How Odotur handles changes

A trip is a fact once recorded. You add to it; you never overwrite it. Every change is a new, dated entry in the log, the history stays visible, and it is printed in your export.

In short

What the GPS measured (times, start and end point, distance) is never edited. A wrong distance gets a separate correction row.
Every saved edit keeps the old value, the new value and when it was made.
After the grace window, an edit also needs a reason.
Deleting a trip voids it: it stays in the log and the export, struck through, with the reason.
Gaps (GPS lost, app stopped by the phone) are recorded and printed, not hidden.
The log checks itself on launch and before every export, and the export prints the result.

What happens when you change something

You do this	Odotur records	In your export
Fill in or change a purpose, category, address or other field	A revision: field, old value, new value, when. Within the grace window no reason is asked; after it, a reason is required (Forgot, Typo, Wrong place or Other, plus optional text).	The current value in the row, and every revision after the first save in the revision appendix.
Fix the km of a GPS trip	A separate correction (+ or - km, with a reason). The measured distance stays as it was.	The correction next to the trip and in the corrections appendix. Totals include it.
Delete a trip	A void, with a reason. It can be restored later, which is recorded too.	Struck through, with the reason. Voided trips never count in totals or counters.
Add a trip you forgot	A manual trip, marked "entered on" with the date you typed it.	Marked Manual. Entered more than 7 days after the trip: "late entry".
Log a possible drive	A manual trip from the suggestion. If you adjust its times, the original suggestion stays visible.	Marked as a possible drive.
Continue after an early stop	A link between the two parts.	One trip with a pause line; km are added up.
Nothing: the GPS was lost or the phone stopped the app	A gap, with its cause. After an interruption, the trip ends at the last position received; no time or cause is invented.	In the gaps appendix. Estimated km are labelled as estimated.
Enter an odometer reading	The reading. When it closes an interval, a reconciliation with the difference between the odometer and your logged km.	Netherlands: a correction trip, split pro rata. Other countries: a discrepancy note, with no km allocated. A later reconciliation of the same interval supersedes the earlier one; both are printed.

Grace window: 7 days after the trip ends, 2 days on the Austrian profile. The 2 days are a product choice for "zeitnah", not a legal safe period. Edits inside the window are recorded too; they just don't need a reason.

A form you haven't saved yet is not an entry. Every Save is, including filling an empty field for the first time.

#1041GPS trip recorded 08:12-08:41, 23.4 km measured3 Mar 08:41prev 52ab… → 7c1e…
#1042Revision Category: empty → Business3 Mar 18:02prev 7c1e… → 0d94…
#1043Revision Purpose: empty → Client visit, Vejle3 Mar 18:02prev 0d94… → e61f…
#1067Correction +1.2 km, reason: GPS error12 Mar 09:15prev a3f9… → 4b20…
#1088Void another trip, reason: Duplicate14 Mar 17:40prev 4b20… → 91cc…

Illustration of log entries, hashes shortened. Each entry carries the hash of the one before it. Entries #1044 to #1066 belong to other trips.

Where you see it

In the app: every trip has a History screen, and a small source line: "GPS · recorded 08:41", "Manual · entered 12 Mar" or "Late entry".
In the PDF and CSV export: the trip rows, then appendices for corrections, voids, gaps, reconciliations and discrepancy notes, and the revision appendix. Revisions are included as of the moment you export: a change made later to an old trip appears in later exports.
On every PDF page: page n of N, the as-of time, and the log's head hash. A legend explains observed, derived and unknown odometer values, GPS, manual and possible-drive sources, and estimated km.

For employers, accountants and tax auditors

The log is an append-only list of events stored in a database on the user's phone. The database itself refuses to change or remove an entry, and an automated test scans the app's code for any statement that would. The only ways entries disappear are Delete everything and restoring a backup, which replace the whole log (see Honest limits). What you see as a "trip" is rebuilt from the events.

Two times per entry. Each entry has occurred_at (when the fact happened) and recorded_at (when it was written). Both are printed: a March correction entered in April shows both dates.
Units. Distances are stored as whole metres, times as milliseconds in UTC with the time zone at capture, and money in minor units. Rounding happens only for display (0.1 km) and on totals, never on stored facts.
The hash chain. Each entry stores hash = SHA-256(prev_hash ‖ canonical JSON) of its sequence number, type, entity, entity id, payload, occurred_at and recorded_at. prev_hash is the previous entry's hash as 64 hex characters (64 zeros for the first entry). Canonical JSON follows RFC 8785 (JSON Canonicalization Scheme), with text normalised to Unicode NFC. Changing any stored entry changes its hash and breaks every link after it.
The check. The app recomputes the chain in the background on launch and again before every export. A mismatch shows "Log integrity check failed at entry N", and the export prints the break. Exports print the head hash, and the CSV lists each entry's sequence number and hash.
Odometer values are printed as observed (typed by the user), derived (calculated between two typed readings, only when no gap or possible drive is unresolved in between) or unknown. Strict profiles show a checklist warning for each derived value. Whether a derived value is acceptable is for the reader of the log to decide.
Rates carry a version and rule id, printed in each report. An updated rate table never silently changes an export you already made.
Germany. The Fahrtenbuch (DE) layout is a closed chronological form for the full year with the change history in the same file. A purpose or business partner added more than 7 calendar days after a trip prints "late entry", unless date, odometer and destination were captured at trip end. Whether the log suits the Fahrtenbuchmethode is for the user and their adviser to decide.

Honest limits

The chain shows changes made through the app and detects edits that break it. Anyone with full access to the device could rewrite the whole chain from start to end, and the app can't prevent that. The log is evidence of how it was kept, not proof that nobody could have altered it.
Odotur is an independent tool. It is not affiliated with any tax authority.
Delete everything (Settings, confirmed by typing DELETE) removes the whole log from the phone, history included. It is your data and your choice. Keep the exports or backups your country requires you to keep.
Restoring a backup replaces the log on the phone with the one in the backup, and the restored chain is verified.
GPS distances can be wrong, and a phone can stop an app during a trip. That is why gaps, estimates and corrections are recorded instead of hidden.

Questions about the log format: odotur@benbasha.com.