Udal — Privacy Policy

Last updated: 3 November 2026

Who is responsible for your data (the "controller"): UDAL LIMITED, a company registered in England and Wales (company number 17557394), registered office 128 City Road, London EC1V 2NX, United Kingdom. Contact for anything in this policy, including the rights described at the end: privacy@udalapp.com.

The short version

Udal does two things. It keeps track of where your car is and helps you get back to it, and it lets you hand the space on to a driver who needs it when you leave. The first half is just for you and most of it never leaves your phone; the second needs a server, because another person is involved.

• Your parked location is never shown exactly to other users until you accept their request. Until then everyone else sees a point randomised within about 130 metres.
• Your messages are stored on our server in readable form and are not end-to-end encrypted. We can read them. We only do so to investigate a report of abuse, fraud or a disputed handover.
• We do not sell your data, show advertising, or share anything with data brokers.
• Udal works out by itself when you park and when you drive off — it watches your location in the background to do that, and can share your spot with other drivers when it judges you are walking back to the car.
• We do not keep a trail of everywhere you go. What is recorded is where your car parked and when it left, not your journeys. We do work out patterns from those parks — which place is your home, how long you usually stay, how long a trip usually takes — and that is described below.
• The photo and the note you add to a parking spot never leave your phone. They are not uploaded, not attached to the space other drivers see, and are deleted when the car leaves.
• The compass, your parking history and your photo and note all work with no network at all.

What we collect, and why

Account

Username, email address, and an optional profile photo. Sign-in is handled by our own Keycloak server; your password is held there and never by the app. Why: to give you an account and let other drivers see who they are dealing with. Basis: performance of our contract with you.

Vehicle details

Car type and colour, and optionally the last digits of your number plate. Why: so the other driver can recognise the right car at the kerb. Car colour and plate are shown only to a driver whose request you have accepted, and the plate only if you have left that setting on. You can switch plate sharing off at any time in your profile. Basis: performance of our contract; plate sharing is optional and switched off by you.

Location, and how automatic detection works

This is the part of Udal that does the most, so it is worth describing properly.

On iPhone, Udal works out by itself when you park and when you drive away. You do not check in or press anything. To do that it uses, in the background:

• your location, continuously while you are driving and around a parked car;
• your phone's motion sensing — whether it is in a vehicle, walking or still;
• your car's Bluetooth or CarPlay connection, whose disconnection is usually the first sign that you have parked.

From that it records where your car parked, when it parked, and when it left. That is what the map marker and your parking history are made of.

It learns which Bluetooth device is your car. The first time a drive ends with a device disconnecting while stationary, Udal remembers that device's name and identifier so it can tell your car from your headphones or someone else's system. That identifier never leaves your phone — it is not sent to us and we never see it.

It can share your spot with other drivers without you pressing anything. When Udal judges that you are walking back to your car, it marks your spot as about to become free, and from that moment other drivers can see it and request it. It asks you first when it can — but if you do not answer, and it becomes confident you are returning, it publishes anyway. Until that point a detected spot is visible only to you.

Why: this is the service. A parking space cannot be offered without knowing where it is, and the whole point of the detection is that it works while your phone is in your pocket.

Important: other users see a randomised point within roughly 130 metres of the real position until you accept their request. Only then is the exact location released, and only to that driver.

Basis: performance of our contract.

How to stop it: detection needs background location. Removing that permission in iOS Settings → Privacy & Security → Location Services → Udal stops the automatic detection entirely. The app still works for declaring a spot by hand.

Finding your way back to the car

Three things help you back to a parked car, and none of them sends anything to us.

• A photo of the spot, if you take one. The camera is used only at the moment you press the button. The photo is written to this app's own storage on your phone, is never uploaded, is never attached to the space other drivers see, and is deleted automatically when the car leaves. There is only ever one, and it replaces the last. We never receive it and cannot ask for it.
• A note, up to 80 characters — "level 3, blue zone". Same rules: on the phone, never uploaded, gone when the car is.
• A compass pointing at the car. It uses your phone's magnetometer (the sensor that knows which way the phone is facing) together with a position your phone already has. It needs no network, and it sends nothing.

The photo deserves a word about why. A photograph of a street can contain faces and number plates — personal data belonging to people who never installed anything. Keeping it on your device means there is nothing for us to lose, disclose or be asked to hand over.

Why: a coordinate cannot tell you "level 3, bay 47", and a map cannot be drawn with no signal. Basis: performance of our contract. The camera is used only when you choose to use it.

What Udal works out from your parking history

From where and when your car has parked, the server works out some things about your habits:

• Your places — the spots you return to, and which is likely your home and which your weekday place. This is what stops Udal offering to advertise a space outside your own house, or setting a parking reminder where you demonstrably sleep.
• How long you usually stay somewhere, and how long a trip usually takes — which is where "Usually about 7 minutes" in a notification comes from.
• Where you are probably going next, from the place you have just left at this time of day.

Three things are worth being precise about:

• It is worked out fresh each time, not stored. There is no separate table of your habits. It is calculated from your parking history when it is needed, so when that history is deleted after 90 days, everything derived from it goes with it. Nothing survives the data it came from.
• The name of a place never reaches us. The server answers in coordinates. Turning a coordinate into "Τσιμισκή" happens on your phone, and that name is never sent back. A street is a fact about a place; a name you would give it is a statement about what you do there, and we do not want it.
• None of it is shown to anyone else, ever. It exists to make the app quieter and more useful to you. The detection engine does not read it either.

Why: an app that asks you to share a space outside your own front door, or reminds you about a meter on your own driveway, is an app you turn off. Basis: legitimate interests — making the service useful without asking you to configure it. You can stop it by deleting your parking history with your account, or by turning off the reminder and return prompts in your profile.

When spaces free up in an area

Udal also counts, across all drivers, when spaces tend to free up in a given area, so it can say that a street is usually busier at nine than at eleven.

This is a count, not a list: it is built from many drivers' sessions and shows nothing about any one of them. An area is only ever described once enough different drivers have contributed to it; below that threshold Udal says nothing at all, because a "pattern" drawn from one or two people is simply a description of those people.

Basis: legitimate interests.

Diagnostic data from the detection engine

The app keeps a detailed technical log on your phone — positions, speeds, sensor states, and a summary of each trip such as its duration, average speed and how often it stopped. This stays on your device. It is not uploaded. It is only ever shared if you deliberately export and send it to us, which is something you would have to go and do.

What we do send: faults. When the app hits an error, or does something it should not — losing track of a parked car, for instance — it tells our server what happened. That is the name of the fault and a few numbers describing it: an error message, which permission was missing, which code path ran. It carries no location of any kind, so it cannot say where you were when it happened, and the position is stripped on arrival as well as left out on the way.

Why: an app this quiet about its own failures is one where a fault on your phone is something you put up with and we never learn about. We would rather fix it.

And how early it saw you coming back. Each time you walk back to your parked car and drive off, the app works out how early it noticed — for example, "1 minute 17 seconds before you left, 36 metres from the car" — and sends that to our server, with how long the walk was and whether the "leaving soon" signal reached other drivers in time. It is a few numbers about each return: times, and distances from your own car, with no location of any kind. You see your own in your profile, as Heads-up; we look at them only added up across everyone, to know how well detection works and to make it better.

Basis: legitimate interests — keeping the service working.

Your activity list

Profile → Activity lists what happened in the app over the last three days: your parks, the spots you shared, requests and handovers — so it can include the usernames of drivers you dealt with. This stays on your device — in the app on your phone, or in your browser on the website. It is never uploaded, entries older than three days are removed, and the whole list is erased when you log out.

Messages

The messages you exchange with other drivers. Why: to arrange a handover. Basis: performance of our contract. Be aware: these are stored in readable form on our server and are not end-to-end encrypted. Staff access is limited to investigating reports of abuse, fraud, or a disputed handover. Deleting one: press and hold a message you sent and choose Delete. Its text is erased from our server for both of you, and the other person sees "Message deleted" in its place. You can only delete messages you sent.

Handovers and ratings

A record of each completed or abandoned handover — who, when, and whether the person arrived — plus the rating and optional comment each side leaves. Why: a rating is only meaningful if it comes from someone you actually dealt with, and a record of a no-show is what protects the next driver who waits for someone. Basis: our legitimate interest in keeping the service usable and safe for its members.

Usage counters

Spots declared, spots taken, average arrival time, and a percentile rank derived from them. Why: to show how active and reliable a member is. Basis: legitimate interest.

Notifications

A push token for your device, if you enable notifications. Why: to tell you when someone requests your spot or accepts yours. Basis: consent, which you give through the iOS permission prompt and can withdraw there.

Some notifications are made on your phone and never involve our server at all: the parking reminder you set, "Did you park here?", and "Returning to your car?". These are scheduled by the app on the device, which is why they still arrive with no signal.

Who else sees it

• Other users see: your username, photo, member-since date, rating, rank, car type, and the activity counters. They see your approximate parking location; the exact one, your car colour and (optionally) your partial plate only after you accept their request.
• Our hosting provider, Hetzner, whose servers are in the EU. They store the data on our behalf and do not use it.
• Apple or Google Maps, if you tap Navigate — the destination is handed to that app, which is then governed by its own privacy policy.
• Nobody else. We do not sell data, share it with advertisers, or pass it to data brokers.

We will disclose data if we are legally required to, and we will tell you unless we are forbidden from doing so.

How long we keep it

Where your data is

On servers in the European Union, operated by Hetzner, and it stays there. UDAL LIMITED is a UK company; the EU recognises the UK as protecting personal data to an equivalent standard (an "adequacy decision"), so being responsible for it from the UK needs no further safeguards.

Security

Traffic between the app and our server is encrypted in transit (HTTPS). Access to the database is restricted to the people who operate the service. As explained above, message content is not end-to-end encrypted, which means operators are technically able to read it.

Your rights

Under the UK GDPR and the EU GDPR you can ask us to:

• give you a copy of what we hold about you;
• correct anything that is wrong;
• delete your account and data ("right to be forgotten");
• restrict or object to how we use it;
• export it in a portable format;
• withdraw consent for anything based on consent, such as notifications, at any time.

You can delete your account yourself, at any time, from Profile → Delete my account. For anything else, write to privacy@udalapp.com and we will respond within one month.

What deleting your account actually does:

• Your account, profile, vehicle details and photo are erased, and your sign-in is removed so the account cannot be recovered or used again.
• Any spot you are currently sharing disappears from other drivers' maps immediately.
• Your parking history, your messages, and the ratings you have both given and received are erased.
• Messages are erased for the other person too. Unlike an email, a conversation here does not survive in the other person's inbox — deleting your account removes both sides of it.
• Because the ratings you gave are erased with you, the people you rated have their score recalculated without them.

If you think we have handled your data badly, please tell us first at privacy@udalapp.com. You also have the right to complain to the data protection authority where you live or work. As a UK company, we are supervised by the UK Information Commissioner's Office (ico.org.uk). In the EU, the European Data Protection Board lists each country's authority (edpb.europa.eu).

Children

Udal is for licensed drivers and is not intended for anyone under 16. We do not knowingly collect data from children.

Changes

If we change this policy we will update the date at the top and tell you in the app before the change affects you.