# Shotgun — Privacy Policy

*Last updated: 3 September 2026*

Shotgun (`com.tagadaisai.assistant`) is an app for Android Automotive OS that
can be selected as the car's digital assistant. It answers the steering-wheel
assistant button, understands a set of spoken requests you can edit
(navigation, calls, media, what the car knows about itself), and can pass
anything else to an AI model of your choosing. This policy explains what the
app accesses, what leaves the car, and where it goes.

## What stays in the car

1. **Contacts and call history.** Read only to turn "call Jennifer" into a
   number, and to tell two contacts with the same first name apart by who you
   rang before. Your contact list and call history are never uploaded.
2. **Microphone audio.** Speech recognition is done by the car's own recognition
   service, the same one the car's other apps use. The app never records,
   stores or transmits audio itself. What the service returns is text, and the
   app keeps that text as described below. Contact names are handed to the
   recogniser as hints so it hears them correctly.
3. **Vehicle data.** Range, battery level and outside temperature are read from
   the car when a request asks for them, and spoken back. They are not sent
   anywhere.
4. **Recent requests and a diagnostic log.** The app keeps your last few
   requests and what it did about them, and a log of what it did and any
   errors, on the car, and shows them on its own screen. Neither leaves the
   car, and both are removed when you uninstall the app.

## What leaves the car, and to whom

The app talks to at most three places, and each is under your control.

### 1. The companion service (assistant.oats.cc)

Pairing the car with the companion web portal is optional, and until you do
nothing is sent to the web portal. After pairing, the app sends it:

1. **AI usage records.** When a request is passed to an AI model, the text of
   the request, the model's reply, which model answered, and the token count,
   so the portal can show your spending against the weekly cap you set.
2. **A random install identifier** that ties the car to your portal account,
   and the car's make and model as a label. No Google account, phone number,
   email address or vehicle identification number is read or sent.
3. **Which text-to-speech voices the car has**, so the portal can offer them.

The service stores your settings, your rules, any voice clips and avatar you
upload, and the items above, against your account. The API key you enter for
your AI provider is handed to the car once and the service keeps only a hash
of it to confirm the car received it. To have everything the service holds
about you deleted, email the address below. An account that is never paired,
or that holds nothing and has not been heard from for 30 days, is deleted
automatically.

### 2. The AI provider you choose

If you enter an API key for an AI provider in the portal (currently Anthropic
or OpenAI), then any request that none of your rules claims is sent **from the
car directly to that provider** using your key, along with the previous few
turns of the conversation and a short instruction to answer as a car assistant.
It is your account with that provider, and their privacy policy governs what
they do with it. Without a key, nothing is ever sent to an AI provider.

### 3. Web addresses you configure

A rule can be set to post what you said to a web address you own. Such a
request carries the sentence, the words the rule captured, the car's make and
model, a one-way hash identifying the car, and a secret you set, and only goes
to the address in that rule. No rule of this kind is switched on unless you
switch it on.

## What the app does not do

1. No advertising, no analytics, and no tracking of any kind.
2. No data is sold, rented, or shared with anyone other than the parties above,
   each of which you chose.
3. Nothing is transmitted to the web portal until you pair the car with the
   portal, and nothing goes to an AI provider or web address you have not
   configured yourself.

All transmission is over HTTPS.

## Children

The app is not directed at children and is not intended for users under 18.

## Data retention and deletion

Data held by the companion service is kept until you ask for it to be
removed, or the account is collected automatically as above. Uninstalling the app removes everything
it kept on the car. What an AI provider or your own web address retains is
governed by them. Contact, call log and microphone permissions can be revoked
in the car's settings at any time; the app keeps working without them, minus
the features that need them.

## Contact

Questions or deletion requests: **ben@nattercan.com**