Privacy
policy.

1. Who we are, and who we are not

We are an independent app. We are not Hyundai, Genesis or Kia.

Bloo is an independent app that talks to the Bluelink and Connected Car services of Hyundai, Genesis and Kia. It is not made by, endorsed by, or affiliated with Hyundai Motor Company, Genesis, Kia, or any of their subsidiaries. We have never met them. This is working out well for everyone.

2. What Bloo stores, and how it is encrypted

Your password and service PIN are encrypted before they are saved, with the key kept in your phone’s security chip.

Every sensitive thing Bloo keeps is encrypted before it is written to your phone:

• Your Bluelink, Genesis or Kia password, and any service PIN, are sealed with AES-256-GCM.
• Your sign-in tokens are sealed the same way, in a separate vault. That vault is locked with a key that only your phone's own lock can open, so it needs your phone to be unlocked before the app can read it. The keys that background work uses (status, alerts, AutoLock and the watch) need no unlock, so those keep running.
• The key for that vault is itself wrapped by a key that lives in the Android Keystore, the security chip inside your phone. On phones with a hardware-backed Keystore, the key stays inside the security chip. Bloo cannot read it out, and nobody who takes the phone apart with a screwdriver can either.
• Everything else Bloo keeps (your preferences, widget choices, the last car status it fetched) lives in the app's private storage, and Android encrypts that storage on the device. Nothing is kept in readable form on your phone.

In plain words: your password is encrypted once by Bloo, and then the phone encrypts the whole app's storage as well. The password is never sitting around as text. Not on the phone, not on a server, not in a log.

What that means in practice: if you change your phone's lock, or your phone resets its security key, your saved sign-ins may have to be entered again. Nothing can recover them without that key, so we cannot either.

3. Where things go

Your car maker, when you use your car. GitHub, to check for updates. Nowhere else.

• To your car maker's service, using your own account. That is the point of the app: locking, starting, finding and reading your car all happen there. Their privacy policy governs what they do with the request, and you should read it too.
• To GitHub, to check whether a newer build exists. It sends no account details, no car data, and no identifier that points at you.
• Nowhere else. No analytics, no advertising, no crash reporting, no tracking pixels. You can check this in the source (see section 9).

If you turn on Drive sync, your settings (never your password) are written to a file in your own Google Drive, so your other devices can read them. We cannot see that file. We would not know what to do with it if we could.

The on-device AI summaries run on your phone. Nothing you summarise leaves it.

4. Transactions

We sell nothing and take no payments. Your car maker handles any charges.

Bloo does not sell anything. There is no shop, no subscription, and no button that asks you to upgrade. Bloo does not take payments, hold money, or store card details. It is not a bank, a car dealer, or a fairground ride.

A transaction, meaning something you asked the car to do, works like this:

• You tap Lock. Bloo sends that request to your car maker's service, using your account. The service locks the car and reports back. That round trip is the transaction. Bloo shows you the outcome, and that is the end of our involvement.
• You start the climate or set a charge limit. The same thing happens. Your car does the work, the car maker's service records it under its own rules, and Bloo keeps only enough to show you what happened.
• If your car maker charges for a feature, such as a subscription for remote start, that charge is between you and them. Bloo never sees the money, cannot refund it, and is not responsible for the price of anything.

If you ever see a charge on your card with the word "Bloo" on it, it was not us. We would like to know who is impersonating us, and we would like a word with them about their taste.

5. If a pirate takes control of your car

Change your car maker password, sign out of Bloo, and call your car maker.

This is the part where policies start making promises, so we will stick to facts. Nobody can promise a determined criminal will never get into your car. What Bloo does is make sure the app is not the weak link, and that you always have a plan.

What protects you already:

• Your password and service PIN are encrypted on the phone, with the key held in hardware. Someone who copies your phone's files gets an expensive paperweight.
• Your credentials go only to your car maker. Nothing goes to a Bloo server, because there is no Bloo server, so there is no Bloo database for a pirate to raid. We did mention that.
• The app can lock itself behind your phone's own lock: fingerprint, face, PIN, pattern or password. The app has no PIN of its own. Turn that on. It is the pirate's least favourite setting.

What to do if you think your car has been taken over:

• Change your car maker's account password, from their own website or app, and turn on whatever two-step sign-in they offer. This is the single most useful thing you can do, and it works whether or not Bloo is involved.
• Sign out in Bloo's Settings. That deletes the credentials stored on that phone.
• Change your service PIN in your car maker's app, if they let you. Remote commands need it, so a new PIN stops anyone who copied the old one.
• Call your car maker. They can see the requests coming in, and can cut off a session in ways we cannot.
• If the car is in front of you and it is not yours to drive, call the police and the car maker. Do not argue with the pirate. The car is not worth it.

If we learn of a weakness in the app that a pirate could use, we will fix it, record it in the change log below, and tell you what to do. We would rather you heard it from us than from a news story about a car that drove itself into a lake.

6. What Bloo never collects

No name, address, contacts or phone location. Only your car’s location, from your car maker.

• Your name, address, phone number, or contacts.
• Your location. Only your car's location, and only because your car maker's service reports it to you. Your phone's own position is used on the device to draw your dot on the map, and goes nowhere.
• Anything from other apps, or how you use your phone.
• Money, or anything that would make a data broker's eyes light up.

7. Permissions, and why we ask

Every permission is optional, and each one unlocks one feature.

Bloo asks only for what a feature needs, and every one of them is optional. Location, to find your car and to run AutoLock. Notifications, for car alerts. Bluetooth, for AutoLock with your car's own connection. Activity recognition, so AutoLock knows when you are driving. Say no to any of them and that feature sulks quietly. Nothing else breaks.

8. Your control

Sign out to delete your credentials. Uninstall to delete everything else.

• Sign out in Settings to delete your stored credentials.
• Clear the app's data in Android's settings, or uninstall the app, to remove everything it stored.
• Delete the sync file from your own Google Drive, if you turned on sync.

There is nothing for us to export, delete, or correct, because we do not have it. This is the one time a lack of infrastructure works in your favour.

9. Open source: please check our work

The code is public on GitHub, so you can check every claim here.

Bloo is open source. The whole app, including the encryption code, is on GitHub, and you do not have to take our word for any of this:

• The vault that seals your credentials: shared/src/main/java/com/bloo/bluelink/data/SecureVault.kt.
• The credential store that uses it: shared/src/main/java/com/bloo/bluelink/data/CredentialStore.kt.
• The update check, which is the only other outside request besides your car maker (and Drive sync, if you turn it on): shared/src/main/java/com/bloo/bluelink/data/UpdateApi.kt.

If you are suspicious, good. Go and look. If you find something that does not match this page, please tell us, and we will fix the code or the page, whichever is wrong.

10. Children

Bloo is not for children.

Bloo is not for children, and we do not knowingly collect anything from them. If you are a child reading this, go and ask a grown-up to show you a car instead.

11. Changes

Every change is dated in the change log below.

When this policy changes, the date at the top changes too, and the change is written below in plain words, with the date. We do not make quiet edits in a drawer.

• 30 October 2026. The app has no PIN of its own any more. It unlocks with your phone's own lock (fingerprint, face, PIN, pattern or password), and your sign-ins sit behind that lock in a vault of their own. Background work keeps its own key, so status, alerts and the watch still run. The watch has no PIN of its own either: its own screen lock holds it after a restart. An app PIN from an older version, and the watch's, is deleted the first time this version opens the vault.
• 29 October 2026. Rewritten. States plainly that sensitive data is encrypted before it is stored, and that the rest of the app's storage is encrypted on the device. Adds sections on transactions, on what to do if a pirate takes control of your car, and on the open source code. The policy is now also inside the app.
• 14 October 2026. First published.

12. Contact

Questions go to adi1.perets@gmail.com.

Questions, complaints, or a pirate who would like to apologise: adi1.perets@gmail.com.

Bloo is unofficial. It is not affiliated with, endorsed by, or operated by Hyundai Motor Company, Genesis, Kia, or any of their subsidiaries.