Dragonish

You are probably right, always check local laws when modifying your vehicle. Even if there are no laws you will probably run afoul of your insurer in some way.

One dreams of a day where it could be a thing. My take is that a drop in replacement is not possible because there is no incentive for car manufacturers to provide that hardware interoperability. They profit too much from the work google does to write the software for them, and all your data they can sell. They want you to buy a whole new car to get the latest features, they are not going to make it any easier on you to extend the lifetime of their product.

There are projects like Crankshaft that allow you to add a head unit to a vehicle that does not have one, but that does not get rid of the android app on your phone. As far as i know all these projects relay on a reverse engineered implementation of the android auto spec: https://github.com/f1xpl/openauto

One could read that implementation and make a client, but i am not aware of one that exists, let alone is actively maintained. Ibl believe the reason is the cost of testing the software for compatibility with all the different auto maker hardware makes this too difficult to sustain. I look forward to other responses to see what others are using.

my understanding is that terms of service would be helpful but not needed if someone trued to sue because you blocked access to the site. I would not expect ToS for a site like you are explaining, but if it did it would say “the web admin will ban you if you are naughty, you have been warned”

For privacy policy i think what you wrote to give us context is near perfect. Explain how your app stores data, be specific about encryption at rest and in motion. If your app is designed to hold name, email address, billing info you should highlight that in your policy. including a (monitored) contact email for questions would be nice, but not needed imo unless you are storing PII