For $99, a small plug for a car's diagnostic port promises a lot: knowing where the vehicle is, calling for help when something goes wrong, and doing it without selling the data that makes those features possible. That combination is why The Verge tried the device, and why the product is interesting.
Connected cars are a data business now. Modern vehicles log location, speed, braking behaviour and vehicle health, and ship those streams to manufacturers, insurers and data brokers. Anyone driving an older model, or unwilling to trust the built-in system, has mostly had to choose between DIY tinkering and a subscription. A $99 plug with an explicit no-selling promise is an answer to that gap — and a test case for whether privacy works as a product feature or only as marketing.
The questions worth asking before buying are not the ones on the box.
First: where is the data processed, and how long does it live? A device that evaluates in the car and transmits only events is a fundamentally different object from one that keeps a permanent location trail in the cloud. Second: who can see that trail — just the owner, or also the third-party service that runs the emergency dispatch? Third: what happens on a law-enforcement request, and is there a published policy covering it? Fourth: what happens if the company is acquired or folds? A privacy promise attached to a company rather than to an architecture is only as durable as the company's ownership. Fifth: is $99 the whole cost, or is there a cellular fee that quietly reproduces the manufacturers' subscription model?
The wider context makes this more urgent than the product itself. Vehicle data has become the subject of regulatory action in several jurisdictions, and insurers have started using telematics not only for discounts but for risk pricing overall. A device that makes the data stream controllable therefore also changes who gets to judge the driver.
That is a reasonable product. But it is not privacy you buy once and then own. It is an agreement with a company that can change its mind at any time — unless the promise lives in the architecture: local processing, end-to-end encryption, deletable history, disclosed requests. That is the standard to hold it to, not the wording on the box.
