Privacy, in three lines.

The short version below is binding: it is how we handle data today and throughout beta. The codriver.io service is operated by 9570-6198 Québec inc. (NEQ 1182296179), the data controller (responsable du traitement) for the personal information described here. The core privacy commitments Quebec's Law 25 requires (who controls your data, what we collect, why, how long we keep it, and your right to access and correct it) are already in force during beta, set out below. An expanded Privacy Policy (naming our third-party processors and detailing PIPEDA and GDPR compliance) ships alongside paid launch (Phase 7). It will expand on what's here, not contradict it.

• Pseudonymous by default. An email is the only required identity; burner addresses are first-class, no KYC ever. Reading the map requires no account; community alerts are submitted unsigned.
• Identity is opt-in. Nicknames, reputation tiers, and profile pages are opt-in features. Until you opt in, you stay anonymous.
• You stay in control of what you share. Favorites live in your car browser's local storage by default; you can opt to sync some of them to your profile if you want them across devices. Your current position and trips are never recorded on the server. An opt-in trip-history feature may land later, but it will never be a requirement.
• Telemetry is event-level, not location-level. Backend latency, UX score, GPS continuity. The privacy gate rejects forbidden fields (GPS coordinates, route polylines, destinations, addresses) at ingest, not after the fact.
• Connecting your Tesla account is optional and read-only. Pairing your car with codriver never asks for your tesla.com login; pairing is a QR scan against your codriver account. Separately, if you link your Tesla account, codriver reads two things: the destination already set on your car's screen, and your car's configuration so the Garage shows the right vehicle. The destination is fetched live at the moment you open the app and is never stored on our servers. codriver holds no command permission: it cannot unlock, drive, or even wake your car. Disconnect any time from your account page, or revoke it at tesla.com.
• “Continue with Tesla” grants the same read-only access, at sign-in. If you sign in with Tesla instead of Google or a magic link, the consent screen Tesla shows you covers exactly the permissions above: your identity, your vehicle list and configuration, and vehicle location for the destination hand-off. Nothing more is requested at sign-in than by the Connect button, and the same disconnect and revocation paths apply. Signing in with Google or email instead keeps your Tesla account entirely out of it; the Garage still works, you just build it by hand.
• Car route is opt-in, and it is the one feature that reads your route. If you turn on Car route (a Premium feature) and add codriver's virtual key in the Tesla app, your car streams four things to us while it drives: the route its navigation has planned, the destination's position, the destination's name and the odometer. We do not ask your car for its live location. The route is held temporarily on our servers so the app in your car can draw it; it is cleared when your car reports that the route has ended, and it expires on its own after six hours at most. It is not kept as trip history. We do keep a daily count of how many messages your car sent, with no content, to account for what the feature costs. Odometer readings are stored only if you have separately opted in to usage and distance badges, which is off by default, and opting out deletes them. The key is used to set up this data stream and nothing else: codriver cannot send a command to your car or wake it. Turn Car route off from your account page, which asks your car to drop the configuration, or remove the key in the Tesla app, at any time.
• EU residency: Helsinki, Finland. All user data, alerts, feeds, and entitlement state on Hetzner Helsinki. GDPR coverage, out of reach of US data acts.
• Refuse non-justice-system data requests as policy. Marketing, advertiser, and partner inquiries to share user data are refused outright. We comply with court orders in the user's relevant jurisdiction only.
• No third-party trackers. Self-hosted Plausible only. No GA, no FB pixel, no cookie-consent banner because we don't set tracking cookies. No SSO upsell: magic-link auth only.
• Privacy officer (Quebec Law 25). A designated person is responsible for the protection of personal information (responsable de la protection des renseignements personnels). Reach them at privacy@codriver.io.
• We can't sell what we don't have.