Privacy policy

Last updated: 2026-10-24

1. Who we are

mytesla.io (the "Service") is operated by Embay, LLC and is contactable at support@mytesla.io. (When you connect your Tesla, our app appears as "Embay, LLC" on Tesla's authorization screen — that's us.) This policy explains what personal data we collect about you when you use the Service, why we collect it, how long we keep it, and the rights you have over it.

2. What we collect

Account data — your email address (required for login via one-time code); an optional display name if you set one; the date your account was created. Stored in Cloudflare's infrastructure.

• Legal basis: Contract — we need this to provide the Service to you.

Tesla connection data — when you connect your Tesla account, Tesla issues us an OAuth access token and refresh token. We store these tokens encrypted at Cloudflare. We do not receive or store your Tesla account password. We also record the Tesla account identifier that Tesla includes in those tokens (an opaque ID, not your Tesla email), so we can tell when the same Tesla login is connected to more than one mytesla.io account.

• Legal basis: Contract; legitimate interest (keeping the free trial to one per person).

Vehicle identifiers - the VIN of each car on your connected Tesla account. We keep that list so we can act on a specific car when you ask us for help (for example, clearing a cached setting for one vehicle). We also keep a keyed, one-way hash of each VIN (not the VIN itself), and use it only to spot the same car being connected to more than one mytesla.io account. When two accounts share a Tesla login or a car, our team is alerted to review it; nothing is blocked automatically, and many shared cars are simply two drivers in one household.

Welcome-offer fingerprints - some promo codes (for example the welcome offer you can earn from freeteslacharging.com) can be used once per Tesla account and once per car. To enforce that, when you redeem one we store a keyed, one-way hash of your Tesla account identifier and of the VIN of each car on your account, together with which offer used them. The record holds no email address, account ID or name, and it is the only data we keep about your Tesla account or cars after you delete your account. We use it solely to enforce one welcome offer per Tesla account and car, and delete it 24 months after it is created.

• Legal basis: legitimate interest (preventing repeated use of a one-time offer).

• Legal basis: Legitimate interest (supporting your account; preventing abuse of the free trial).

iPhone app data - if you use the mytesla.io app for iPhone, the app signs you in to your existing mytesla.io account and keeps the resulting sign-in token in your iPhone's Keychain. It also keeps your car's last known status (battery, range, charging and climate state) on the phone, so the home screen widget and Siri can show it without a new request. Neither leaves the phone except as part of a request to our Service. The app has no analytics, advertising or crash-reporting software in it. When you use "Ask mytesla", the words of your request are understood by Apple Intelligence, on your iPhone or on Apple's Private Cloud Compute (your choice in the app's settings); we never receive the words, only the resulting commands, which are handled exactly like a command from any other AI assistant. Apple's handling of Private Cloud Compute requests is described in Apple's own privacy policy; Apple states that these requests are not stored and are not accessible to Apple.

• Legal basis: Contract - we need this to provide the app's features to you.

Vehicle data (transient) — when your AI assistant asks for your car's status or sends a command, we fetch live data from the Tesla Fleet API (battery level, location, climate, etc.) and return it to the assistant. We do not store this data on our servers by default. The exceptions are the vehicle identifiers described above, and the quality-of-service data each MCP tool call produces, which we record to keep the Service reliable and improve its quality: which tool was called, whether it succeeded, and how long it took (see "Usage logs" below). The data your commands return, such as your car's battery level or location, is not in that record; for a failed command, the record can include the error message, as described there.

• Legal basis: Contract.

Billing data — when you subscribe or buy a top-up, Stripe processes the payment. We store your Stripe customer ID and a record of subscription/invoice events (not your card number — Stripe holds that). See Stripe's own privacy policy for how they handle payment data: https://stripe.com/privacy.

• Legal basis: Contract + legal obligation (tax/accounting records).

Usage logs — for every MCP tool call, we record: your user ID, the tool name, whether it succeeded or errored, any error code, the latency, and the credits consumed. For some failures the error code is the start of the error message, and for some outcomes we also keep a short diagnostic note (up to 500 characters), such as an excerpt of the error Tesla returned; either can name a car on your account or include its VIN. We use these to compute your credit balance, diagnose errors, and aggregate overall service health. A shorter copy of each record (your user ID, the tool name, the outcome, the error code, the latency, and the credits used) also goes to our hosting provider's metrics store, Cloudflare Workers Analytics Engine, which deletes it automatically within three months. Google Analytics receives a separate, shorter event for each call, without the error message or the note (see "Usage analytics" below).

• Legal basis: Legitimate interest (operating and improving the Service).

Usage analytics - to keep the Service reliable and improve its quality, to understand how the Service is used, and to see which channels bring new users and paid subscriptions, our servers send Google Analytics a short event when our connector address (mcp.mytesla.io/mcp) receives a request, when your AI assistant connects to your account, for each tool call and each bug report filed, and when an account is created or a subscription starts. These events are sent whatever you chose in our marketing site's cookie banner. They go from our servers straight to Google: the signed-in service at mcp.mytesla.io runs no analytics script in your browser and sets no Google Analytics cookies. An event can contain:

• an identifier: your internal account ID (one we generate, not your email or name). The event for a request to our connector address never carries your account ID; whether or not you are signed in, it carries instead a code computed from the connecting IP address and user agent with a secret key that only we hold, so the code cannot be turned back into the IP address without that key;
• for a tool call: the tool name, its outcome (for example success, a Tesla error, or that your account had no subscription, no credits left, or no Tesla connected), how long it took, the credits used, and, if it failed, a short error label: a fixed code such as "missing_scopes", an HTTP status code, or the reason the car gave for refusing the command. Any other error is sent only as "other";
• for a bug report: the name of the failed tool as your AI assistant reported it, and the same kind of short error label;
• for a request to our connector address: the type of request (such as "initialize" or "tools/call"), the response status, and whether the request was signed in;
• which AI client made the request, read from its user agent (a user agent we don't recognise is sent as is, shortened to 100 characters);
• the country, region, and city that the connecting computer's IP address appears to be in (country and city only, for a request to our connector address). For assistants that reach us from their provider's servers, such as Claude.ai and ChatGPT, that is usually the provider's datacenter, not you; for an app on your own computer that connects to us directly, it can be your own approximate location;
• for a new account: the sign-up method and where you came from (source, medium, and campaign), taken from the campaign tags on the link you followed, a referral code, the name of the AI app you signed up through, or the website that linked you to mcp.mytesla.io and the first page you opened there (see "Attribution data" below);
• for a new subscription: the plan and its price and currency;
• technical fields such as a daily session number and whether the call came from our demo account.

If you accepted analytics cookies on our marketing site before signing up, your sign-up event carries the same Google Analytics identifier as your earlier visits from that browser, so Google Analytics can connect those visits to your account's later usage events, which carry your internal account ID. We do not send Google your email address, your Tesla tokens, the names or VINs of your cars, your bug-report description, or the data your commands return, such as your car's battery level or location, and the events do not include your IP address itself. We use this data only for the purposes above. We never sell or resell it, and we don't use it for advertising.

• Legal basis: Legitimate interest (keeping the Service reliable, improving its quality, understanding how it is used, and understanding which channels work).

Bug reports — if your AI assistant asks you whether you want to report a failed command as a bug and you say yes, we record the tool that failed, the error message, your own description (if you provide one), and your AI assistant's summary. The error message and the summary come from your AI assistant and can name a car or include its VIN. A short copy of the report (your user ID, the tool name, and the error code) also goes to the metrics store described under "Usage logs" above, and Google Analytics receives the event described under "Usage analytics" above.

• Legal basis: Legitimate interest + your consent at the point of filing.

Request metadata — IP address, browser user-agent, and request timestamps for a short window to support rate limiting and debugging. Typically purged within 30 days.

• Legal basis: Legitimate interest (security, abuse prevention).

Approximate location - when you sign in or open your dashboard in a browser, our edge provider (Cloudflare) tells us where your IP address appears to be: continent, country, region and region code, city, postal code, US metro area code, timezone, whether the country is in the EU, and coordinates we round to roughly 1 km (IP geolocation is city-grade at best - it usually points at your metro area, not your street). We keep the most recent snapshot on your account and refresh it as you come back, so it reflects where you are now rather than where you first signed up. We use it in aggregate to understand where our users are, and for support context (like knowing your timezone). This snapshot is never captured from AI-assistant traffic (that would usually locate the AI provider's datacenter, not you), it is never used to make decisions about your account or to gate any feature, it is included in your data export, and it is erased when you delete your account. The usage analytics described above are separate: they can carry an approximate location for a request, as explained there.

• Legal basis: Legitimate interest (understanding our market, support).

Email we send you, and a record of it: besides account emails (sign-in codes, verification, receipts, replies to your support messages), we send a small number of onboarding and usage emails: a welcome message when you sign up, occasional prompts if you've set up an account but haven't connected your car or your AI assistant yet, or if your connection has gone quiet for a few weeks, and - if you took the free trial and have unused credits about to lapse - one heads-up a few days before they expire that names the paid plans. There is no newsletter, no promotional campaign, and nothing is sent to a mailing list. Each one is triggered by the state of your own account.

For each email we record who it went to, which type it was, whether it sent, and whether it was opened or its link clicked. Open tracking is a 1x1 image and is unreliable by design: Apple Mail and Gmail routinely load it whether or not a human read anything, so we treat it as a rough signal, not proof you read an email.

Every onboarding or usage email carries a one-click unsubscribe, and opting out stops that whole category immediately. Account and billing emails are not affected by that choice, because skipping those would only hurt you.

• Legal basis: Contract (account emails); Legitimate interest (helping you actually set up and use the Service you signed up for), with an unconditional opt-out.

Attribution data — when you arrive at our marketing site via a link or ad, we record a first-touch attribution cookie (mt_attr) on .mytesla.io containing the referral source, medium, campaign, any ad click identifiers (e.g. utm_*, gclid), and the referring page. We read it once when you create an account to record which channel you came from. It's a first-party cookie, set without consent only outside the EEA/UK/Switzerland; within those regions it is set only after you accept the cookie banner.

We also record where a sign-up came from on mcp.mytesla.io itself. If your browser opens a page there (such as the sign-in page, or the page your AI assistant opens to connect) and does not already have mt_attr or mt_land, we set a first-party cookie, mt_land (on mcp.mytesla.io only, kept up to 90 days), holding the host name of the website that linked you there, if any, the path of that first page, and the time. It is not set when your IP address appears to be in a European Union country. If you follow a referral link, a mt_ref cookie (on mcp.mytesla.io only, kept 30 days) holds the referral code. If you sign up from an AI assistant's connection screen, we record the name that assistant registered with us (for example "ChatGPT"). When you create an account, we store what these signals show with your account and include the resulting source, medium, and campaign in the sign-up event described under "Usage analytics" above.

• Legal basis: Legitimate interest (understanding which channels work); for mt_attr, consent within the EEA/UK/Switzerland.

3. What we DO NOT collect

• We don't track you across other websites, and we use no third-party advertising cookies. The signed-in service at mcp.mytesla.io runs no analytics script in your browser and sets no Google Analytics cookies, but our servers do send Google Analytics the usage events described under "Usage analytics" above. (Our public marketing site, mytesla.io, uses Google Analytics, which sets analytics cookies only after you accept the cookie banner - see "Who we share with" below - and Cloudflare Web Analytics, which is cookieless and collects no personal data.)
• We don't read or store your Tesla's charge history, drive history, or navigation history beyond the single live snapshot requested by a tool call.
• We don't sell or resell your data, including the usage analytics described above, to anyone. Ever.
• We don't train AI models on your conversations, tool calls, vehicle data, or bug reports.

4. Who we share with

We share data only with the third parties below, each for the purpose shown:

The AI assistant you connect receives the results of the tools it calls, including your car's status and location, and its provider handles them under its own privacy policy. Apart from that, we do not share personal data with anyone else unless compelled by valid legal process or a court order. If that happens we'll notify you unless the order forbids it.

5. How long we keep it

• Account data: as long as you have an account. Deleted within 30 days of account closure.
• Tesla tokens: until you disconnect, or until they expire.
• Tesla account identifier: kept with your Tesla connection, and removed when you disconnect or delete your account.
• Vehicle identifiers: the VIN list is kept for up to 12 months after we last see a change to it; the VIN hashes, and any record that another account shares your Tesla login or car, are kept while your account exists, including after you disconnect your Tesla, so the check still works if the same car is connected elsewhere. All of it is erased when you delete your account.
• Welcome-offer fingerprints: the keyed hashes of your Tesla account identifier and VINs described in section 2 are kept for 24 months from the day they are created. Unlike the rest of your Tesla data they are not erased when you delete your account, because deleting the account would otherwise reset the one-per-Tesla-account-and-car limit. They contain no email address, account ID or name and cannot be turned back into a VIN or Tesla account identifier.
• Tool-call logs: 12 months rolling — older rows are deleted.
• Metrics copies of tool calls and bug reports (in Cloudflare Workers Analytics Engine, described under "Usage logs" in section 2): deleted automatically within three months.
• Google Analytics data (the usage events from our servers and the marketing site's analytics): Google keeps individual events for 14 months, the data-retention period set in our Google Analytics property, and then deletes them; totals in Google Analytics' standard reports can remain. Because our property restarts that period for your identifier each time a new event arrives from you, user-level data linked to your account ID is kept until 14 months after your last activity. These events are not deleted when you delete your account (see section 6).
• Financial events (invoices, payments): 7 years, because accounting rules.
• Bug reports: 12 months after the status becomes "fixed", "duplicate", or "invalid".
• Request metadata logs: 30 days.
• Sign-up attribution (where your account came from, described under "Attribution data" in section 2): kept with your account record, and kept with the anonymised record after you delete your account.
• Approximate location snapshot: most recent only - each refresh overwrites the last, so there is no location history. Erased on account deletion.
• Backups: a weekly snapshot of the database, kept 90 days, then deleted automatically. Deleting your account removes your data from the live database immediately; copies inside existing backups age out within that window, or we can purge them sooner on request.
• Email send records (which type was sent, when, whether it was opened or clicked): kept as a delivery log. On account deletion your email preferences, including your unsubscribe token, are deleted outright, and these records keep only the internal account identifier, which by then resolves to an anonymised account, not to you.

6. Your rights

Depending on where you live, you have some or all of these rights:

• Access — get a copy of your data. You can self-serve from Account → Download my data on the dashboard. The download is a summary: profile, the approximate-location snapshot described above, current subscription and credit balance, your Tesla account identifier and VINs, how many other accounts we have found sharing either, billing events with Stripe invoice IDs (so you can reconcile with your receipts), usage totals by category and by day, bug reports you've filed, and waitlist entries. Individual per-call records are aggregated into daily totals rather than itemised.
• Correction — fix anything inaccurate.
• Deletion — ask us to remove your account. You can self-serve at Account → Delete my account. Email, display name, Tesla connection tokens, vehicle identifiers, and your location snapshot are erased immediately (the welcome-offer fingerprints described in section 5 are the one exception), and the device you deleted from is signed out. Sign-in sessions on any other device are not individually revocable (they are signed cookies, not server records) and expire on their own within 14 days; nothing they can reach is still linked to you. Your usage, billing, and bug-report history is kept, without your email address or display name, for aggregate business analytics, tax / accounting, and to keep the bug tracker useful. In the tool-call history in our database, error messages and diagnostic notes are removed and only short error labels stay. Some records can still identify you, though: billing records keep the details Stripe sent us about each payment, which can include the email address and name on an invoice, for the 7 years accounting rules require (see section 5); a bug report keeps the error message it was filed with and your AI assistant's summary, either of which can name a car or include its VIN; and the metrics copies described under "Usage logs" in section 2 keep their original error codes until they are deleted automatically within three months. If you ever started a checkout, Stripe also keeps its own record of you, including your email address and internal account ID, under its own retention rules. Usage events already sent to Google Analytics are not deleted with your account: those keyed to your internal account ID stay keyed to it, along with any link to your earlier marketing-site visits (see section 2), and the ID then points to an anonymised record. Google deletes them as described in section 5. Active subscriptions cancel at the end of the current billing period per our billing policy.
• Portability — the self-serve export above is structured JSON, machine-readable.
• Object / restrict — tell us to stop or limit certain processing, if possible to do so.
• Withdraw consent — for anything based on consent, you can withdraw at any time.

Email support@mytesla.io with any request the self-serve flows don't cover. We'll respond within 30 days.

7. Security

• All traffic is HTTPS-only.
• Passwords don't exist — we use one-time email codes instead.
• Tesla tokens and Stripe secrets are stored encrypted at rest.
• Session cookies are HttpOnly, Secure, and SameSite=Lax.
• Rate limits on login and signup block brute-force attempts.
• In the iPhone app, your sign-in token is stored in the iPhone Keychain, and commands that could open the car ask you to confirm and only run from an unlocked phone.

If we ever suffer a breach that affects your data, we'll notify you within 72 hours as required by law.

8. Children

The Service isn't directed at anyone under 18 and we don't knowingly collect data from them. If you believe we have data on a child, email us and we'll delete it.

9. International transfers

We operate on Cloudflare's global network; your data may be processed in any region Cloudflare operates. Cloudflare's data processing agreement covers cross-border transfers. The other providers in section 4, including Google Analytics, may process the data they receive outside your country, including in the United States.

10. Changes to this policy

If we make material changes (new data types, new providers, longer retention), we'll email you at the address on your account at least 14 days before the change takes effect.

The update of 2026-10-03 corrected this policy's description of analytics, cookies, and providers that were already in use; it did not start any new data collection.

11. Contact

Questions? Complaints? Data requests?

Email: support@mytesla.io