myrobotaxi

MyRoboTaxi lets you watch your Tesla, share it with people you trust, and let them ask it for a ride. That means handling data about where your car is and where people are going, which is about as personal as data gets. This page sets out precisely what we collect, who can see it, how long we hold it, and how to delete it.

• Sign in with Apple is the only way into the app. There are no passwords.
• If you link a Tesla, we store detailed data about it, including its location and the full GPS trail of every drive.
• Location data is stored exclusively as encrypted ciphertext, under a key held outside the database. We cannot read your drives from the database, and neither can anyone who obtains a copy of it.
• Drives and their GPS trails are deleted automatically after one year.
• Someone you share a car with sees where it is, where it is going, and how charged it is — not what is playing, not the cabin, not the locks, and no controls.
• We do not sell your data. There is no advertising, tracking, or analytics code anywhere in the app.
• You can delete your account from inside the app, and two final steps happen on Tesla’s side.

Questions, corrections, or a request for your data: privacy@myrobotaxi.app.

MyRoboTaxi (“we”) operates from the United States. We write and run the iOS app, the server it talks to, and this website. We are the only party deciding what is collected and why, which makes us the ones answerable for it.

Two addresses reach us, and both are read by a person:

• privacy@myrobotaxi.app — for a copy of your data, a correction, a deletion, or any question about this page.
• support@myrobotaxi.app — for help with the app and everything else.

Your data is hosted in the United States. Our database and its backups sit in Supabase’s us-west-2 region in Oregon, our server runs on Fly.io in Ashburn, Virginia, and this website is served by Vercel. Nothing is stored outside the United States.

If you use MyRoboTaxi from anywhere else, your data is transferred to the United States and processed there, under United States law and the protections set out on this page. Using the app is your consent to that transfer. It is a real trade-off rather than a formality, which is why it is stated here and not in a footnote.

Sign in with Apple is the only way to sign in to the MyRoboTaxi app. There are no passwords, so there is no password for us to store or lose.

Apple sends us a signed token proving it is you, your email address, and — only the very first time you authorize the app — your name. Apple never sends it again, so we keep the name from that first sign-in. If you chose “Hide My Email,” the only address we ever see is Apple’s private relay address.

We store, on our server:

• Your name and email address, as Apple provided them.
• The account identifier Apple uses for you, which is how we recognize you on your next sign-in.
• Sign-in sessions — we keep a hash of each session token, not the token itself.

On your iPhone, the app keeps your session token in the iOS Keychain and caches your name and email in app storage so it can show them before it reaches the network. Signing out clears both.

Linking a car happens through Tesla’s own sign-in. We never see your Tesla password. You grant us permission to read your profile and vehicle data, read your vehicle’s location, and send commands to the car, including charging commands. You can withdraw that permission at any time from the Tesla app.

While a car is linked, our server stores and keeps up to date:

• Identity — VIN, the name you give it, model, year, colour, trim, licence plate, software version, and Full Self-Driving version.
• Where it is — precise coordinates, a street address we look up from them, speed, heading, gear, and odometer.
• Where it is going — the current navigation destination, its address, and the route line to it.
• Drive history — each drive’s start and end time and place, distance, duration, speeds, energy used, and the full GPS trail of the route taken.
• Battery and charging — charge level, charge state, estimated range, and time to full.
• Cabin state — interior and exterior temperature, climate settings, fan speed, seat heaters and coolers, and media volume.
• What is playing — the title, artist, album or station showing on the car’s screen. The app displays it; we store it as part of the car’s state. It is the one piece of vehicle data that says something about you rather than the car, and nobody you share the car with sees it.
• Service status — whether the car is in service and when it is expected back.

We can also send commands to the car: lock and unlock, start and stop climate and set temperatures, start and stop charging and set a charge limit, open the charge port and trunk, honk and flash, adjust the seats and media, and set a navigation destination. We send a command when you ask us to, with one exception: when you accept a ride we automatically send the car the pickup point, and when the ride starts we send the dropoff.

The MyRoboTaxi key you add to the car is what lets those commands be signed and accepted. Only you can remove it, from the car’s own touchscreen.

When a ride is requested, we store:

• Pickup and dropoff — the exact coordinates, plus the place name and street address shown in the app.
• Who and which car — the rider, the owner, and the vehicle.
• Times and status — when it was requested, any scheduled time, and each status change through to completion or cancellation.

A ride is always for the person requesting it. There is no way to book on someone else’s behalf, so we never ask for a third party’s name or phone number, and there is no SMS anywhere in the product.

Pickup and dropoff coordinates are sent to Tesla, because sending the car a destination is how the car learns where to go.

If you save a Home or Work place, we store its coordinates and the label you gave it.

An owner can share a car by generating a six-character invite code and sending the recipient a link. The code stops working after 7 days if it is not used.

That link looks like myrobotaxi.app/join/ABC123 and carries the sender’s and the recipient’s first names in the web address itself. We deliberately put only a first name there — the first word, letters only, cut off at twenty characters — because the link travels by text message, and a link that arrives by text should not carry somebody’s surname. Whatever messaging app you send it through can see those names, as can anyone who can see the message or its link preview.

If you turn on notifications, Apple issues a device token that we store against your account so we can reach that iPhone. When you sign out, the app hands the token back and we delete it, so a shared phone stops receiving the previous account’s alerts.

A ride in progress also uses a Live Activity, which has its own token tied to that one ride. We delete it when the ride ends, and a sweep clears any that are left behind within 24 hours.

• What a notification says — at most the requester’s first name and the car’s nickname. Never an address, a place name, or coordinates.
• What the Live Activity shows — ride status, estimated arrival, the car’s nickname, and your destination’s label, such as “Home.” That label is on your lock screen and is readable without unlocking the phone.

You can turn off each kind of alert separately in the app, and all of them in iOS Settings.

The app asks for your location only while you are using it, and uses it to centre the map, to fill in “Current location” as a pickup point, to bias place search toward where you are, and to draw the blue dot. There is no background location and no continuous tracking — the app never follows you around when it is closed.

Your location reaches our server only as the pickup point of a ride you request. Turning a coordinate or a typed search into a place name uses Apple’s Maps services on your device, which means those coordinates and search terms go to Apple under Apple’s privacy policy, not ours.

These never leave your device, and we never receive them:

• Recent destinations — the last five places you chose, so they are one tap away next time.
• Last known vehicle positions — a small cache, up to twelve cars and thirty days, so the map opens where the car was last seen.
• Your view preference — whether you last used owner or rider view.
• Whether we have already asked about notifications, so you are not asked twice.

The recent-destinations list is never uploaded. If you choose one of those places and book a ride to it, that single destination is sent as part of the ride request, like any other.

The iOS app contains no third-party analytics, crash-reporting, advertising, or attribution software. Its only outside code dependency is a package we wrote ourselves. There is no advertising identifier, no App Tracking Transparency prompt, and no cross-app or cross-website tracking, because there is nothing in the app that could do it.

We do not sell your personal information and we do not share it with advertisers or data brokers. No code path for doing so exists in the app, the server, or this website.

myrobotaxi.app serves three pages: a coming-soon page, this policy, and the invite landing page at /join/{CODE}.

• The invite page does not look your code up. It renders the code and the names straight from the address you arrived on. It makes no call to our server and never touches our database.
• No cookies and no tracking on any of these pages. We set no cookie for a visitor without an account, and there are no analytics scripts or tracking pixels.
• Fonts are served from this domain, not fetched from Google, so loading a page here does not tell anyone else that you did.
• Standard server logs. Our host, Vercel, records the usual web server access log — IP address, time, page requested, browser — for every request.
• Error monitoring. We use Sentry to catch server errors, and invite codes are stripped out of web addresses before anything is sent to it, because a code in a link is itself a credential. The route that browser-side error reports would travel through is closed on these public pages, so nothing is sent to Sentry from your browser.

We do not run our own hardware. These companies process data on our behalf, each for a single purpose:

• Apple — sign-in, push notifications, and the Maps services the app uses on your device to turn coordinates and searches into place names.
• Tesla — the source of all vehicle data, and the recipient of the commands and navigation destinations we send on your behalf.
• Fly.io — hosts our server.
• Supabase — hosts our database and its backups.
• Vercel — hosts this website.
• Mapbox — turns coordinates into street addresses, on our server and nowhere else. When we work out where a drive started and ended, where a car is parked, or the address it is navigating to, we send those exact coordinates to Mapbox. Neither the iOS app nor this website contacts Mapbox at all.
• Sentry — error monitoring for this website, as described above.

That is the whole list, and we review it with every update to this page. Adding a company that handles your data means changing this section first.

We may also disclose data if the law requires it, but no such request has been made.

Everything we store is held in one of three forms:

• Encrypted, as AES-256-GCM ciphertext and in no other form — your car’s coordinates, the route it is following, the GPS trail of every drive, the pickup and dropoff coordinates of every ride, the coordinates of the Home and Work you save, the Tesla tokens that let us talk to your car, and the sign-in tokens from every provider we support.
• Stored as text — your name and email address, the street address and place name for a drive’s start and end and for where a car is parked, licence plates, and notification tokens. These are protected by our database host’s disk encryption and access controls.
• Stored as a hash — your sign-in sessions. We hold a fingerprint of each session token rather than the token itself.

Data in transit is encrypted as well. Cars connect to our server using mutual TLS, so both ends prove who they are. Invite codes and notification tokens are treated as credentials and kept out of our logs, and VINs appear in logs only as their last four characters. Coordinates, addresses, email addresses, and tokens are not written to logs.

• Live vehicle state — overwritten each time it updates. We keep no history of it.
• Drives and their GPS trails — kept for one year, then deleted automatically. A job runs once a day and removes every drive older than 365 days, taking its trail with it. The one-year window is fixed in our code rather than being a setting. Each pass records one audit entry per car — how many drives it removed and the dates they span, with no coordinates, addresses, or routes.
• Rides — kept as history for both the rider and the owner, and deleted when the car is removed or when either of you deletes your account. Historic ride records are subject to the same retention windows as current ones.
• Invite codes — stop working after seven days, or as soon as the owner revokes them.
• Sign-in sessions — expire after ninety days without use, and are revoked immediately when you sign out or delete your account.
• Live Activity tokens — deleted when the ride ends; anything left over is swept within 24 hours.
• Our audit log — a permanent record of significant actions, holding identifiers, action names, and timestamps only. No names, locations, or addresses.
• Server logs — retained for our hosting provider’s standard period.
• Backups — our database host retains encrypted backups for up to thirty days, with a seven-day window for point-in-time restore. Deleted data remains recoverable from a backup for that period.

You can delete your account from inside the app, under Settings. It is not a request and there is no waiting period — it happens immediately. We:

• cancel any ride you have open
• ask Tesla to revoke our access to your account
• delete every car you added, along with its drives, trip stops, route data, and ride records
• revoke every share you granted and every share granted to you
• delete your notification devices and your saved places
• revoke your sign-in sessions
• delete your Apple sign-in link and your account itself

What survives deletion, and why:

• Audit log entries, which record that something happened and when. They hold no names or locations.
• Rides in the other party’s history. If you rode in someone else’s car, that ride is their record too, and it stays. Your name is not shown against it.
• A record that a share was revoked, including the label the owner typed for the person, and a record that a VIN was removed.
• Your notification preference toggles — five on/off settings, which hold no personal information and are not attached to a working account once yours is gone.
• Backups, for up to thirty days, as above.

One consequence worth knowing: if an owner deletes their account, the ride records for their cars go too — including from the ride history of everyone who rode in them. A rider deleting their account does not remove anything from the owner’s history.

• Delete your account, and everything above happens.
• Revoke or suspend any share you have granted, at any time, from the app.
• Unlink your Tesla, or revoke our access from the Tesla app directly.
• Turn off any category of notification in the app, or all of them in iOS Settings.
• Turn off location access for the app in iOS Settings. Pickup will need to be chosen manually.

If you want a copy of what we hold about you, or you want something corrected, email privacy@myrobotaxi.app and we will take care of it.

MyRoboTaxi is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has given us data, write to privacy@myrobotaxi.app and we will delete it.

These hold wherever you live. We do not ask for a reason and we do not charge for any of them.

• See what we hold about you. Most of it is already in the app — your cars, your drives, your rides, your saved places. For a complete export, including anything the app does not display, email privacy@myrobotaxi.app.
• Correct it. A car’s details and your saved places are editable in the app. Your name and email come from Apple, so write to us and we will change them by hand.
• Delete it. Settings, then delete your account — it runs immediately, with no request to approve and no waiting period, exactly as described above. Write to us instead if you would rather we did it.

We never sell personal data. That is not a policy we could quietly reverse: no code path for selling, sharing, or brokering it exists anywhere in the app, the server, or this website, and building one would be a change large enough to appear on this page first.

If personal data is exposed, we notify the users affected without undue delay, and in any case within 72 hours of confirming it. The clock starts when we confirm a breach, not when we finish investigating it — a notice that waits for a complete picture arrives after it was useful.

The notice tells you what was exposed, when, what we have done about it, and what you should do. We notify regulators as well where the law requires it. If we are still working out the scope, we say so rather than delaying the notice until we are not.

If the product is sold, merged, or otherwise transferred, your data goes only to a party that has committed in writing to protections at least as strong as the ones on this page. We tell you before that happens, not after, so that deleting your account first is a real option rather than a theoretical one.

If MyRoboTaxi shuts down instead, user data is deleted within thirty days of the service ending. It is not held for a buyer who might appear later.

We update this page whenever our practices change — a new kind of data, a new company processing it, a different retention period — and we move the effective date at the top when we do. If a change materially affects you, we tell you in the app rather than editing this page quietly.

One thing to weigh the rest of this page against: it is written from a direct audit of our own source code — the iOS app, the server, and this website — and we are the ones who conducted it. No independent party has reviewed our systems or verified the claims here. That is the honest standing of this document, and you should read it knowing so.

MyRoboTaxi is an independent product and is not affiliated with or endorsed by Tesla, Inc. or Apple Inc.