Privacy Policy

1. Data we process and how it is collected

• Account: an internal account identifier and, depending on how you signed up, an e-mail address. Accounts created by an in-app purchase have no e-mail or password, only the identifier.
• Subscription: the Apple App Store / Google Play transaction identifier (originalTransactionId, purchaseToken), product id, status and expiry, and the app-generated account token (appAccountToken). Payment details stay with the store.
• Tesla link: the access and refresh tokens Tesla issues when you connect your account, your vehicles' VINs and names, and the vehicle state needed for the queries and commands you request.
• Location: processed on your device. The server receives a location only inside a command you trigger (vent windows, HomeLink, send a destination) or an AI request, uses it for that request and does not store it. When the app requests a route from Kakao Navi, location goes from the app to Kakao directly.
• AI features: the text you send and the vehicle situation are forwarded to the Google Gemini API for processing. We store only daily / monthly usage counters, not the conversation — except in bug / idea reports you submit yourself, which keep what you attach.
• Access tokens and guest links you create, with last-used time and IP address (abuse prevention).
• Service logs: request time, IP address, path, error details.

Collected automatically while you use the Service, or entered / connected by you.

2. Purposes

• Verifying your subscription, providing Pro features, restoring purchases
• Reading Tesla vehicle state and executing the commands you request
• Generating AI assistant responses
• Account security, abuse prevention, incident response and service improvement
• Handling the enquiries and reports you send

3. Retention and deletion

• Account, Tesla tokens, access tokens, guest links, AI usage counters, reports, sessions: deleted without delay when you delete the account.
• Subscription transaction records: kept unlinked from the account and anonymised for accounting and refund / dispute handling, and deleted after the statutory retention period for payment records (5 years under the Korean E-Commerce Act).
• One-time web login codes: expire after 5 minutes, purged a day later.
• Service logs: up to 30 days.

Electronic records are destroyed irrecoverably.

4. Disclosure to third parties

We do not sell personal data or share it for advertising, and we disclose it beyond section 2 only in these cases:

• Tesla, Inc.: the vehicle queries and commands you request are forwarded to the Tesla Fleet API with your Tesla access token (Tesla's own privacy policy also applies).
• Where required by law or a lawful request of a competent authority.

5. Processors and cross-border transfers

• Apple Inc. (USA): in-app subscription billing, receipt verification, subscription notifications — transaction identifiers, account token.
• Google LLC (USA; Google Cloud, Gemini API): hosting (Cloud Run, Seoul region) and log storage, AI responses (request content processed, not stored), Google Play verification when Android is offered.
• Supabase, Inc. (USA; database region Seoul or Tokyo): authentication and database hosting — account, subscription, token and usage data.
• Kakao Corp. (Korea): location / destination the app sends directly for navigation (never via our servers).

Transferred over the network while you use the Service; retained per section 3; processors are bound by law and contract and we supervise them.

6. Your rights

• You may at any time request access, correction, deletion or suspension of processing of your data.
• Delete your account in the app (Settings → Delete account) or via DELETE /api/v1/account; data is then handled as in section 3.
• The Apple / Google subscription itself must be cancelled in the store's "Manage Subscriptions"; we cannot cancel it for you.
• The service key paired with your car can be removed in the car under Locks → Keys.
• Requests and questions: contact@alphacode.co.kr (handled within 10 days).

7. Security measures

HTTPS everywhere; access-controlled database with row-level security and service-account access; signed vehicle commands; signature verification of Apple / Google purchase data; automatic masking of tokens and e-mails in logs; minimal staff access.

8. Cookies and children

The web service uses cookies and browser storage only for the login session and language / theme preferences, no advertising or behavioural tracking. The Service is aimed at Tesla owners and drivers and does not knowingly collect data from children under 14.

9. Privacy officer

Privacy officer: the representative of AlphaCode, contact@alphacode.co.kr. You may also contact the Korea Internet & Security Agency privacy centre (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).

10. Changes

Changes are announced on this page at least 7 days before they take effect (30 days for changes unfavourable to you).