Privacy Policy

1. Scope

This Privacy Policy describes how BaristaLabs, LLC ("we," "us," or "our") handles information when you use the Supercharger Rally iPhone application, the website at superchargerrally.app, and the related cloud service (together, the "Service").

2. Information we collect

Tesla account and authorization

You sign in through Tesla’s authorization service. We receive an account identifier and authorization tokens that allow the Service to perform the features you approve. Tesla access and refresh tokens are encrypted at rest. We do not receive or store your Tesla password.

Vehicle information and commands

We process the vehicles available to your authorized Tesla account, including identifiers, display names, online or asleep status, and command results. Your navigation selection is stored on your device, and your participating Rally vehicle is stored by the Service. When you ask to send checkpoints, or enable Keep Route Rolling for a Rally you started, we process the ordered destinations and command metadata needed to deliver one signed navigation command per batch. Supercharger Rally does not issue vehicle wake commands.

If you choose Import Tesla History, we retrieve charging sessions for the current calendar year for the vehicles you select. We cache session identifiers, VIN, charging time, site name, energy, cost when available, and the matched Rally checkpoint so the import is deduplicated. Confirmed imports keep Tesla’s original charging date. Your selected vehicles then receive adaptive automatic history checks; you can change those selections from Profile. Only Tesla-verified, fair-play-eligible sessions count toward competitive visits, energy, achievements, Rally or Dash runs, and leaderboards.

To apply fair-play rules without collecting phone location, we use Tesla-provided VIN, charging-session times, matched checkpoint locations, and the participating-vehicle selections you make. We store vehicle participation periods and eligibility decisions. We do not collect a phone route or continuous device location for this purpose.

Phone location

With your permission, the app uses your phone’s location to find nearby checkpoints, display your position, detect arrival near a committed checkpoint or Poker Run card drop, and calculate an optimized multi-stop route you request. A Poker Run card claim sends the current coordinate, observation time, and horizontal accuracy needed to check the drop radius. We store the accepted drop, distance, accuracy, and claim time, but not the submitted coordinate. Other location and route requests are used for proximity, geographic search, or on-demand road routing. Optimized plans are returned to the app and are not stored as a phone route history. We do not build or store a continuous movement history.

Rally activity

We store captures and related rally information such as the Supercharger checkpoint, visit time, energy delivered when available, achievements, committed next target, and leaderboard statistics. This information powers your history, progress, automatic next-stop flow, and anti-abuse checks.

Poker Runs

If you participate in a Poker Run, we store the run, invitations and responses, player list, card drops, accepted card claims, randomly assigned cards, best hand, result, winner status, and collectible token award. Live hands and invitation responses remain restricted to eligible participants. Organizer-created runs may be invite-only or publicly discoverable. You must join a public run before Rally monitors its card drops or lets you claim cards. Before you join, Rally does not show you the live player roster, claim identities, or claim times. When a run finishes, its player names, revealed hands, results, drop locations, and token can appear on public profiles and a shareable result page. We do not publish live player locations.

If you organize a Poker Run, we receive the name, description, dates, player invitations, card-drop details, and token description you enter. We send token descriptions through our content-safety service before generation. Approved token prompts are sent to fal.ai for image generation. Generated artwork is normalized through Cloudflare Images when available and stored in our Cloudflare R2 bucket. Failed generation jobs may be retried through a bounded queue.

Private and published Trips

Trip drafts are files in the app's private iCloud Documents container, cached on your device for offline use. iCloud can synchronize a draft across your iOS devices signed into the same Apple account. A private Trip may contain a name, description, route, charging-session references, added stops, tags, selected photo copies, and photo time or location used on the device to suggest a stop. BaristaLabs does not receive or store that private Trip draft. Apple handles its private iCloud storage under your Apple account and Apple's terms.

When you choose Publish, we receive the Trip details and selected photos shown in the publishing preview. We reconstruct charging facts from your verified Rally history instead of trusting editable copies from the phone. We store a private publication package, review state, and a public version containing the route, selected stops and photos, Trip-level energy and charging cost, achievements, and the public username that published it. We normalize photos to remove embedded metadata before upload and re-encode approved images before public delivery. Published Trip pages can be indexed, cached, linked, and reshared.

Optional leaderboard profile

You are anonymous on leaderboards by default. If you accept the current Leaderboard & Public Profile Terms and opt in, we collect the public username you choose and a contact email. We publish an opaque, shareable profile URL containing your username, eligible leaderboard results, verified Rally and Dash summaries, completed Poker Run results and wins, aggregate unique-stop, region, distance and charging-energy totals, and achievement names and unlock dates. We do not publish your contact email, Tesla or vehicle identifiers, precise location, individual charging sessions, subscription status, or send usage. Public pages may be indexed, cached, or reshared by others. Leaving the leaderboards disables the profile and removes you from future leaderboard results, although copies outside our control may remain. If you report a leaderboard username or a public Poker Run, we retain the reported account or run, the public name shown at the time, the report category, and your account as the reporter so we can review abuse and prevent duplicate reports. Reporting hides the reported profile or run for your account. Reporting a public Poker Run also blocks its organizer from sending you future Poker Run invitations or appearing in your public-run discovery.

Purchases and usage

Apple processes payments. We receive purchase and subscription records such as product, transaction identifiers, entitlement status, and expiration or revocation information. We also keep monthly waypoint-send counts and estimated Fleet API request cost so we can show usage and enforce the stated fair-use limit.

Technical information

Our infrastructure may process standard request metadata such as IP address, timestamps, user agent, response status, and diagnostic logs for security, reliability, and troubleshooting. The website does not use advertising cookies.

First-party product analytics

The app sends a small set of authenticated events to our own service when you navigate Achievements, create a local Trip, or submit a Trip for publication. These events help us find confusing or broken product flows. They may include a selected country code, category, achievement identifier, unlock state, Trip stop or photo count, app version, and build number. They do not include achievement search text, Trip names or notes, photo contents, precise location, Tesla credentials, contact email, or vehicle identifiers. Supercharger Rally contains no third-party analytics SDK or advertising tracker.

Aggregate Apple Analytics

Apple provides App Store acquisition and commerce reports and, for users who choose to share usage and diagnostics with Apple, privacy-thresholded usage and crash reports. We import only standard aggregate daily totals for operating the Service. We do not import detailed report dimensions or use this information to identify individual users.

3. How we use information

We use information to:

• authenticate your account and maintain your session;
• find unvisited Superchargers, optimize multi-stop Rally routes you request, and send destinations you select;
• detect and record eligible checkpoint arrivals;
• show visits, achievements, usage, subscriptions, and opt-in leaderboards;
• operate Poker Runs, deliver invitations, assign cards, determine results, generate winner tokens, and prevent abuse;
• publish and display a Trip only after you submit it and accept the Trip Publishing Terms;
• review public Trip and Poker Run content for safety and respond to content reports;
• protect the Service, prevent abuse, and enforce usage limits;
• diagnose errors, maintain reliability, and respond to support requests;
• understand whether the Achievement discovery experience is useful and improve its navigation; and
• comply with legal obligations.

4. When information is shared

We disclose information only as needed to operate the Service, including to:

• Tesla, to authenticate your authorization and retrieve vehicle data or send a command you request;
• Apple, to provide iOS functionality, validate App Store subscriptions, and supply privacy-preserving aggregate App Store Analytics;
• Google Maps Platform, which receives public Supercharger identity and coordinates only when the Service needs a missing Google Place ID for Tesla’s ordered navigation command; Rally stores and reuses that identifier and performs only a limited periodic identifier validation;
• Cloudflare, which hosts our website, API, database, public Trip media, image processing, security, and operational logs;
• content-safety providers, which receive text or images when you submit a Trip for publication or a Poker Run token description so the material can be checked before it appears publicly;
• fal.ai, which receives an approved Poker Run token description to generate token artwork; and
• professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, or complete a business transaction subject to appropriate safeguards.

We do not sell or rent personal information. We do not share personal information for cross-context behavioral advertising.

5. Retention

We retain account and rally data, including vehicle participation periods and session eligibility decisions, while your account is active and as needed to provide the Service. Private Trip drafts remain on your iPhone. We retain submitted publication packages while they are reviewed and retain published versions while they are public. Moderation, content-report, and required legal records may be kept after public content is hidden or unpublished when needed for safety, repeat-abuse prevention, or law. First-party product analytics events are automatically deleted after 90 days. Shorter-lived operational logs are retained according to our service providers’ and our diagnostic needs. Purchase records may be retained as needed for entitlement integrity, fraud prevention, accounting, and legal compliance.

When you delete your account in Profile, we delete the account and associated rally records from the active database. Some information may persist temporarily in backups, security records, or records we must keep by law.

6. Your choices and controls

• Location: change the app’s location access in iOS Settings. Arrival detection and nearby checkpoint features may not work without it.
• Leaderboard and public profile: opt in by accepting the current participation terms and creating a profile. Leave the leaderboards to disable your public profile and remove your identity from future results. You may also use Report & Hide on another player’s row to report an inappropriate username and hide that profile from your authenticated leaderboards.
• Poker Runs: public organizer-created runs are visible in discovery, but Rally does not monitor their card drops until you choose Join. You may use Report & Hide on a public run to report it, hide it, and block future Poker Run invitations and discovery from its organizer.
• Trips: create and edit private Trips across your iOS devices through your private iCloud account. Publishing to Rally requires a public Rally profile, an eligible subscription, a separate publishing action, and acceptance of the current Trip Publishing Terms. You can unpublish from the app.
• Tesla access: revoke authorization through your Tesla account. You can also log out of the app.
• Account deletion: use Delete Account in the app’s Profile tab.
• Subscription: manage or cancel through your Apple ID subscription settings.

To ask a privacy question or exercise an applicable privacy right, email privacy@baristalabs.io. We may need to verify your request.

7. Security

We use safeguards designed for the sensitivity of the information, including encrypted transport, encrypted Tesla tokens at rest, signed vehicle commands, access controls, and server-side authorization checks. No system is perfectly secure, and we cannot guarantee absolute security.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Vehicle operation and Tesla-account eligibility remain governed by Tesla’s requirements and applicable law.

9. Changes to this policy

We may update this policy as the Service changes. We will post the updated policy here and revise the effective date. If a change is material, we will provide additional notice when appropriate.

10. Contact

Questions about this policy can be sent to privacy@baristalabs.io. For product help, visit Support.