Privacy Notice

Effective September 30, 2026.

Our promise

• The Operator does not sell your information or use it for advertising.
• It goes only to the services that help run EV Logger, to the vehicle makers, to the one person you allow, or where the law requires it.
• You can export your data, or delete it and your account, at any time.

1. Who is responsible

Flying Blue Doxie EV Logger (the Service) is run by its operator (the Operator) as a personal, non-commercial project. The Operator decides how your information is used and is its controller where that term applies. Contact: [email protected].

A Tesla is connected through Tesla's Fleet API, with the Operator's own application registered with Tesla. Tesla is a separate, independent controller of the information it collects about the use of its interface, and may use the information submitted through it under the Tesla Customer Privacy Notice (tesla.com/legal/privacy).

2. What is collected

2.1 Your account

• Your email address, and your password stored only as a one-way hash.
• The sign-in protections you choose: Two-factor sign-in, trusted browsers, passkeys, and linked sign-in providers (Google, Microsoft, LinkedIn, Discord), with the identifier and email address each provider reports. A passkey's private key stays on your device.
• Your preferences, such as theme, units and time zone.
• Invitation and sharing records: Who invited you, and with whom you share vehicles.
• Security records: Failed sign-ins and password-reset requests, used to protect accounts.
• Activity: When you last signed in, and the hour you last opened the Service. The Service does not record the pages you view or what you click.

2.2 Your vehicle-maker account

• The access tokens the vehicle maker issues, stored encrypted.
• Your vehicle-maker password is not stored. A Rivian sign-in passes it to Rivian, and a Tesla sign-in happens on Tesla's own pages.
• The identifiers the maker gives you and your vehicle.
• For a Tesla: The record of your consent (which version, in which language, when given and when withdrawn), the categories you allowed at Tesla (vehicle information and location), whether you reach each vehicle as its owner or as a driver, and how much data your vehicles send.

2.3 Your vehicle

The Service collects the following from the vehicle maker's systems while the vehicle is awake.

• Identity and configuration: The vehicle identification number (VIN), model, trim, colours, options, name and picture.
• Location: Position, heading and speed over time, the routes driven, where the vehicle parks and charges, and the navigation destination with its arrival estimates.
• Driving: Trips with their times, distances, energy use, efficiency, elevation where reported, gear and power.
• Charging: Sessions with their times, places, power, energy, charger and cable type, battery level, the charge limit, and the charging schedule set in the vehicle.
• Condition: Battery level, range and capacity, odometer, tire pressures, inside and outside temperatures, climate, doors, windows and locks, security mode, sleep and wake, and software versions and updates. For a Tesla, whether someone is in the driver's seat. For a Rivian, the energy used while parked and what used it.
• What you add: Names you give to places and stops.

2.4 Technical information

• The Service uses cookies only to keep you signed in and to protect your sign-in. It sets no advertising or tracking cookies.
• An access log records each request's time, your IP address, the address requested and the result, to look into faults and abuse.
• Cloudflare Web Analytics measures two public pages, this notice and the agreement, and sets no cookie. Nothing you see after signing in is measured. At present there is no advertising and no other analytics. If that changes, the Operator will name the provider in this notice first.

2.5 What is not collected

Payment information, the location of your phone or computer, your contacts, advertising identifiers, and data from data brokers.

2.6 Other people

A vehicle's data describes whoever drives it. If other people drive a vehicle you connect, tell them (agreement, Section 2). If someone invites you, the Service receives your email address from them, to send the invitation and one reminder.

3. How it is used

• To collect, store, calculate and show your vehicle's data to you and to the person you allow.
• To sign you in and keep accounts secure.
• To send the mail the Service needs: Address confirmation, password reset, email change, invitations and security notices. No marketing mail is sent.
• To keep the Service running: Backups, fixing faults and preventing abuse.
• To estimate the outside temperature of a vehicle that does not report it, a Rivian, from weather data, and to show the weather of every vehicle's drives (rain, snow, wind and the wind along the route) beside their efficiency.
• To answer your requests. When you write for help, the Operator may look at your account details, your vehicle's connection status, recent data and logs related to your request.
• To make statistics of all accounts together that do not identify any person or vehicle, such as the number of vehicles or average distances by maker. The Operator may publish such totals.
• To comply with the law.

The Operator does not use your information for automated decisions with legal or similarly significant effects, for advertising, or to train machine-learning models.

4. Who receives it

The person you allow

You may allow one other account to see the vehicles you choose, view only, through Invite to Share. Either of you can end it at any time.

The vehicle makers

Tesla and Rivian receive the Service's requests made with your tokens. They already hold this data as your vehicle's maker. For a Tesla, Tesla also receives, as a separate controller, the requests made with the Operator's application, which name your vehicle by its VIN, the data settings sent to your vehicle, and information about how the interface is used.

Sign-in providers

Google, Microsoft, LinkedIn and Discord are involved only when you choose to sign in with one. They send back your identifier there, your email address and whether it is verified, and your name. The Service keeps neither your name nor their sign-in tokens.

Google user data

When you choose Continue with Google, the Service asks only for the scopes openid, email and profile. It uses what Google returns only to sign you in, to create your account if you ask, and to link Google to your account. It stores your Google account identifier, the email address Google reported and verified, and when you linked and last used it. It does not store your name, picture or Google's tokens. The Operator does not sell this information, use it for advertising, or use it to develop, improve or train any artificial intelligence or machine-learning model. Unlink Google in Settings › Account Management › Sign-in methods, or at myaccount.google.com/permissions. The Service's use of information received from Google APIs adheres to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Services that run the Service

Map and weather services

These receive coordinates only, with no account, name or vehicle identifier.

• OpenStreetMap's Nominatim and public Overpass servers turn a position into an address or a business name. The results are kept in a cache shared by all users and linked to no account.
• Open-Meteo gives the hourly temperature for a Rivian's places, the hourly weather for the places of every vehicle's drives, and the morning's forecast for each drive's starting place, each rounded to about 1 km, with their dates. Open-Meteo keeps its request logs for 90 days. You can turn this off in Settings › Preference.
• Map images are loaded by your browser from the map provider you choose, which sees your IP address and the area you view. A Google Maps link sends a place to Google only when you follow it.

The Operator

The Operator can access the database to run the Service, and looks at one account's data only to fix a fault, to answer that account's request, or to investigate abuse. The Operator's administration pages show, for each account, its email address, when it joined, when it last signed in and opened the Service, its monthly Fleet API use and the size of its data, for support.

Others, only if required

Information may be disclosed where the law requires it, or to protect the rights and safety of the Operator, users or others. If the Service is transferred to a company formed to operate it, your information moves with it under this notice, and the Operator will tell you beforehand.

5. Where it is kept

The Service is hosted in the United States, and encrypted backup copies are kept on storage under the Operator's control. If you use the Service from another country, your information is transferred to, stored and processed in the United States, whose privacy laws may protect you less than those of your country.

6. How long it is kept

• Account and vehicle data, for as long as your account exists.
• When you delete your account, your account, vehicles and all their history are deleted from the live database at once. Deleted data leaves the backups within 30 days. You can also clear a vehicle's history without closing your account.
• An account whose email address was never confirmed is deleted within 7 days.
• Server logs, up to 30 days, and up to a week more in the hosting provider's disk snapshot.
• Your monthly Fleet API use, while your account exists. The daily counts, for the current and the previous month.
• A record that an account, or a vehicle of a given maker, left, with no account or vehicle identifier, kept for the statistics of Section 3.
• The shared cache of addresses and business names, indefinitely. It is linked to no account.
• If the law requires something to be kept, or it is needed for an investigation of abuse already under way, only that is kept, and only for as long as needed.
• For a Tesla, before your account is deleted or a vehicle removed, the Service asks Tesla to remove that vehicle's data setting, so the vehicle stops sending data. The record of your consent is deleted with your account.

7. Security

Traffic is encrypted in transit. Passwords are stored as one-way hashes. Vehicle-maker tokens and two-factor secrets are encrypted. Two-factor sign-in and passkeys are available and recommended, and accounts lock after repeated failed sign-ins. Backups kept outside the hosting provider are encrypted.

The Service is run by one person without a security team, and no way of sending or storing information over the internet is completely secure. If a security incident affects your information, the Operator will tell you by email without undue delay, and tell the authorities where the law requires it.

8. Your choices and rights

• In the Service you can export your vehicle data, clear a vehicle's history, stop sharing, change your email address and password, and delete your account and everything in it.
• You can withdraw your Tesla Fleet API consent at any time: remove your Teslas (Database › Clear Data › Clear All Data), or with none left, press Disconnect Tesla account under Connected Accounts in Settings (before you have signed in to Tesla: Withdraw consent in Settings). Removing EV Logger from your Tesla account's third-party apps ends its access at Tesla.
• For anything else, write to [email protected] from your account's address. The Operator answers within one month, at no charge, and may ask you to confirm that you control the account.
• If you live in California: The Operator does not sell your information or share it for cross-context behavioural advertising, and does not treat you differently for exercising a right. The Service does not track you across sites, so it has nothing to change for a Do Not Track or Global Privacy Control signal.
• If you live in the European Economic Area or the United Kingdom and believe your information is processed unlawfully, you may complain to your local data protection authority.

9. Children

You must be at least 18 to have an account. If you believe a minor has created one, write to the contact address and the Operator will delete it.

10. Changes to this notice

The Operator announces material changes before they take effect, by email or by a notice shown when you sign in, unless a change must take effect sooner for legal, security or safety reasons. The date at the top shows when this notice last changed.

11. Contact

[email protected]