Vorbita Privacy Policy

Effective date: August 22, 2026

1. Who we are

Vorbita ("the app") is published by Zerous - FZCO ("we", "us"), a company registered in Dubai, United Arab Emirates.

For any privacy question or request, contact us at [email protected].

2. What Vorbita is — and what that means for your data

Vorbita is a fleet-monitoring client for Traccar GPS servers. The app itself does not track you: it connects to a Traccar server that you choose and displays the vehicles and devices managed on that server.

This has an important consequence:

• The operator of the Traccar server you connect to is the data controller of all fleet data (vehicle positions, routes, events, driver information) stored on that server. We do not have access to that data and this policy does not cover it. Contact your server operator (typically your employer or fleet manager) for their privacy terms.
• If you connect to a server operated by us (for example the pre-filled default server), the separate Vorbita service privacy policy at https://vorbita.app applies to the data stored on that server.

This policy covers what the app on your phone does with data.

3. The app does not access your phone's location

Vorbita never requests location permission and never reads your phone's GPS. The positions shown on the map are those of the fleet devices reported by your Traccar server — not your phone's.

The app contains no advertising and no analytics SDK, and we do not sell or rent any data. It does include a crash-reporting SDK (Firebase Crashlytics) used solely to diagnose and fix errors — see section 5.2.

4. Data stored on your device

To work as a login-based client, the app stores the following locally on your device only, inside the operating system's encrypted secure storage (iOS Keychain / Android Keystore-backed storage):

• the Traccar server URL you entered;
• your account email and password (so you can be signed in automatically);
• your session cookie or access token;
• app preferences (theme, language, selected map style, marker settings).

This data never leaves your device except as described in section 5. It is deleted when you log out (credentials and session) or uninstall the app (everything).

5. Data transmitted off your device

5.1 To the Traccar server you choose

• Login credentials (email and password) are sent to your server to authenticate you, over the connection of the server URL you entered.
• API and WebSocket requests carry your session cookie or token so the server can return your fleet data.
• Push notification token: if you enable push notifications, the app stores its Firebase Cloud Messaging registration token in your own user account on your Traccar server (the notificationTokens user attribute), so the server can send you event notifications. The token is removed from your account when you disable notifications or log out.

We recommend only connecting to servers using https:// URLs so this traffic is encrypted in transit.

5.2 To Google

• Google Maps SDK: when you use the Google map styles, map content is loaded from Google's servers. Google receives technical request data such as your IP address and the viewed map area. See the Google Privacy Policy and the Google Maps Platform terms.
• Firebase Cloud Messaging (FCM): push notifications are delivered through Google's FCM infrastructure, which processes a per-install registration token and message-delivery metadata. Firebase Analytics and advertising features are disabled in this app. See Firebase privacy.
• Firebase Crashlytics: if the app crashes or hits an internal error, a crash report is sent to Google's Firebase Crashlytics so we can find and fix the bug. A report contains the technical stack trace and app state at the time of the error, the app version, device model and OS version, a random per-install identifier generated by Crashlytics, and — so we can tell customers apart when investigating — your numeric Traccar user ID, whether you use a Traccar server or the Vorbita Dashboard, the hostname of the Traccar server you are connected to, and the map style in use. Your email address, password, session cookies, vehicle names and positions are never included. Crash reports are used only to diagnose and fix errors; they are not used for advertising or profiling. Crash reporting is always on and cannot be disabled in the app. See Firebase privacy.

5.3 To OpenStreetMap

When you select the OpenStreetMap map style, map tiles are loaded from tile.openstreetmap.org, operated by the OpenStreetMap Foundation, which receives your IP address and the requested tiles. See the OSMF privacy policy.

5.4 To Wiredash (only if you send feedback)

The app includes an optional "Send feedback" feature powered by Wiredash (Wiredash GmbH, Germany). Nothing is sent until you explicitly write and submit feedback. When you do, the following is transmitted to Wiredash so we can read and answer your feedback:

• your feedback message and the category you picked;
• your account email and server URL (so we can follow up and reproduce issues);
• app version and basic device information (model, OS version, locale).

See the Wiredash privacy policy.

6. Push notifications

Push notifications are off by default. Enabling them requires your explicit action in Settings and the operating system's notification permission. Notification content is generated by your Traccar server based on the notification rules configured in your account. You can disable notifications at any time in Settings; this removes the device's token from your account on the server.

7. Legal bases (GDPR)

Where the EU/UK General Data Protection Regulation applies, we rely on:

• Performance of a contract (Art. 6(1)(b)) — processing your credentials and session locally and transmitting them to your chosen server is necessary to provide the app's core function.
• Consent (Art. 6(1)(a)) — push notifications and feedback submission are opt-in and can be withdrawn at any time.
• Legitimate interest (Art. 6(1)(f)) — loading map content from Google or OpenStreetMap, which is necessary to display the map you requested.
• Legitimate interest (Art. 6(1)(f)) — crash reporting, to keep the app working reliably.

8. Data retention and deletion

• On your device: credentials and session data are deleted on logout; all app data is deleted when you uninstall the app.
• On your Traccar server: retention of your account and fleet data is governed by your server operator. The app does not create accounts — it only signs in to accounts that already exist on your server — so account deletion is handled by your server operator.
• Feedback: to have a submitted feedback message deleted, email [email protected].
• Crash reports: Google retains Crashlytics crash data and associated identifiers for 90 days, after which it is removed automatically. To have crash reports associated with your user ID deleted earlier, email [email protected] stating your server and user ID.

9. Your rights

Where GDPR or similar laws apply, you have the right to access, rectify, erase, restrict or object to processing of, and port your personal data, and to lodge a complaint with a supervisory authority. For data held on a Traccar server, address requests to the server operator; for anything covered by this policy, contact [email protected].

10. International transfers

Google and Wiredash may process the data described above on servers outside your country, including the United States and the European Union, under their respective safeguards (such as EU Standard Contractual Clauses). See their privacy policies linked in section 5.

11. Children

Vorbita is a professional fleet-management tool and is not directed at children under 16. We do not knowingly process children's data.

12. Security

Credentials and tokens are stored in the operating system's secure storage. All endpoints we operate or integrate (Google, Wiredash, OpenStreetMap, the default server) use TLS/HTTPS encryption in transit.

13. Changes to this policy

We may update this policy as the app evolves. The current version is always available at https://zerous.org/privacy; material changes will be reflected in the effective date above.

14. Contact

Zerous - FZCO — Dubai, United Arab Emirates
Email: [email protected]