachments and our replies so we can answer you and handle any follow-up.
2. Please don't send card numbers, passwords or other information we haven't asked for. We don't need them.
3. The community Discord is optional. If you use it, what you post is visible to other members and handled by Discord under its own terms.

How we use information

1. We collect information directly from you, from your devices and vehicles through the app and MQBadapter, from Apple (sign-in and purchases), from Stripe (orders on our website), and from tuners (Tuner PINs). We use it only to:
   1. provide MQBone, your account and its features;
   2. check and record activations and purchases, and restore them;
   3. sell activations on our website, and sell, deliver and support MQBadapter, including faults, returns and guarantee claims;
   4. prepare and carry out operations for the correct vehicle and controller;
   5. run Tuner PINs and the tuner portal;
   6. find, fix and prevent problems, failed operations and misuse;
   7. keep MQBone and our users secure, and enforce our terms;
   8. answer support requests; and
   9. comply with the law and respond to lawful requests.
2. What we don't do: we don't sell or rent personal information. We don't use it for advertising, don't track you across other apps or websites, don't send marketing email, and don't make decisions with legal or similarly significant effects about you by automated means alone.

Who we share information with

1. We share personal information only:
   1. with service providers who process it for us (clause 18);
   2. with your tuner, when you use a Tuner PIN they issued (clause 12);
   3. with Apple, as part of Sign in with Apple, purchases and the platform features you use;
   4. with Stripe, which takes payment for orders on our website, and with the delivery carrier that delivers an MQBadapter order (clause 7);
   5. where the law requires or allows it, for example to respond to a court order or a request from a regulator or law enforcement agency;
   6. to protect the rights, safety or property of MQBau, our users or others, including to investigate misuse; and
   7. to a buyer or successor if all or part of the MQBone business is sold or transferred, who must keep handling it in line with this notice.

Service providers and overseas disclosure

1. Cloudflare hosts this website, the tuner portal and the MQBone backend: account, activation and vehicle records, encrypted tune files, diagnostic traces and the Advanced Diagnostics service. Cloudflare's privacy policy.
2. Apple provides Sign in with Apple, in-app purchases, iCloud sync, WeatherKit, App Attest, Siri, CarPlay and crash reports. Apple's privacy policy.
3. Stripe takes payment for orders on our website, for MQBadapter and activations, and holds order records. Stripe's privacy policy.
4. Delivery carriers, such as Australia Post or a courier, deliver MQBadapter orders.
5. Our email provider handles messages sent to support@mqb.au.
6. These providers run global networks, so information we hold may be stored or processed outside Australia, including in the United States, the European Union and other countries where they operate. We choose providers with strong security and privacy commitments, and take reasonable steps so they handle information consistently with the Australian Privacy Principles.

Security

1. We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include encrypting information in transit, encrypting tune files and stored sign-in credentials, short-lived sign-in sessions, and limiting staff access to people MQBau authorises.
2. No system is completely secure, and we can't guarantee the security of information sent over the internet.
3. You're responsible for keeping your devices, Apple Account and MQBone account secure, including using a passcode and keeping your software up to date.
4. Data breaches. If a data breach is likely to cause serious harm to the people involved, we'll notify them and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

How long information is kept

1. We keep personal information only as long as we need it for the purpose it was collected for, or as the law requires, and then delete or de-identify it:
   1. diagnostic traces sent to us: 30 days, or until you delete your account;
   2. account and activation records: while they support your access to the app and the recovery of purchases. Deleting your account removes them (clause 21);
   3. sign-in sessions: an access token lasts 15 minutes and a refresh token 30 days. The encrypted Apple credential is kept until you delete your account;
   4. controller details for a VIN: while any account holds an activation for that VIN;
   5. Tuner PINs: a PIN stops working after 30 days, or sooner if its attempts are used up or the tuner withdraws it;
   6. tune files and client lists: until the tuner deletes them, or deletes their account;
   7. server logs: kept briefly for security and troubleshooting;
   8. Website orders (MQBadapter, activations and subscriptions): for at least five years after the order, as Australian tax law requires, and for as long as a guarantee claim about it remains possible;
   9. support correspondence: while it's needed for your enquiry and any follow-up; and
   10. records we're required to keep, such as legal, tax, accounting and security records: as long as those obligations require.

Deleting your account

1. You can delete your MQBone account in the app. For your security it asks you to sign in with Apple again immediately beforehand. The practical steps are in deleting your account.
2. Deletion revokes your sessions in the app and the portal, revokes your Apple sign-in credential with Apple, removes the VIN activations held on that account and erases the diagnostic traces sent from it.
3. Any Tuner PIN you claimed is released and stops working. If you're a tuner, your client list, tunes and PINs are deleted, along with the tune files.
4. A controller's original details for a VIN are kept only while another account still has an activation for that VIN. Records we're required to keep by law are kept for as long as that requires.
5. Deletion doesn't refund anything, doesn't remove anything on your devices or in your iCloud account, and doesn't move purchases to another account. Refund requests for Apple charges go to Apple: reportaproblem.apple.com.

Your rights: access, correction and complaints

1. You can ask us for access to the personal information we hold about you, to correct it, or to delete it, by emailing support@mqb.au. Tell us the Apple Account email or relay address you use so we can find the right account. We may need to verify your identity before acting on a request.
2. We'll respond within a reasonable time, usually 30 days. If we can't do what you ask, we'll tell you why, unless the law prevents it.
3. You can use MQBone's website without identifying yourself. The app needs an account for features that check activations.
4. Complaints. If you're unhappy with how we've handled your information, tell us first and we'll work through it with you. If you're not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au.
5. Outside Australia. If you're in the European Union, the United Kingdom or another place with its own privacy laws, you may have further rights, such as to object to or restrict processing, to data portability, or to complain to your local regulator. We process your information to provide the service you asked for (performing our contract with you), for our legitimate interests in running, securing and fixing MQBone, and to comply with the law. Contact us to use these rights.

Children

1. MQBone is for adults. It isn't directed at children, and we don't knowingly collect information from anyone under 18. If you think a child has given us information, contact us and we'll delete it.

Your responsibilities

1. You're responsible for the information you give us being accurate, and for having the right to give it to us, including the VIN of any vehicle you use MQBone on.
2. If you use MQBone on someone else's vehicle, you're responsible for having the owner's permission, including for their vehicle's information being handled as this notice describes.
3. If you're a tuner, you're responsible for your clients' information as set out in clause 12.
4. You're responsible for any logs, files or traces you choose to share from the app, and who you share them with.

Changes to this notice

1. We may update this notice as MQBone changes. We'll publish the new version on this page with a new date, and where a change is significant we'll take reasonable steps to let you know.
2. Continuing to use MQBone after a change means the updated notice applies.

Contact

1. MQBau Engineering, Australia. Email: support@mqb.au.