Privacy Policy

This policy describes how ChargeTrackr ("we", "the service") handles personal information at www.chargetrackr.com. It applies to everyone who visits the site, whether or not they have an account.

ChargeTrackr is an independent project. It is not affiliated with, endorsed by, or operated by Tesla, Inc.

Only what the features need. Each item below says why it exists, and nothing is collected "just in case".

Your email address

The identity of your account. Used to sign you in, to send verification and password-reset links, and to reach you about the service. It is never displayed to other users.

Your display name

Chosen by you at sign-up, or derived from your Google profile name. This is the name that appears beside a car you publish to the leaderboard.

Your password

Stored only as a one-way hash that cannot be turned back into the password, not even by us. If you only ever sign in with Google, no password is stored at all.

Google account details

If you sign in with Google, we receive your email address, name and profile picture URL, and store the identifiers needed to recognise you on your next sign-in. We hold no long-lived Google credential, so we cannot reach your Google account when you are not signing in.

A Tesla refresh token

Held encrypted, and only if you connect a Tesla account. It is what lets the nightly import fetch new charging sessions without asking you to sign in to Tesla each time. Alongside it we keep a one-way fingerprint of your Tesla account's identifier, which is what stops the same Tesla account being connected to two ChargeTrackr accounts.

Your vehicles

For each car: its VIN, the model line, the name you gave it in the Tesla app, and whether you have published it. The VIN and the car's name are both encrypted, the name because owners very often name a car after a person. Section 4 covers how those are protected.

Your Supercharging sessions

For each session Tesla reports: the site name, the start and end time, the energy delivered, and the amount billed. We match the site to a public Supercharger location so it can be mapped.

Security records

Counters used to rate-limit sensitive actions such as signing in. These are keyed by email address and by IP address, and are the only place the application itself stores an IP address; our host keeps ordinary server access logs, as every host does. We also store one-way hashes of the verification and reset links we email you, so a link can be used once and never twice.

Your time zone

A cookie holding the IANA time zone your browser reports, so timestamps read correctly. It is a preference, not an identifier.

How the site is used

Google Analytics records which pages are opened, roughly where in the world from, and what kind of device — enough to tell which parts of the service people actually use. It runs for every visitor, signed in or not. It is never joined to your account: we do not send it your identity, and it receives nothing about your cars or your charging.

There is no advertising on the site, we do not build advertising profiles, and we do not sell or share personal information for advertising or any other marketing. Analytics is the one thing here that watches how the site is used, and section 5 says what Google receives.

Every car is private by default. Publishing is a per-car choice you make on your account page, the exact text that will go live is shown to you before it does, and you can remove a car from the leaderboard at any time.

For a car you publish, anyone visiting the site can see your display name, the model line of the car, the name you gave it in the Tesla app if it has one, and its totals for the year: the number of distinct Supercharger sites visited, the total energy taken, the longest chain of new sites, and the number of sessions counted.

These are never published, for any car:

• Your VIN, in whole or in part
• Your email address
• What you paid, at any site or in total
• Individual charging sessions, their times, or their locations
• Your home, your routes, or any live position of a car

Unpublishing removes the car from the leaderboard immediately. It cannot reach into copies made while it was public, such as a search engine's cache or a screenshot someone took, which is why the confirmation says what is about to become public before it does.

Two totals for the service as a whole appear on the home page: how many charging sessions have been imported, and how many kilowatt-hours they add up to. Those count every car, including ones nobody has published, because they describe the service rather than anyone in it. They are not broken down by person, car, site or date, and no amount anyone paid appears in them.

• Everything travels over HTTPS, and the connection to the database is encrypted as well.
• VINs, the names of your cars and the Tesla token are encrypted, so a copy of the database on its own reveals none of them and cannot reach anyone's Tesla account.
• Passwords are stored only as a one-way hash and cannot be recovered, including by us.
• Sensitive actions are rate limited to slow down automated abuse.

No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, please tell us before disclosing it publicly. Contact details are in section 11.

ChargeTrackr runs on other companies' infrastructure. Each one below receives only what its job requires and handles it under its own privacy policy. The providers we pay, Amazon Web Services and Resend, process it only to provide their service to us.

Tesla, Inc.

The source of your charging history. Connecting your Tesla account sends you to Tesla to sign in; we never see your Tesla password. The permissions we request are the charging-history scope and the vehicle-data scope used to read the names of your cars.

Google

Two separate things, and they are not connected. If you choose to sign in with Google, they authenticate you. Separately, Google Analytics measures how the site is used: it runs for every visitor and receives your IP address, which pages you open and what kind of device you are on. Your IP is used to work out a rough location and is not stored by Google Analytics. Nothing about your account, your cars or your charging is sent to it.

Amazon Web Services

Hosting, application logs and the database. Data is stored in the United States.

Resend

Sends verification, password-reset and notification email. Receives your email address and the contents of those messages.

OpenFreeMap

Supplies the background map tiles. When a map loads, your browser requests tiles directly from them, so they receive your IP address and which part of the map you are looking at. They do not receive your account, your cars or your sessions.

We will also disclose information if the law requires it, or where it is necessary to investigate abuse or protect the safety of people using the service.

Account information and charging history are kept for as long as your account exists, because the service is a record of your charging over time and deleting last year's sessions would defeat the point of it.

Disconnecting Tesla on your account page deletes every charging session and every vehicle we hold for you, along with the stored token. The confirmation tells you exactly how many of each will go. This is immediate and cannot be undone; the data can only come back by reconnecting and importing it again from Tesla.

One honest limitation: disconnecting discards our copy of the Tesla token but does not revoke it at Tesla's end, so it remains valid there until it expires on its own. To revoke it immediately, remove ChargeTrackr from the third-party apps list in your Tesla account.

Rate-limit counters and used email-link records are operational data, not tied to anything you see in the app. Those belonging to your account are removed when you delete it.

You can do all of these yourself, at any time:

• Change your display name, on your account page
• Change or add a password, on your account page
• Publish or unpublish any car, on your account page
• Disconnect Tesla, which deletes all imported vehicles and sessions
• Delete your account outright, on your account page. This is immediate and permanent: it removes the account, your sign-in details, every vehicle, every charging session and the stored Tesla connection, and it cannot be undone

To ask for a copy of your data, to have something corrected, or to ask a question about anything on this page, contact us from the address on the account. Contact details are in section 11.

Depending on where you live you may have additional rights over your personal information, including the right to access it, correct it, delete it, or object to how it is used, and the right to complain to your local data protection authority. We honour these requests regardless of where you live rather than only where the law compels it, and we will not treat you differently for making one.

ChargeTrackr's own cookies do three things: keep you signed in, protect the sign-in forms against forgery while you are using them, and remember your time zone so that dates and times display correctly. Google Analytics sets its own as well, so that a returning browser is recognised and one visit is counted as one visit rather than several. None of them is used for advertising.

ChargeTrackr is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, tell us using the details in section 11 and it will be removed.

If this policy changes in a way that affects what is collected or who it is shared with, the date at the top will be updated and, where the change is significant, we will email account holders before it takes effect. Continuing to use the service after a change means you accept the updated policy.

ChargeTrackr does not have a published contact address yet. One will be added here once it is set up, and the date at the top of this page will change when it is.

You do not need one in order to leave. Deleting your account, and every vehicle and charging session attached to it, is a button on your account page and takes effect immediately.

See also the Terms of Service.