Privacy Policy

01 Overview & Who We Are

OptiFlux ("we," "us," "our") is an intelligent EV charging optimization service developed by ASR Enterprises. OptiFlux connects to your Tesla vehicle via the official Tesla Fleet API to schedule charging during the cheapest and cleanest grid periods, helping you save money and reduce carbon emissions automatically.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. By creating an account or using the OptiFlux app, you agree to the practices described here.

Contact: privacy@optiflux.app

02 What Data We Collect

2.1 Account Data

When you create an account we collect:

• Email address — used for authentication and service communications.
• Authentication tokens — Firebase ID and refresh tokens are protected on-device using iOS secure storage. The app sends short-lived ID tokens to our API over HTTPS so the server can verify each authenticated request. We never receive your Firebase password.
• Sign-in method — Email/Password or Google Sign-In (Apple Sign-In forthcoming). We do not receive your Google or Apple password; only the OAuth identity token.

2.2 Tesla Vehicle Data

After you authorize OptiFlux via Tesla's official OAuth flow, we access the following vehicle data to operate the service:

2.3 Charging Session Records

When OptiFlux starts or detects a charging session, we record:

• Start and end timestamps
• Start and end battery level
• Estimated energy added (kWh)
• Estimated cost (based on your configured rate plan)
• Charger power (kW)
• Rate period (off-peak / peak / etc.) at session start

These records power your historical analytics (lifetime savings, total energy added, session history).

2.4 User Preferences

We store the settings you configure in the app:

• Ready-by time (target charge completion hour)
• Minimum battery percentage (range-safety floor)
• Charge limit target
• Time-of-use (TOU) rate plan / utility rate schedule
• Charging optimization objective (Savings / Greenest / Balanced)
• Onboarding completion status

2.5 Device & Notification Data

If you enable push notifications, we store your device's Expo push token in our database. This is used only to send you charging status alerts (e.g., "Auto-charging started — $0.09/kWh"). We do not use push tokens for marketing or advertising.

2.6 Grid & Energy Data

To optimize charging schedules, OptiFlux fetches publicly available electricity market data:

• Retail electricity rates — from the U.S. Department of Energy's OpenEI Utility Rate Database (URDB) and pre-curated time-of-use plans. This is public pricing data; no personal information is involved.
• Grid carbon intensity — from Electricity Maps (when enabled). Your vehicle's or phone's latitude and longitude may be sent to Electricity Maps' API to retrieve the relevant carbon signal. See their privacy policy.

2.7 Usage & Technical Data

Our servers automatically log standard request metadata: timestamps, HTTP method/path, response codes, and anonymized error traces. We do not collect device identifiers, ad IDs, browsing history, or behavioral analytics beyond what is described above.

03 How We Use Your Data

04 Data Sharing & Third Parties

We share data only with the service providers necessary to operate OptiFlux:

We require all providers to protect your data under terms consistent with this policy. We do not sell, rent, or trade your personal information to any third party.

We may disclose data if required by law, court order, or to protect the rights and safety of OptiFlux, its users, or the public. We will notify you of such disclosures to the extent legally permitted.

05 Tesla & Vehicle Data

OptiFlux integrates with Tesla's Fleet API under Tesla's third-party developer program. By connecting your Tesla account, you authorize OptiFlux to access your vehicle through Tesla's official OAuth 2.0 flow with the minimum necessary scopes:

• vehicle_device_data — read charge state, battery level, location
• vehicle_charging_cmds — start and stop charging
• vehicle_cmds — lock/unlock, climate, other manual controls

All commands sent to your vehicle use Tesla's Vehicle Command Protocol (VCP), which requires an end-to-end cryptographically signed message authenticated by a virtual key you install in your vehicle's Bluetooth key ring. OptiFlux's signing keys are stored as access-controlled Railway service variables and are never committed to source code. We cannot issue commands to your vehicle without your virtual key authorization and without the full VCP signature chain.

You can revoke OptiFlux's Tesla access at any time from your Tesla Account security settings. Revoking access immediately stops all scheduled commands. We will retain your charging session history and preferences for up to 30 days after disconnection, after which they are deleted unless you request earlier deletion.

06 Location Data

OptiFlux uses your vehicle's GPS coordinates (latitude and longitude), which are included in the Tesla vehicle data your car reports when awake. Location is used only to:

• Determine which electricity grid zone you are in (e.g., CAISO, ERCOT, NYISO) so we can retrieve accurate local pricing and carbon intensity data.
• Select the most relevant retail rate schedule from OpenEI's URDB.

OptiFlux may request foreground access to your iPhone's location when you ask it to find a local tariff or set your home charging location. It may also receive vehicle location from Tesla when that scope is available. Phone location is not collected in the background.

07 Data Retention

You may request immediate deletion of all your data at any time (see Your Rights section). Deletion requests are processed within 30 days.

08 Security

We implement industry-standard technical and organizational safeguards:

• Encryption in transit: All client-server communication uses TLS 1.2+ (HTTPS). Tesla API communication uses TLS enforced by Tesla's endpoints.
• Encryption at rest: Railway encrypts databases and persistent volumes at rest. Tesla tokens are stored in the protected PostgreSQL service and operational secrets are held in Railway service variables.
• Authentication: Firebase RS256 JWT verification on every API request. Tokens are short-lived and rotated automatically.
• Vehicle command security: All vehicle commands use Tesla's VCP protocol — end-to-end signed with P-256 ECDH and per-session nonces. Commands cannot be replayed.
• Infrastructure: Backend services run in isolated Railway containers with HTTPS-only public API access; PostgreSQL and Redis remain on Railway's private network.
• Secrets management: Operational credentials are stored in Railway service variables. They are not logged or committed to source code.

09 Children's Privacy

OptiFlux is not intended for use by children under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided us personal information, we will delete it promptly. If you believe we have inadvertently collected data from a minor, please contact us at privacy@optiflux.app.

10 Your Rights & Choices

Access

You can view all data OptiFlux holds about you by contacting us. We will respond within 30 days.

Correction

You can update most personal data (preferences, rate plan, ready-by time) directly in the OptiFlux app. For corrections to account data, contact us.

Deletion ("Right to be Forgotten")

You may request deletion of your account and all associated data at any time by:

• Emailing privacy@optiflux.app with subject "Delete my account"
• Or through the account deletion option in the app Settings (coming soon)

We will delete all personal data within 30 days except where retention is required by law. Anonymized, aggregated statistics (e.g. total kWh charged across all users) are not deleted.

Portability

You may request an export of your data in a structured, machine-readable format (JSON). Contact privacy@optiflux.app.

Opt Out of Push Notifications

Disable push notifications at any time through iOS Settings → Notifications → OptiFlux. Disabling notifications does not affect the charging scheduler.

Revoke Tesla Access

Disconnect OptiFlux from your Tesla account at any time via Tesla Account → Security → Third-Party Apps → OptiFlux → Revoke. This immediately stops all scheduled commands.

11 California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we collect, use, disclose, or sell.
• Right to Delete: You may request deletion of personal information we hold about you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising. No opt-out action is required.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise your CCPA rights, contact us at privacy@optiflux.app or by mail to the address below. We will verify your identity before processing requests.

Categories of Personal Information Collected (CCPA)

12 International Users (GDPR & Global)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent laws grant you additional rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object to processing based on legitimate interests (Art. 21)

Our primary data processing infrastructure is in the United States (Railway). By using OptiFlux, you consent to your data being transferred to and processed in the United States. We apply the same safeguards described in this policy regardless of where data is processed.

If you are in the EEA and wish to lodge a complaint, you have the right to do so with your local Data Protection Authority. We ask that you contact us first so we can resolve your concern directly.

For GDPR inquiries, contact: privacy@optiflux.app

13 Changes to This Policy

We may update this Privacy Policy as our practices evolve or as required by law. When we make material changes, we will:

• Update the "Effective Date" at the top of this document
• Send a push notification or in-app alert to existing users
• For significant changes, request renewed consent where required by law

Continued use of OptiFlux after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree, you may delete your account at any time.

Previous versions of this policy are available upon request by emailing privacy@optiflux.app.

14 Contact Us

Questions, requests, or concerns about this Privacy Policy or your personal data can be directed to: