Flying Blue Doxie EV LoggerPrivacy Notice

Pre-release edition · Effective September 30, 2026

In short

• The Service records where your vehicle goes, how it is driven and how it charges. That is its purpose, and it is sensitive information. Please read Section 2.
• Your data is yours. It is not sold, and it is not shared with anyone except the providers needed to run the Service (Section 4) and the one person you allow to see the vehicles you choose, such as someone in your household (Section 2.8).
• There is no advertising and no tracking across sites, and the only cookies are the ones signing in needs (Section 2.4). Two public pages (this notice and the agreement) are measured with Cloudflare Web Analytics, which sets no cookie; nothing you see after signing in is, and neither is the sign-in page. Section 2.7 says what it receives, and what happens first if any of this changes.
• The Operator looks at statistics of all accounts together, such as how many vehicles there are and how long they are driven on average, to run and plan the Service; never at one account's or one vehicle's, except a live count of vehicles by what they are doing, which with few vehicles can be one vehicle's (Section 3).
• You can export your vehicle data and delete your account, with everything in it, from within the Service at any time.
• The Service is run by one individual in California, and your data is stored in the United States.

1. Who is responsible

Flying Blue Doxie EV Logger (the "Service") is operated by James Jung, an individual residing in California, United States (the "Operator", "I", "me"), as a personal, non-commercial project. The Operator decides how and why your personal information is processed and is the "controller" of it where that term applies. Contact: [email protected].

2. What is collected

2.1 Your account

• Your email address.
• Your password, stored only as a one-way hash.
• If you turn on two-factor sign-in: its secret, stored encrypted, and your recovery codes, stored as hashes.
• If you choose not to be asked for a code on a browser for 30 days: a record of that browser, which is a hash of a random token kept in its cookie (Section 2.4), a hash of your password hash and two-factor secret as they were then (so that changing either ends it), how many wrong passwords were entered on it, when you chose it, when it was last used and when it lapses. No name, address or details of the browser or device.
• If you add passkeys: for each, its public key, the name you give it, when it was added and last used, a counter your device keeps, whether your device syncs it, and how your device says it can be reached (for example "internal" or "usb"); and one random identifier the Service gives your account for passkeys. The private key never reaches the Service: it stays with your device, or with the passkey provider you use (such as your phone's or browser's password manager), which may sync it to your other devices and keeps your account's email address as the passkey's name. The Service never receives your fingerprint, face or device PIN.
• Your preferences: theme, units, time zone, and similar settings.
• Invitation records: who invited you, the email address an invitation was sent to, and which of your invitation codes was used by which account.
• Sharing records: the account you are connected with for sharing, who invited whom and when it was approved, and which of your vehicles you have chosen to share (Section 2.8).
• Security records: counts and times of failed sign-ins and of password-reset requests, used to lock an account under attack.

2.2 Your vehicle-maker account

• The access and refresh tokens that the vehicle maker issues when you connect a vehicle, stored encrypted.
• Your vehicle-maker password is not stored. Where a sign-in requires it, it is passed to the maker and held in memory only for the few minutes that sign-in takes.
• Identifiers the maker assigns to you and your vehicle.

The Tesla sign-in helper. You may connect a Tesla with the Service's browser extension, "Flying Blue Doxie EV Logger sign-in for Tesla", instead of pasting tokens. It runs in your browser only. It opens Tesla's own sign-in page, where you type your Tesla password and codes; they never reach the extension or the Service. When Tesla finishes, the extension exchanges Tesla's one-time code for tokens directly with Tesla and hands them to the Service's page that asked, which stores them as described above. The extension works on the Service's address and in the Tesla sign-in tab it opened, and on no other site. It keeps a sign-in in progress in your browser's memory for at most 15 minutes, writes nothing to disk and sends nothing to the Operator or anyone else. You can remove it at any time in your browser's extension settings.

2.3 Your vehicle

Collected from the vehicle maker's systems, continuously while the vehicle is awake:

• Identity and configuration: the vehicle identification number (VIN), model, trim, colours, options, name, and images of the vehicle.
• Location: the vehicle's position, heading and speed over time, the routes it drives, where it parks and charges, and the navigation destination set in the vehicle together with the arrival estimates the vehicle reports.
• Driving: trips with their times, distances, energy use, efficiency, elevation, gear and power.
• Charging: sessions with their times, places, power, energy, charger type and battery level, and the charging schedule set in the vehicle (when charging is set to start, or the departure time and whether it charges off-peak).
• Condition: battery level, range and capacity, odometer, tire pressures, inside and outside temperatures, climate settings, doors, windows and locks, security-mode state, the state of driver-assistance parking and summon features, sleep and wake times, software versions and updates, and, for a Rivian, the energy used while parked and what used it (vehicle systems, outlets, climate, security mode).
• Inside the vehicle, for a Tesla only: whether someone is in it, and what its media player is playing (the title, artist and source).
• What you add: names you give to places and stops, and their positions.

The street addresses and business names shown for a position are looked up from public map data (Section 4). For a vehicle that does not report outside temperature (a Rivian), the outside temperature shown for a finished drive, park, charge or sleep is estimated from weather data (Section 4) and marked "Est.".

2.4 Technical information

• Cookies, each strictly necessary for signing in: - jawn_session, which keeps you signed in; the Service cannot work without it. - jawn_signup, set when you create an account, so that the confirmation link signs you in only in that browser; it lapses with the link, within 24 hours. - __Secure-jawn_device, only if you choose not to be asked for a code on that browser: it holds a random token for each account that chose it on that browser, is sent only to the Service's account addresses (those under /api/auth), and lapses after 30 days.

Your theme choice is kept in your browser's local storage.

• Sessions are stored without your IP address and without device or browser details. A session notes whether it began on a trusted browser or with a passkey, so that forgetting that browser or removing that passkey ends it.
• The Service keeps a record that a mail of a certain kind was sent and when, not to whom.
• The Service keeps an access log: for each request, the time, your IP address, the method and address requested, the status and size of the answer and how long it took. It does not hold cookies, your browser's user agent, or the one-use codes a sign-in carries in an address. The Service's own logs may also contain email addresses used at sign-in and VINs. Both are kept to look into faults and misuse (Section 6 says for how long). Cloudflare, which carries all traffic to the Service, processes your IP address (Section 4).
• An IP address that submits wrong invitation codes is slowed down. That record is kept in memory only and is lost when the Service restarts.

2.5 What is not collected

No payment information. No location of your phone or computer. No contacts. No data bought or obtained from data brokers. No advertising identifiers, and no usage tracking of what you do after signing in; two public pages are measured as Section 2.7 describes. The statistics of Section 3 are drawn from vehicle data the Service already holds, not from what you do in the Service.

2.6 Other people

A vehicle's data describes whoever is driving it. If other people drive a vehicle you connect, the Service records their journeys too. You are responsible for telling them, and for having the right to connect the vehicle (EULA, Section 2).

If someone invites you, the Service receives your email address from that person and uses it to send the invitation and, if it is still unused about a day before it expires, one reminder. An unused invitation expires after 7 days.

2.7 Analytics and advertising

Cloudflare Web Analytics, on two public pages. From the effective date of this notice, this notice and the agreement are measured with Cloudflare Web Analytics (the sign-in page was until then, and no longer is), a script from Cloudflare, Inc., which already carries all traffic to the Service (Section 4). It tells the Operator how often those pages are opened and how quickly they load. For each time one of them is opened it sends Cloudflare the address of the page, the address of the page that linked to it, and how long the page took to load; like any web request it also shows Cloudflare your IP address, from which Cloudflare derives a country, and your browser and operating system. Cloudflare states that Web Analytics sets no cookie, stores nothing in your browser, and does not fingerprint visitors or follow them from one site to another.

Nothing you see after signing in is measured. Cloudflare adds the script to every page it delivers; on every page other than those two, the Service instructs your browser not to load it (a content security policy). The pages that show a vehicle, its location, a VIN or your account therefore send that script nothing, and neither do the pages reached from a mailed link or an invitation.

There is no advertising and no third-party tracking of any other kind. The Operator may add other analytics, or advertising, later. If that happens:

• this notice will be changed first, naming each provider, what it receives and why, and you will be told as Section 10 describes;
• where the law requires your consent (as it does in the European Economic Area, the United Kingdom and Switzerland for non-essential cookies and similar technologies), the feature will stay off for you until you give it, and you will be able to withdraw it;
• where the law gives you a right to opt out (as California does for the "sale" or "sharing" of personal information), you will be given a way to do so, and a Global Privacy Control signal from your browser will be honoured as an opt-out.

2.8 Sharing with someone you allow

You may allow one other account, for example someone in your household who uses the same vehicle, to see the vehicles you choose. Nothing is shared unless you do all of this:

• You create an invitation link in Settings ("Invite to Share") and send it yourself; the Service does not send it. The link works once and expires after 7 days.
• The person opens it, signs in or creates an account, and accepts.
• You see the email address of the account that accepted, and approve it. Until you approve, and if you do not approve within 7 days, nothing is shared.
• You choose which of your vehicles that person may see. A vehicle you add later is not shared until you choose it.

The person you allow can then see everything the Service shows about those vehicles, in the same way you do: their location history, drives, charges, parking and sleep, the names you gave to places and stops, and the rest of Section 2.3, past and present. They can only look: they cannot change, export, import or clear any of it, and they cannot act on the vehicle or on your vehicle-maker account. You may be each other's person, and each of you then chooses which of your own vehicles the other sees; neither of you can pass access on to anyone else.

You can stop sharing a vehicle, or end the connection, at any time, and so can the person you allowed; access ends at once. It also ends when either account is deleted or the vehicle leaves your account. If other people drive a vehicle you share, their journeys are shown too (Section 2.6).

3. Why it is used

Your information is not used for automated decisions that have legal or similarly significant effects, and it is not used to train machine-learning models. At present it is not used for advertising, and for analytics only as Section 2.7 describes and for the statistics below, and no marketing mail is sent; marketing mail, if ever introduced, will be sent only with your consent and with a way to stop it.

The Operator's statistics. The Service's administrator accounts can see figures about all accounts together: how many accounts and vehicles there are, how many accounts use two-factor sign-in, how many accounts are connected for sharing and how many vehicles are shared, how many joined or left in a day, week or month, and, for each maker, averages per vehicle such as drive time, distance and charging over the last 30 days. They are computed inside the Service from data it already holds; no one else receives them. They never show one account or one vehicle, and a maker with fewer than three vehicles is shown as a count only, since an average of one vehicle would be that vehicle's.

The Operator's service monitor. To keep the Service running, the administrator accounts also see, for all vehicles together and read again every 30 seconds, how many vehicles are driving, charging, parked or asleep right now, how many accounts hold a vehicle, and, for each maker, how many vehicles sent data in the last 15 minutes and the last 24 hours and how long ago the latest data arrived. These figures are exact: while there are few vehicles, a count of one can be one vehicle's state at that moment, and an administrator who knows what their own vehicles are doing may tell whose it is. They show no name, place or other figure of any vehicle, and they are not kept.

4. Who receives it

Your information is not sold. At present it reaches the following, and no one else:

The person you allow. The one account you approve sees the vehicles you choose, as Section 2.8 describes, and no one else's.

The vehicle makers. Tesla and Rivian receive the Service's requests, made with your tokens. They already hold this data as your vehicle's maker and handle it under their own privacy policies.

Providers that run the Service.

Public map services. To turn a position into an address or a business name, the Service's server sends coordinates, with nothing that identifies you or your vehicle, to OpenStreetMap's Nominatim service and to public Overpass servers (overpass-api.de in Germany, overpass.kumi.systems). The results are kept in a cache shared by all users; it holds public map data and is not linked to any account. When you search for an address in Settings, your browser sends the text you type directly to Nominatim, which therefore also sees your IP address.

Weather. For a vehicle that does not report outside temperature (a Rivian), the Service's server asks Open-Meteo (open-meteo.com) for the hourly temperature where the vehicle was, after each drive, park, charge or sleep has ended, and for those recorded before this began. It sends the places where the vehicle stood, or for a drive a point along its route for every 15 minutes it lasted (so a long drive's route at about 1 km), each rounded to about 1 km (two decimal places), in shuffled order, with the dates they fall on, and nothing that identifies you or your vehicle; the request comes from the Service's server, so your IP address is not sent. Open-Meteo keeps its request logs, which contain those points, for 90 days. Nothing is sent for a time when the vehicle's location is hidden, and nothing for a vehicle that reports its own outside temperature. You can turn this off in Settings > Preference ("Estimate outside temperature from weather"); from then on nothing more is sent for your vehicles, and turning it on again sends the records still without an estimate. The Service may later use another weather provider for this; this notice will name it first.

Map tiles. Maps are drawn from images that your browser loads directly from the map provider you select: OpenStreetMap, OpenTopoMap, CyclOSM, or Esri. That provider sees your IP address and which area of the map you are viewing, and handles it under its own privacy policy.

Google Maps links. A pin beside a drive, a park, a sleep or a security-mode session opens that place, or the drive's route, in Google Maps in a new tab. Only when you follow it does your browser send those coordinates to Google, with your IP address (and your Google account, if you are signed in to Google); the address of the page you left is not sent. Google handles them under its own privacy policy.

The Operator. The Operator can access the database to run the Service, and looks at an individual account's data only to fix a fault, to answer that user's request, or to investigate abuse. The Operator holds the keys to the encrypted items and to the backups (Section 7): encryption protects a copy that leaves the Operator's control, not against the Operator.

Others, only if required. Information may be disclosed where the law requires it, or to protect the rights and safety of the Operator, users or others. If the Service is transferred to a company formed to operate it, your information moves with it under this notice, and you will be told beforehand.

5. Where it is kept

The Service is hosted in the United States. Backup copies are also kept on storage equipment under the Operator's physical control in California; those copies are encrypted, and the key that opens them is not kept with them. If you use the Service from another country, your information is collected directly into, and stored and processed in, the United States, whose privacy laws may protect you less than those of your country.

6. How long it is kept

• Account and vehicle data: for as long as your account exists.
• When you delete your account, your account, your vehicles and all of their history are deleted from the live database immediately and cannot be recovered. You can also clear a vehicle's history without closing your account.
• Backups are overwritten on a rolling schedule. Deleted data disappears from the last backup within 30 days. Backups are not used for any other purpose in the meantime.
• An account whose email address was never confirmed is deleted automatically, within 24 hours if no confirmation link is outstanding and within 7 days otherwise.
• Sign-in sessions and mailed links expire by themselves. The record of mail sent is kept for about a month.
• A trusted browser: 30 days from when you chose it, or until you forget it in Settings, change your password or two-factor sign-in, reset your password, or enter a wrong password on it three times; its record is removed 30 days after it lapses.
• Passkeys: until you remove them (also by choosing so when you change your password), reset your password, or delete your account. A passkey sign-in or registration already used is remembered for about 5 minutes (at most 10), so it cannot be used twice; that record holds a hash and a time, nothing about you.
• Sharing records: an invitation until it is used or expires; a connection and your choice of vehicles until either of you ends it or deletes the account.
• Server logs, the access log among them, are kept for up to 30 days, on the server that runs the Service and nowhere else: they are not part of any backup.
• The shared cache of addresses and business names is kept indefinitely; it contains no personal information.
• An estimated outside temperature is kept with its drive, park, charge or sleep and is deleted with it. The count of weather requests made for your account is kept for two days, to hold each account to its daily limit.
• When an account is deleted or a vehicle removed, the Service keeps a record that one account, or one vehicle of a given maker, left, and when, with nothing that identifies it. It is kept indefinitely, for the statistics of Section 3.

7. Security

Traffic is encrypted in transit. Passwords are stored as one-way hashes; session and link tokens are stored as hashes; vehicle-maker tokens and two-factor secrets are encrypted in the database. Of a passkey only the public key is stored, which cannot sign in by itself. Two-factor sign-in and passkeys are available and recommended. Accounts lock after repeated failed sign-ins. Backup copies kept outside the hosting provider are encrypted as a whole, and the key that protects the encrypted items above is never included in a backup.

No system is perfectly secure, and the Service is run by one person without a security team. If a security incident affects your information, you will be told by email without undue delay, and the authorities will be notified where the law requires it. You can end the Service's access to your vehicle at any time by changing your password with the vehicle maker.

8. Your choices and rights

Everyone can, from within the Service: export their vehicle data; clear a vehicle's history; stop sharing a vehicle or end a sharing connection; change their email address and password; and delete their account and everything in it.

Requests. For anything the Service does not let you do yourself, write to [email protected] from the address of your account. You will get an answer within one month. There is no charge. You may be asked to confirm that you control the account.

If GDPR or UK GDPR applies to you, you have the right to: be told whether your information is processed and receive a copy; have inaccurate information corrected; have your information erased; have its processing restricted; receive it in a portable format; object to processing based on legitimate interests; and complain to the data-protection authority where you live. No automated decisions with legal or similar effects are made about you.

If you live in the Republic of Korea:

• The person responsible for personal information is the Operator, James Jung, [email protected]. Requests to access, correct, delete or suspend the processing of your information, or to withdraw consent, go to that address and are answered without delay, within 10 days.
• Location information. The Service collects and stores your vehicle's location to show you your drives, stops and charges. You consent to this when you connect a vehicle. You can withdraw that consent at any time by deleting your account or by changing your password with the vehicle maker, which ends collection; you can delete the location history already collected with the "clear data" tool. Your vehicle's location is not provided to any third party, other than as coordinates without any identifier sent to the public map services described in Section 4, and to the one person you yourself allow to see the vehicles you choose (Section 2.8), which you can end at any time.
• Your information leaves Korea. The Service has no presence in Korea. Your information is sent over the internet, encrypted, directly to the United States as you use the Service and as your vehicle reports, and is processed there by the recipients listed below, for as long as your account exists (Section 6). You may refuse this transfer by not creating an account, or end it by deleting your account; the Service cannot be provided without it.
• When information is deleted, it is erased from the live database at once in a way that cannot be recovered, and from backups as they are overwritten (Section 6).
• You may bring a complaint or seek mediation through the Personal Information Protection Commission (pipc.go.kr), the Personal Information Dispute Mediation Committee (kopico.go.kr), or the KISA Privacy Infringement Report Center (privacy.kisa.or.kr, telephone 118).

Recipients of your information outside Korea:

If you live in California: your personal information is not sold. At present it is not shared for cross-context behavioural advertising, and none is disclosed to third parties for their direct marketing; if that changes you will be given the right to opt out first (Section 2.7). You will not be treated differently for exercising any right described here. At present the Service does not track you across sites, so there is nothing for it to change in response to a "Do Not Track" or Global Privacy Control signal.

9. Children

The Service is for adults. You must be at least 18 to have an account. If you believe a minor has created an account, write to the contact address and it will be deleted.

10. Changes to this notice

Material changes will be announced by email or by a notice shown when you sign in, before they take effect. The date at the top shows when this notice last changed.

11. Contact

[email protected]