Privacy Policy
Last updated 30 August 2026
MercLight is an app for controlling the lighting of a Mercedes-Benz vehicle you own, over a Bluetooth OBD adapter. This policy describes every category of data the app processes.
We show no advertising, use no analytics or attribution SDK, and do not track you across other apps or websites. There is no account to create, no email address collected, and no password.
What is collected
| What | Why | Where it goes |
|---|---|---|
| A random per-install device identifier | To issue the credential that authorises your app to request an unlock, and to carry your purchase | Our own server only. It is generated on your device, is not an advertising identifier, and is not shared with anyone. |
| Your vehicle's VIN | To identify the model so the right lighting profile is used and, if you buy, to attach your purchase to that specific vehicle | Our own server. A shortened, non-identifying descriptor is also sent to the U.S. National Highway Traffic Safety Administration's public vPIC service to decode the model. |
| A security challenge value from the car's control unit | The unlock response is computed on our server, not in the app | Our own server only. |
| Purchase receipts | To verify with Apple or Google that a purchase is genuine | Our own server, and the store that issued the receipt. |
| Diagnostic logs | Troubleshooting | They stay on your device unless you choose to export or send them. Identifiers are masked before they are written. |
What is never collected
- Your location. The app requests no location permission on Android 12 and newer, and declares its Bluetooth scan as never used to derive location.
- Your contacts, photos, calendar, microphone, or camera.
- Any advertising identifier.
Who else receives data
One third party: the NHTSA vPIC service, a public database run by the U.S. Department of Transportation, which decodes a vehicle descriptor into a model name. It receives a shortened descriptor, not your full VIN. Apple and Google receive purchase information as the operators of their own stores.
Where data is stored
On your device, and on a server we operate. Your device credential is held in the operating system's keystore (Keychain on iOS, Keystore on Android). The app excludes its stored settings from Android's cloud backup, so your saved vehicles do not leave the phone that way.
How long it is kept
Device registrations and purchase records are kept while your installation is active. You can erase all of it at any time; see Delete account and data. Deletion is immediate and cannot be undone.
Children
MercLight is not directed at children and is not intended for anyone under 13.
Your rights
You can obtain a copy of what we hold, correct it, or erase it, by using the in-app deletion described above or by writing to support@merclight.app.
Changes
If this policy changes materially, the updated date above changes and the new version is published here before it takes effect.