Pandu — Privacy Policy

Last updated: 24 October 2026. Pandu is published by BobOffice, LLC ("we"). Contact: info@bobwork.ai.

Summary

Pandu has no ads and does not sell or share your data for advertising. Each install gets an automatic Pandu account (no sign-up, no email or phone needed) so your settings and saved places can be restored on a new phone, and so we can see how the app is used and improve it; you can delete it at any time in Menu > Delete my data. To work, the app sends some data to map, search and routing providers. Search and route requests pass through a small relay we operate on Cloudflare (it hides our TomTom key and counts requests per day); the relay does not store your map searches or route coordinates. It keeps a per-day request count and short-lived counters derived from your IP address for abuse protection (kept for up to 2 hours). The relay also stores what you choose to submit (hazard reports, places, feedback) and, for the optional online place lookup, the text you typed and the results, described below.

What the app uses

• Location (precise). Used on your device to show your position, match it to the road and give turn-by-turn guidance. Pandu asks for "While Using" access; on iPhone you may choose "Always" so guidance continues with the screen off. On Android a foreground notification is shown while navigating. Location is used only while you are navigating or viewing the map.
• Destination searches. The text you type is sent, through our relay, to TomTom Search, and to OpenStreetMap-based services (Photon, Nominatim) as a fallback or when you tap "Search more".
• Routes. Your start and destination coordinates are sent, through our relay, to TomTom Routing (or to OSRM / OpenStreetMap as a fallback) to calculate a route. During rerouting your current coordinates are sent again.
• Petrol stations. When you open the Gas list, your current coordinates are sent, through our relay, to TomTom Search to find nearby stations.
• Pandu Places search. To find businesses and places, the app downloads small public data files (open place data from Overture Maps) from Cloudflare Pages. The file requested depends on the first letters of the word you type; the matching happens on your phone, and your coordinates are not sent for this.
• Online place lookup. When a place is not found in our own data, the app can look it up online. The place text you typed and your approximate area (your position rounded to 2 decimals, about 1 km) are sent through our relay to an AI web-search service (a third party), which returns candidate places; we then geocode them with TomTom. The relay stores the text you typed and the places found in a shared cache, reused for other users who type the same text, for 30 days (1 day when nothing was found). Your approximate area is not stored. The cache is not linked to you.
• Adding a place (optional). If you tap "Add this place", the name you typed, the optional short note you type, the app language and the coordinates of the pin are stored on our relay (Cloudflare D1) and shown to other Pandu users in search. They are not linked to you. We may hide or delete a place, and you can ask us to remove one (info@bobwork.ai).
• Hazard reports. If you tap Report and choose a hazard, its type, its coordinates and the time are stored on our relay (Cloudflare D1) and shown to other drivers nearby for about two hours. Reports are deleted automatically, normally within a day. They are not linked to you.
• Voice input (optional). Only when you tap a microphone button, Pandu records a short clip (up to about 45 seconds), sends it through our relay to a third-party speech-recognition service, receives the text, and deletes the clip from your phone. We do not keep the audio. The speech service may handle it briefly under its own policy. The microphone is never used in the background.
• Feedback (optional). If you send feedback, we receive the text you wrote, any photos or videos you attach, an optional email or phone number you type, the app version, phone type and operating system version, and a short note on what the app was doing. Photos and videos are deleted after 60 days; text is kept so we can fix the problem, and we delete it on request (info@bobwork.ai). Please do not include information you do not want us to see.
• Map tiles. Your device requests map images from the tile provider (OpenFreeMap). The tile requests reveal the map area you are viewing and your IP address.
• Your Pandu account and app use. When you first open Pandu, our relay creates an account identified by a random ID (we store only a scrambled form of its secret key). Linked to that account we store: your optional username; your settings (language, voice, fuel type, car, map style, avoid tolls); your Home, Work, favourites and recent destinations (names and coordinates); and a log of how you use the app: destinations you choose (name, coordinates rounded to about 10 m, the text you searched), trips you start and end (destination, distance, time, toll, whether you arrived, kilometres driven, whether it was a simulation), favourites you add or remove, and reports you make. We also store the app version and phone type (iOS/Android). We do not store your live GPS track. The log is kept for up to 12 months; the profile until you delete it. We use it to restore your settings and places, to fix problems and to improve routes and search. It is not sold or used for advertising.
• Spoken directions. Generated on your device with the system text-to-speech voices.

What is stored on your device

Your settings, Home, Work, favourites and recent destinations are stored on your phone and, as described above, in your Pandu account on our relay so they can be restored. Uninstalling the app removes the copy on your phone; use Menu > Delete my data to remove the copy on our relay.

Third parties

Search, routing and map providers receive the requests described above and handle them under their own policies: TomTom, Komoot Photon, OpenStreetMap (Nominatim), the OSRM project, OpenFreeMap, an AI web-search service for the online place lookup, a speech-recognition service for the optional voice input, and Cloudflare (which sees your IP address and the request as our relay host and stores hazard reports, places, feedback and the lookup cache for us). We do not sell your data, use it for advertising, or track you across apps and websites. Search and route requests to these providers are not sent with your Pandu account ID.

Security and retention

Requests use HTTPS. Our relay keeps no copy of your location or routes, and does not store map searches; it stores the online place lookup text and results for 30 days as described above. Counters derived from your IP address (for rate limiting) are deleted after about 2 hours. Your account profile is kept until you delete it and the app-use log for up to 12 months. Hazard reports are deleted automatically, normally within a day, and feedback photos and videos after 60 days; provider logs follow their own policies. Provider retention follows their policies.

Children

Pandu is a driving app and is not directed at children under 13.

Your choices

You can change or revoke location and microphone permission in your phone settings at any time; navigation will not work without location, and voice input will not work without the microphone. To delete your Pandu account (settings, places and app-use log) tap Menu > Delete my data; it is removed from our relay immediately. To delete feedback you sent, email info@bobwork.ai.

Changes and contact

We will update this page and its date if the app's data use changes. Questions: info@bobwork.ai.