Privacy Policy
Last updated 27 July 2026 · Effective 27 July 2026
Written from the code, not from a template. Every claim here describes what the software actually does, and can be checked against it.
The short version. Your Tesla password is never seen by the app. Your car's location is never stored — not coordinates, not history. There are no analytics SDKs, no advertising networks and no third-party trackers. Nothing is sold, rented or shared for marketing, ever. You can delete everything from inside the app, and that also revokes our access at Tesla.
Who is responsible for your data
TeslaWatch (“we”, “us”) is the data controller for the information described here. For any privacy question, request or complaint, contact privacy@teslawatch.app. We respond to rights requests within 30 days.
What we store, why, and for how long
| Data | Why | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Tesla access & refresh tokens | To talk to your car on your behalf. Encrypted at rest; the app cannot read them. | Contract | Until sign-out or deletion |
| VIN and vehicle status — battery, range, charge state, climate, lock state, tyre pressures, odometer | To display your car without waking it every time you glance | Contract | Live cache: 5 minutes |
| Periodic status snapshots | Tyre-leak and drain detection need history to compare against | Contract | 30 days |
| Battery readings | Capacity degradation is slow and cannot be measured in a shorter window | Contract | 180 days |
| Charging sessions | Charging history and cost estimates | Contract | Until deletion |
| Command log — which command, result, latency. VIN stored hashed. | Security audit trail, and measuring whether Bluetooth is genuinely faster | Legitimate interest (security) | Until deletion |
| Push notification token | To deliver alerts to your device | Contract | Until sign-out or deletion |
| Your settings — alert thresholds, electricity rates | So the app behaves as you configured it | Contract | Until deletion |
| Anonymous usage events | Finding faults and improving the app | Legitimate interest | Indefinite — see below |
The command log stores your VIN scrambled, not readable. It goes through a one-way cryptographic hash before it is written, so the log can tell one car from another without holding an identifier that means anything on its own.
Location — what we actually receive
TeslaWatch does not store where your car is. It receives a single yes/no signal from Tesla: whether the car is at the home address you configured in your own Tesla account. That is used only to tell home charging apart from Supercharging for cost estimates. No coordinates are requested, stored or transmitted anywhere, and there is no location history. We do not request location permission from your device.
Anonymous usage data
We record which screens you open and which commands you send, so faults can be found. This carries no VIN, no account identifier and no name — only a session identifier that is hashed and rotates daily, plus app version and watch model. Values are restricted to a fixed vocabulary, so free text cannot end up in it.
Because it cannot be traced back to a person, it is not deleted when you delete your account — there is nothing to look it up by. This is the one exception to deletion, and it is stated here rather than buried.
What we never collect
Purchases are handled entirely by Apple. We never see your card, billing address or Apple ID.
Who else receives data
That is the complete list. There is no analytics provider, no advertising partner, no data broker, and no AI training on your data.
Where data is processed
Data is processed on Cloudflare's global network and may be handled outside your country, including in the United States. Transfers out of the UK/EEA rely on Standard Contractual Clauses through our processor. Tesla and Apple process data under their own terms.
Your rights
Wherever you live, you can access, correct, export and delete your data, and object to processing based on legitimate interest. Deletion is built into the app; for anything else email privacy@teslawatch.app.
If you are in the UK or EEA (UK GDPR / GDPR)
You additionally have the right to restrict processing, the right to data portability, the right to withdraw consent where processing relies on it, and the right to lodge a complaint with your supervisory authority — in the UK, the Information Commissioner's Office at ico.org.uk.
If you are in California (CCPA / CPRA)
You have the right to know what is collected, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal information, and never have — including under CPRA's broad definition covering cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes requiring a right to limit. We will not discriminate against you for exercising any right.
Other US states
Residents of Virginia, Colorado, Connecticut, Utah, Texas and other states with comprehensive privacy laws have equivalent rights, exercised the same way. We do not conduct targeted advertising, sale of personal data, or profiling with legal effects.
Deleting everything
In the app: Settings → Delete Account. This:
- Revokes TeslaWatch's access at Tesla, so the connection genuinely ends rather than being forgotten locally.
- Deletes your session and stored tokens.
- Deletes your vehicle data — charging history, snapshots, saved scenes, cached status.
- Removes your push token, so no further alerts are possible.
You receive a receipt listing what was removed. If any step fails, it reports the deletion as incomplete rather than claiming success, and can be retried.
Security
- Tesla tokens encrypted at rest with AES-256-GCM under a key held only on the server.
- All traffic over HTTPS/TLS.
- Device credentials in the Apple Keychain, marked device-only, never synced to iCloud.
- Sign-in uses OAuth 2.0 with PKCE, so an intercepted authorisation cannot be replayed.
- Unlocking via Siri requires Face ID or passcode, even from a locked phone.
- Every request is rate-limited, and every command is recorded in an audit log.
No system is perfectly secure. To report a vulnerability see security.txt or email security@teslawatch.app — vehicle-access issues are treated as highest priority.
Children
TeslaWatch is not directed at children under 13 (or under 16 in the EEA/UK) and we do not knowingly collect their data. If you believe a child has provided data, contact us and we will delete it.
Cookies
This website sets no cookies and runs no analytics. It has no tracking scripts of any kind. The app itself uses no cookies.
Changes
If this policy changes materially, the app will tell you before the change takes effect, and the date at the top will change. Continued use after that constitutes acceptance.
Contact
Privacy: privacy@teslawatch.app
Security: security@teslawatch.app
General: support@teslawatch.app