Privacy Policy

Ikolvi is a software development studio. For anything in this policy — questions, access requests, complaints — we are the data controller and you can reach us at hello@ikolvi.com.

One policy, because we run one set of rules. What differs between products is how much data each one needs, so every clause below applies only to the apps it names.

Anything we publish in future is covered by the same rules and will be added here before it ships.

We collect only what a feature actually needs to work. Nothing here is sold. Each row names the apps it applies to; if your app is not named, that category does not apply to you.

We do not collect your precise or background location, your contacts, your messages, your photo library, or any special category data such as health or biometric information.

Simple Mileage Tracker works without an account — signing in is what enables cloud backup and syncing between your devices. Link2Basket needs one, because the work happens on our servers rather than on your phone.

The app is offline-first. Everything it does — logging a fill-up, calculating mileage, drawing the charts — runs against a database stored locally on your phone and works with no network connection at all.

• Without an account: your data never leaves your device, except when you deliberately use a camera or voice feature, and except for the ad requests the free tier makes.
• With an account: your vehicles and entries are also stored in our Supabase database so they survive a lost phone and appear on your other devices.
• Paid tiers: the ad-free subscription stops ad requests entirely. The premium subscription additionally enables voice and camera logging, which are the only features that send content off your device by design.
• Uninstalling removes the local database with the app. It does not delete a synced copy — use our deletion form for that.

Link2Basket is a server-backed app and needs an account, because resolving a link happens on our servers rather than on your phone. Signing in is via Google only, and we receive your email address, name and profile picture from Google as part of it.

• What we do with a link you share: we normalise it, then read what the platform publishes about it — through the YouTube Data API for YouTube, or by fetching the public page for Instagram, TikTok and merchant sites. That title, description and thumbnail go to Anthropic's Claude API, which identifies the product. Nothing about your account is sent to any of them.
• Results are cached and shared. A resolved link is stored against the link and your country, not against you, so the next person who shares the same link gets the stored answer instead of a fresh lookup. The cache holds public page metadata and the product we extracted — never your identity — and it is not deleted when an account is. Treat anything you share into the app as a public URL, because that is what it is.
• How we make money: the buyable links we return carry an affiliate tag, so if you buy something we may earn a commission from the merchant at no extra cost to you. To reconcile that, we log each tap-through — merchant, destination, country, time and your user ID — as described in section 3.
• What it does not do: no ads, no advertising identifier, no in-app purchases, no camera, no microphone, and no access to your location beyond the country you pick yourself.

• To provide the features you asked for — storing what you save, syncing it, and resolving the links or images you send us.
• To keep your account secure and to authenticate you.
• To process subscriptions and honour what you have paid for.
• To show ads in free tiers, and to stop showing them the moment you subscribe.
• To attribute purchases made through the links we hand you, so the affiliate commission that funds the app can be reconciled and fraudulent traffic spotted.
• To cache the result of resolving a public link, so the same link does not have to be fetched and interpreted again for the next person who shares it.
• To diagnose crashes and faults, and to prevent abuse of our endpoints.
• To comply with legal, tax and accounting obligations.

We do not use your data to train AI models, we do not build advertising profiles of you ourselves, and we do not sell or rent personal data to anyone.

Where the GDPR or similar law applies, we rely on: contract for the data needed to run an account, resolve what you asked us to resolve and deliver a paid feature; consent for personalised advertising and for optional camera and voice features, which you can withdraw at any time; legitimate interests for security, fault diagnosis, preventing abuse and reconciling affiliate commission; and legal obligation for records we are required to keep.

Only the service providers that make the apps work, each handling data on our instructions and for no purpose of their own. This list is exhaustive for the apps named above.

We may also disclose data where we are legally required to, or to establish or defend legal claims. If Ikolvi is ever acquired, personal data may transfer with the business — you will be told before that happens and this policy continues to apply until replaced.

Our providers operate globally, so your data may be processed in countries other than your own, including the United States. Where data leaves the UK or EEA, transfers are covered by the safeguards those providers offer, such as Standard Contractual Clauses.

Traffic between our apps and our servers is encrypted in transit with TLS, and data at rest is encrypted by our hosting providers. Access to production data is limited to the people who need it. Row-level security rules mean one account cannot read another's records. API keys for third-party services are held server-side and never shipped inside the app.

No system is perfectly secure. If a breach affects your personal data and creates a risk to you, we will notify you and the relevant regulator as the law requires.

• Access — ask for a copy of the personal data we hold about you.
• Correction — have inaccurate data fixed.
• Deletion — have your account and data erased.
• Restriction and objection — ask us to limit or stop certain processing, including advertising.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — at any time, without affecting what was done beforehand.

Exercise any of these by writing to hello@ikolvi.com, or use the data deletion form for erasure. We respond within 30 days. If you are unhappy with our response you can complain to your local data protection authority.

Ads appear only in the free tiers of Simple Mileage Tracker. You can reset or delete your advertising identifier in your device settings (Android: Settings → Google → Ads), which stops ads being personalised against past activity. Any consent you gave for personalised ads can be changed from the app's privacy settings. Subscribing to any paid tier removes ads entirely.

Link2Basket is funded by affiliate commission. The buyable links we show you carry a tag identifying us, and if you buy through one the merchant or an affiliate network may pay us a share. The price you pay is not affected.

Being paid does not decide what we show you: results come from what we could identify in the link you shared and which merchants ship to your country. Once you tap through, you are on the merchant's site and their privacy policy and terms apply, not ours — we have no visibility of what you go on to browse or buy beyond the commission reports the network gives us.

Our apps are not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has given us data, write to hello@ikolvi.com and we will delete it.

We update this policy when what we do changes, including whenever we ship a new app. The date at the top always reflects the current version, and material changes will be announced in the app before they take effect. Continuing to use our apps after a change means you accept the updated policy.

Questions, requests or complaints about this policy go to hello@ikolvi.com. We aim to reply within five working days.