Privacy, in three lines.

The short version below is binding: it is how we handle data today and throughout beta. The codriver.io service is operated by 9570-6198 Québec inc. (NEQ 1182296179), the data controller (responsable du traitement) for the personal information described here. The core privacy commitments Quebec's Law 25 requires — who controls your data, what we collect, why, how long we keep it, and your right to access and correct it — are already in force during beta, set out below. An expanded Privacy Policy (naming our third-party processors and detailing PIPEDA and GDPR compliance) ships alongside paid launch (Phase 7). It will expand on what's here, not contradict it.

• Pseudonymous by default. An email is the only required identity — burner addresses are first-class, no KYC ever. Reading the map requires no account; community alerts are submitted unsigned.
• Identity is opt-in. Nicknames, reputation tiers, and profile pages are opt-in features. Until you opt in, you stay anonymous.
• You stay in control of what you share. Favorites live in your car browser's local storage by default; you can opt to sync some of them to your profile if you want them across devices. Your current position and trips are never recorded on the server. An opt-in trip-history feature may land later, but it will never be a requirement.
• Telemetry is event-level, not location-level. Backend latency, UX score, GPS continuity. The privacy gate rejects forbidden fields (GPS coordinates, route polylines, destinations, addresses) at ingest, not after the fact.
• Connecting your Tesla account is optional and read-only. Pairing your car with codriver never asks for your tesla.com login — pairing is a QR scan against your codriver account. Separately, if you link your Tesla account, codriver reads two things: the destination already set on your car's screen, and your car's configuration so the Garage shows the right vehicle. The destination is fetched live at the moment you open the app and is never stored on our servers. codriver holds no command permission — it cannot unlock, drive, or even wake your car. Disconnect any time from your account page, or revoke it at tesla.com.
• “Continue with Tesla” grants the same read-only access, at sign-in. If you sign in with Tesla instead of Google or a magic link, the consent screen Tesla shows you covers exactly the permissions above — your identity, your vehicle list and configuration, and vehicle location for the destination hand-off. Nothing more is requested at sign-in than by the Connect button, and the same disconnect and revocation paths apply. Signing in with Google or email instead keeps your Tesla account entirely out of it; the Garage still works, you just build it by hand.
• EU residency: Helsinki, Finland. All user data, alerts, feeds, and entitlement state on Hetzner Helsinki. GDPR coverage, out of reach of US data acts.
• Refuse non-justice-system data requests as policy. Marketing, advertiser, and partner inquiries to share user data are refused outright. We comply with court orders in the user's relevant jurisdiction only.
• No third-party trackers. Self-hosted Plausible only. No GA, no FB pixel, no cookie-consent banner because we don't set tracking cookies. No SSO upsell — magic-link auth only.
• Privacy officer (Quebec Law 25). A designated person is responsible for the protection of personal information (responsable de la protection des renseignements personnels). Reach them at [email protected].
• We can't sell what we don't have.