Privacy Policy

Last updated: 2026-11-09

roadlet is not released yet. This page describes the app as it is designed to be in its first version, and it changes with the app. Where something is planned and not built, it says so.

This policy explains what the roadlet Android app (name.gpm.roadlet), a home screen for car head units and car tablets, does with data. It covers the app only.

The short version: roadlet keeps what it reads on your device, on your device. It needs no account. It calls a few outside services to get a photo, the weather and, if you ask, a city, and it talks to a service of ours only if you write to us or sign in. There is no advertising in it. The play build also carries Google’s Firebase Crashlytics (crash reports) and Analytics (usage statistics), which it asks you about once, the first time you open it; the foss build has neither, nor anything else from Google.

There are two builds: play (Google Play) and foss (the family’s own F-Droid repository). Where they differ, this page says which.

Who is responsible

Gabriele Proietti Mattia is the data controller for the processing described here. Contact: apps@gpm.name.

Wallpapers

The home screen draws a wallpaper behind everything: a photo, an animated aurora (on Android 13 and later; a gradient below that), or a gradient. The aurora and the gradient are drawn on your device and call nothing.

Photos are fetched one at a time, and the current one is kept on your device so it shows at once on the next start. Your device’s address reaches whoever serves the photo.

• Both builds (in foss, unless you have pasted a key of your own): photos come through roadlet’s own service, roadlet-app.gpm-apps.com, which keeps the Unsplash key so it is never on your device. The app asks it for a batch of photos (optionally with the search words of the theme in use, or the photo category you chose) at your screen’s size, downloads each one from Unsplash, and tells the service when a photo is actually shown, so that Unsplash can be told. The service sees your device’s IP address, as any server does; it uses it only to keep abuse out, in memory, and stores nothing about you. If the service cannot be reached, the app uses the fallback below.
• foss with your own Unsplash Access Key, pasted in Settings (optional): roadlet asks Unsplash (api.unsplash.com) directly for photos, downloads them from Unsplash, and tells Unsplash when a photo is actually shown, as Unsplash’s guidelines ask. The key stays on the device and is sent only to Unsplash. roadlet’s service is not called for photos.
• As the fallback in both builds: Lorem Picsum, which needs no key and serves Unsplash photos. roadlet asks it for a list of photos and downloads one.

The photographer is named on screen and linked back to Unsplash.

None of these requests carries your name, your address or anything else about you. What you search for in the weather, the apps you have and what is playing are never sent with them.

Themes

A theme sets a wallpaper, colours and layout, and is only data. Settings, Themes lists the themes on your device and a catalogue written by the community. The catalogue is downloaded from roadlet.gpm-apps.com only when you open the Themes screen, never at startup or in the background, and it is hosted on GitLab Pages, so GitLab sees the request like any web server does. Nothing about you is sent with it: no account, no identifier, nothing from your device. If you install a theme, its file is downloaded from the same place and checked before use. Installed themes are kept on your device and removed when you remove them or uninstall the app. Both builds use the catalogue.

Weather

The weather widget asks Open-Meteo (api.open-meteo.com, and geocoding-api.open-meteo.com to find a city by name). Weather data is by Open-Meteo, under CC BY 4.0, and is credited in Settings. Nothing is requested until you have chosen a city.

• Choosing a city. You type a name; that name goes to Open-Meteo’s search. No location permission is asked or used. The chosen city, with its coordinates, is kept on your device.
• Each forecast sends the city’s coordinates to Open-Meteo. It refreshes about every 30 minutes, only while the home screen is showing, and the last answer is kept on your device.
• Estimating the city from your internet connection. The first time you open the weather screen with no city, roadlet offers to estimate one from your IP address, and asks again only when you ask. Nothing is called until you accept.
  • foss: the estimate comes from GeoJS (get.geojs.io), which sees your IP address and answers with an approximate city.
  • play: the estimate comes from roadlet’s own service, roadlet-app.gpm-apps.com, so that no third party sees your IP address. It reads the approximate location that Cloudflare derives from the address, in the visitor-location headers it adds to the request, and answers with a city, without logging or storing the address. This build never calls GeoJS.

Saved places and navigation

You can save places (Home, Work and a few more) with a name and an address or coordinates. They are kept on your device only and are sent nowhere. When you tap one, roadlet hands the destination to the navigation app you chose, through Android, and from then on that app’s own policy applies. roadlet draws no map and does not follow where you go. Syncing places between devices belongs to Pro, which is planned and not built.

The network strip

The strip in a corner says whether you are on Wi-Fi (with its signal), on mobile data, on a VPN or offline, and whether the network has internet. It reads that from Android and sends nothing. It does not read the name of your Wi-Fi network, and no location permission is used.

Now playing

The Now playing card shows what is playing in any app and lets you pause or skip. To list the active media sessions Android requires notification access, so roadlet declares a notification-listener service. It is used for that and for nothing else: roadlet does not read, store or show your notifications. You turn it on yourself in the system’s settings, after a screen in the app that says this, and you can turn it off there at any time.

What the card shows (title, artist, artwork, progress) is read from the media session and drawn on your device. It is sent nowhere.

Modules

A module is a separate app made by somebody else that adds a card to the home screen. Modules are off until you turn each on in Settings, where roadlet lists them with the app that installed them. Only enabled modules are contacted, and only while the home screen is showing. What a module sends roadlet is drawn on the screen; roadlet sends a module nothing about you. Pictures a module points to are fetched from the address it gives (an https address or one of its own), so that module’s author can see that request. What a module does on its own is covered by that module’s own policy, not this one.

Your apps

The dock and the list of all apps are built from the apps your device lists as launchable. roadlet asks Android for that list, filtered to the launcher categories, and does not request the permission that lists every installed app. The list, and which apps you put in the dock, stay on your device.

Writing in, signing in and licences

Info has a screen for sending a report (a bug or an idea) and a sign-in. Both are optional and nothing is sent until you write something and press send, or ask for a code.

What a report carries

• What you wrote: whether it is a bug or an idea, the title and the description.
• What makes it fixable: the app’s version, your Android version, and your device’s manufacturer and model.
• Your email address, only if you type one. Without it a report is anonymous and cannot be answered.
• The IP address it was sent from, stored with the report and seen only by the moderator.
• A fingerprint of your device, made from its Android ID (Settings.Secure.ANDROID_ID), which the app reads without any permission. Android gives every app its own value. The service keeps only a keyed one-way hash of it, and uses it to keep abuse out: if a device is used to send abuse, the author can stop reports coming from that device, without knowing who you are. The same fingerprint accompanies the sign-in and the licence check.

No log and no screenshot are attached, and none can be. Never the advertising id, and no install id of our own.

All of this goes to apps-management.gpm.name, the family’s service, run by the author. It is not shared with anyone, not used to build a profile and not published.

Signing in

Signing in exists so that a licence granted to your address finds your device. There are two ways to prove an address:

• an address and a six-digit code, sent to that address, in both builds;
• Google, in the play build only, where the device offers it (many head units have no Google services). The app asks Google for an ID token and sends it to our service, which checks it with Google’s own keys and keeps your email address and your Google account id (an identifier Google gives your account). The app reads no name, no picture and nothing else from your Google account.

Once the address is proved the app keeps a key. It hangs from the address, not from your device; it works for roadlet only; the service stores a one-way hash of it, not the key; it stops working after a year without use; and Sign out withdraws it at the service as well as on the device.

The licence check. When you are signed in, the app asks the service whether your address holds a licence, each time it starts. The request carries the key and nothing else; the answer is a yes or a no, and “cannot say” (offline, or a key the service no longer recognises) changes nothing on your device. Where nobody has signed in, nothing is asked.

Pro, and syncing between devices

Everything in the app is free today. A paid Pro tier, which would keep your configuration (installed themes, dock, places, widgets, wallpaper settings) in step between devices, is planned and not built. It would go through roadlet’s own service, and this page will describe it the day it exists.

Donations (foss only)

The foss build sells nothing. It shows a weekly reminder to donate, which is a local notification created on your device (it needs the notification permission, and no server is involved), and Info shows donation links as QR codes. It stops for good once a donation is proved to us by an address. You can silence it in two taps. The play build has none of this.

What stays on your device

Your settings (including your two diagnostics answers in play), the city you chose, your saved places, the dock, the themes you installed, your Unsplash key (foss), the cached wallpaper and weather, and your sign-in key. Uninstalling the app removes all of it. Android’s backup may copy app data, as for any app that does not opt out.

Permissions

These are the permissions in each build’s merged manifest.

Both builds:

• INTERNET, to call the services above.
• ACCESS_NETWORK_STATE and ACCESS_WIFI_STATE, for the network strip (they do not read your network’s name).
• POST_NOTIFICATIONS, to tell you when someone answers a report you sent while signed in, and in foss also for the donation reminder. Android asks you before any notification is shown.
• RECEIVE_BOOT_COMPLETED, FOREGROUND_SERVICE and WAKE_LOCK, from Android’s WorkManager library. While you are signed in, it checks every six hours whether a report of yours has an answer, and keeps that schedule across a restart. Signed out, the check does nothing and sends nothing.
• name.gpm.roadlet.permission.BIND_MODULE, roadlet’s own permission that lets only roadlet bind a module.
• name.gpm.roadlet.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION, added by an AndroidX library and held only by roadlet itself, so that the app’s internal broadcasts stay inside the app.

play only, added by Google’s libraries and not used by the app for anything of its own:

• com.android.vending.BILLING and com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE, from Google Play’s billing library (nothing is sold today).
• com.google.android.gms.permission.AD_ID, android.permission.ACCESS_ADSERVICES_AD_ID and android.permission.ACCESS_ADSERVICES_ATTRIBUTION, which Firebase Analytics brings so that it can read the Advertising ID (see Diagnostics). roadlet shows no advertising.
• WAKE_LOCK is also requested by Firebase, so a crash or statistics report can be sent in the background.
• USE_BIOMETRIC and USE_FINGERPRINT, from a Google library, never used: roadlet has no biometric prompt.

The notification-listener service described above is not a permission the app can grant itself: you enable it in the system’s settings. There is no location permission in this version.

Diagnostics: play build only, on until you say otherwise

The foss build has no diagnostics at all: it does not link Firebase or any Google library, and nothing in it sends crash reports or statistics. If it crashes, nothing is sent: the only way anything about a problem reaches Gabriele Proietti Mattia is the report you write yourself.

The play build carries two of Google’s Firebase services, and both start on. The first time you open the app it asks one question, with the two switches in it and what each sends; you can turn either off right there, and that takes effect before a session has been recorded. They stay in Settings, Diagnostics afterwards.

• Crash reports. If this is on and the app crashes, Firebase Crashlytics receives the stack trace, the device model, the Android version, the app version and an installation identifier Crashlytics generates. It does not include what you wrote, your city, your places, your apps or what is playing.
• Usage statistics. If this is on, Firebase Analytics records which features are used (which screen was opened, which setting was changed), together with the identifiers it collects by default: an app-instance identifier, the device model, the Android version, a coarse region from the IP address, and the Android Advertising ID, a cross-app identifier Google gives your device. roadlet shows no advertising; the identifier comes with Analytics, and the Play Console is told so. It never records what you wrote.

Turning a switch off stops that collection from then on. What was already sent is held by Google under its own terms (Firebase privacy).

What the app never does

• No account that you need, and no sign-up.
• No sale or sharing of data with anyone, apart from the services named on this page that carry out the requests above.
• No advertising, and no tracking of what you do across other apps. The only identifier of that kind is the Advertising ID that Firebase Analytics collects in the play build while usage statistics are on (see Diagnostics).
• No reading of your notifications, of the screen, or of what you type.
• No sending of your apps, your saved places or what is playing, to us or to anyone.

Legal basis (GDPR)

For readers in the EU/EEA and the UK: the reports you send and the address you prove rest on your request and consent; you may ask for them to be deleted at any time. The play build’s diagnostics rest on your consent (Article 6(1)(a)), given by leaving the two switches on after the question the app asks before you use it; withdraw it by turning them off in Settings. The calls to Unsplash, Picsum, roadlet’s photo and location service, the theme catalogue, Open-Meteo and GeoJS rest on your use of the features that need them, and you can avoid each by not choosing it. Keeping the IP address and the device fingerprint with a report, to keep abuse out, rests on a legitimate interest (Article 6(1)(f)).

Retention

A sign-in key stops working a year after you last use it, and is withdrawn the moment you press Sign out. Reports are kept while they are useful: an open one until it is answered, a closed one as the record of a decision, with the IP address and the device fingerprint for as long as the report is kept. Crash reports and statistics sent to Firebase are kept by Google under the Firebase terms, not by us. The photo, weather, city and places data on your device stay there until you change or delete them, or uninstall.

Your rights, and deleting your account

Under the GDPR you may request access to, correction of, or deletion of your personal data. To have your address and everything that hangs from it deleted, follow Delete your account, or write to apps@gpm.name from the address you signed in with. It is done within 30 days. You retain the right to lodge a complaint with a supervisory authority. The outside services keep their own records of the requests they receive; ask them.

Children

roadlet is not directed at children under 13 and knowingly collects no data from them, or from anyone.

Changes

Material changes will be published on this page with a new date, and significant ones will be noted in the app’s changelog.

Last updated: 2026-11-09