Privacy Policy

Last updated: 9 September 2026

This policy explains what personal data EV Navi (mapsev.com) processes, why, and your rights. Our servers are hosted by DigitalOcean in Frankfurt, Germany (EU).

What we collect and why

• Account: when you sign in with Google we receive your email address, name and profile picture. Used to identify your account and your subscription. A signed session cookie keeps you signed in.
• Location and routes: your position and the places you route to are processed to compute routes, traffic, weather and charger information. They are used for the request you make and are not sold or used for advertising. Diagnostic logs may contain approximate positions and are kept only as long as needed for troubleshooting.
• Vehicle data (optional): if you link a Tesla account we store the access credentials Tesla issues, your cars' identifiers and names, and the latest charge readings. If you use an OBD-II adapter we store the readings it posts with your token. Used only to show your live charge level and plan charging.
• YouTube (optional): if you connect YouTube in the Music screen we ask Google for read-only access to your YouTube account (scope youtube.readonly). We read the names of your playlists, the videos in them, your liked videos and the results of searches you type, and store the refresh token Google issues so you stay connected. This is used only to show and play that content inside the Music screen; we never post, modify or delete anything on your account, and we do not use this data for advertising or share it. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Disconnect at any time from the Music screen or at myaccount.google.com/permissions; disconnecting deletes the stored token.
• Payments: purchases are handled by Paddle.com as Merchant of Record. Paddle collects your payment details and billing address under its own privacy policy. We receive and store only your Paddle customer identifier and the status of your subscription; we never see card numbers.
• Technical data: IP address, browser type and error reports, used for security, rate limiting and fixing bugs.

How we protect your data

We apply the following measures to safeguard your information, and in particular sensitive data such as the Google/YouTube data you authorise, your Tesla vehicle credentials, and your location and routes:

• Encryption in transit: all traffic between your device, our servers and the providers we call is carried over HTTPS (TLS). HTTP Strict Transport Security is enforced across mapsev.com and its subdomains, so browsers only ever connect over an encrypted channel.
• Secure token storage: the OAuth tokens for sensitive access — your YouTube refresh token and the credentials Tesla issues — are held only on our servers, on a volume readable solely by the account service, with restrictive file permissions. They are never sent to the browser, embedded in pages, exposed to other services, or shared with third parties.
• Authenticated sessions: sign-in uses a cryptographically signed (HMAC-SHA256) session cookie marked HttpOnly, Secure and SameSite, so it cannot be read by scripts or replayed over an insecure connection. The signing key is stored server-side with restricted permissions.
• Least privilege: we request the minimum access needed — read-only for YouTube (youtube.readonly) — and never write to, modify or delete anything on your Google, YouTube or Tesla account. Payment card details are handled entirely by Paddle and never reach our servers.
• Access control and location: our servers are hosted by DigitalOcean in Frankfurt, Germany (EU), with administrative access restricted to the operator. Sensitive stores are not exposed to the public internet.
• Deletion: the YouTube token is deleted the moment you disconnect YouTube; Tesla credentials are deleted when you disconnect your car; and you can have your account and all its data deleted on request. You can also revoke our access directly in your Google or Tesla account at any time.

No method of transmission or storage is completely secure, but we work to protect your data using the measures above and review them as the service evolves. If a breach affecting your data occurs, we will notify affected users and the relevant authorities as required by law.

Third parties

We use map, traffic, weather, geocoding and charger data providers to serve your requests, Google for sign-in and for YouTube content you authorise, Tesla's Fleet API for vehicle data you authorise, and Paddle for payments. Each receives only what is needed for its function.

Retention

Account and subscription data are kept while your account exists. Vehicle credentials are deleted when you disconnect your car; the YouTube token is deleted when you disconnect YouTube. Diagnostic logs are short-lived. You can ask us to delete your account and its data at any time.

Your rights

You can access, correct or delete your data, withdraw consent for vehicle or YouTube access (disconnect in the app, or revoke in your Tesla or Google account), and object to processing. Contact [email protected]. EU residents may also complain to their data protection authority.

Cookies

We use a strictly necessary session cookie for sign-in and a guest cookie that protects map services from abuse. We do not use advertising or tracking cookies.