Privacy — Cippo

Last updated 7 October 2026

The principle

Cippo finds the kilometre or mile marker you are at on your phone, in packs of public road data that it downloads whole, so our relay does not learn where you are. The one exception is a marker report: it sends us a position, and only when you tap Send. Nothing else about you reaches us, and nothing we receive says who you are: no account, no identifier, no IP address kept.

What the app keeps

Cippo records what you put into it:

the packs you downloaded, and the Québec pack that comes with the app
your settings: units, the kinds of markers shown, speaking rate, automatic downloads
the last marker found, with its position, so the widgets and the Apple Watch open on something
with Cippo Pro, your traffic log — each incident with its time, road, marker, direction, position and note — and the road sections you watch

Where it lives

On your device. If iCloud is on, your traffic log and your watched sections also sync through your own private iCloud database, which Apple encrypts and which we cannot open, read or list. Packs, settings and the last marker stay on the device. The iPhone passes the current marker to your Apple Watch directly, and the watch passes back the incidents you note on it.

What it asks permission for

Every one of these is optional. Refuse any of them and the rest of the app keeps working.

Location, while the app is in use: To find the road, the marker, the direction and the next exit. The calculation is done on the device, in the packs; your position is never sent to us, except in a report you send. Siri, Shortcuts and the Apple Watch app use it the same way, when you ask them.
Location during a trip: Only after you tap Start a trip: the marker keeps updating on the Lock Screen and in the Dynamic Island, and iOS shows the location indicator the whole time. Background location stops when the trip ends.
Microphone and speech recognition: Only with Cippo Pro, when you dictate the note of an incident. The transcription is done on the device when it supports your language; otherwise Apple’s speech recognition receives the audio, as for any dictation. Nothing is recorded, and neither the audio nor the text reaches us.
Photos: No permission is asked. When you add a photo to a report, the system picker gives Cippo only the photo you choose; Cippo makes a smaller copy without its metadata (date, place, device) and sends that copy with the report. The camera is never used.

What leaves the device

The app has no analytics, no crash reporting, no advertising and no third-party kit of any kind. What it does send, it sends only to the services below, and only for what you asked it to do:

Our relay, cippo.nidello.ca: the packs: The app asks it for the list of packs, with the fingerprint of the copy it already has, and for each pack it downloads, by its public name (ca-qc, fr, us-ca…). The pack of the region you are in downloads by itself, on Wi-Fi by default, unless you turn that off; the name of a pack can therefore tell which province, state or country you are in or interested in, and nothing more. The requests carry no position, no identifier and no account. The relay keeps no request log.
Our relay, cippo.nidello.ca: a marker report: Only when you fill in Report a marker and tap Send; the screen shows what will be sent first. A report contains the kind of problem, the position shown (rounded to about one metre on arrival), the road, the value you read on the sign, your comment and the photo if you add one; when Cippo had found a marker, the value it computed, the direction and the name of the pack; and the version of the app. The relay adds the date, to the day. No identifier, no account, no IP address and no time of day is kept. Only we read reports, to correct the packs; each is then deleted, with its photo. We do not publish reports or pass them on.
Apple Maps: Draws the Map tab. Receives the point you select, to show its Look Around view, and that point again if you ask for directions, which opens Apple Maps. Looking up a marker (“A-20 km 145”) is done in the packs, on the device. That exchange is between you and Apple.
Siri: When you ask Siri where you are, the answer is computed on the device. What you say to Siri is handled by Apple, under its own policy.
Calls and messages: Emergency mode, always free, calls the emergency number of the country you are in when you tap Call, and can prepare a text message with your marker, your coordinates and an Apple Maps link: you choose the recipient and send it yourself. Share works the same way. None of it goes to us.
The App Store: If you subscribe to Cippo Pro, your device talks to the App Store, as it does for any purchase, and the subscription is managed in your Apple Account. We are told a sale happened; we are never told who you are. The App Store also opens if you tap the occasional suggestion of another Nidello app, which you can turn off in Settings.

Only the two lines about our relay reach us: a pack request, which says nothing about you, and a report, which you send yourself. We have no server in any of the other paths, and we never receive a copy.

Cippo is not a navigation or emergency service. Markers come from the open data of road authorities and from OpenStreetMap; each pack names its source and licence, and Cippo is not affiliated with any road authority.

Your data is yours

Export your traffic log as a CSV file whenever you want, and with Cippo Pro as text or PDF. Delete the app and what was only on the device is gone; the log and sections synced to iCloud go when you remove Cippo from your iCloud settings. We cannot recover any of it for you, because we never had it.

Children

Cippo is not directed at children. The only thing it can send us is a report you choose to send, and nothing in it says who you are.

Changes to this page

If the app ever starts doing something this page does not describe, this page changes first. The date at the top says when it last did.

Your rights

Quebec’s Law 25 and similar laws elsewhere give you the right to access, correct and delete the personal information a business holds about you. We hold nothing that identifies you. Your log is on your device and in your own iCloud, where you can read, change and delete all of it yourself. A report carries no identifier, so we cannot tell which one is yours: write to us with its day, road and value, and we will find it and delete it.

Contact

Nidello — Canada — [email protected]