Privacy policy

Effective October 24, 2026

kWhKey is published by Malina LLC ("kWhKey", "we"). This policy covers the kWhKey apps for Android phones and Wear OS watches, the kWhKey server they talk to, and this website. It says what kWhKey collects, why, who else receives it, how long it is kept and how to delete it.

The short version: kWhKey collects what it needs to show and control your car, and it keeps a history of it - including where the car has been. It is kept on kWhKey's own server in the United States. It is not sold, and there are no ads.

What kWhKey keeps on its server

• Your sign-in. You sign in on Tesla's own page, and kWhKey never receives your password for it. Tesla then hands kWhKey tokens for your account: permission to read your profile, your cars' data and their location, and to send them commands, charging commands included. The tokens are stored encrypted and are used only to talk to Tesla for your household.
• Your account. From Tesla: the ID of your account there, your email address, and your first name, which names your household ("Sam's household"). kWhKey also keeps the time zone your household reckons in. It has no mailing list, and its server sends no email.
• Your cars. For each car: its VIN, its name in kWhKey, model and year, Tesla's own number for it, and how Tesla says it is built - paint, wheels, trim, options, and which seats and whether the steering wheel can be heated. For the Bluetooth key, kWhKey also asks Tesla for the car's own two public keys and keeps them with the time it read them, so that your phones and watches can check that it is your car they are talking to.
• What the car reports. Once kWhKey's key is on a car, the car sends its data straight to kWhKey's server whenever it changes: where it is (its GPS position, and whether it is at home), its speed and gear; the odometer, and how many miles it drove itself; battery level, range, energy and the state of the battery and its cells; charging (power, current, voltage, limit, schedule, the kind of charger); locks, doors, windows, how many keys it has and whether the driver's seat is taken; climate, the temperature inside and outside, seat and wheel heat; Sentry mode; tire pressures; the software version and its updates; the destination set in the car's navigation, with the time and distance to it and the charge expected on arrival; whether valet mode, service mode and PIN to Drive are on (never the PIN); and whether it is connected over Wi-Fi or the mobile network. Tesla also tells kWhKey whether a car is online or asleep, its alerts, its warranties, and how many keys it has.
• The history built from that. kWhKey keeps every value a car reports, with its time. From them it builds your drives (when, from where to where, distance, energy, speed), your charging sessions (where, how much, what it cost), every stop (where the car was parked, and how long), battery health, Sentry events, and when the car was awake. Trips, charging history, costs, alerts and the rules all work from this. It is a history of where the car has been.
• What you enter. Places you save (a name, a position, a size), settings, routines and when they ran, maintenance and detailing records (date, odometer, who did the work, cost, your notes), which trips were for business and why, charging prices, and how your cars look in the app. A maintenance or detailing record you remove is hidden, not erased: it goes when the household goes.
• Where home is. kWhKey works this out by itself: when one of your cars says it is at home and your household has no home place, kWhKey saves that position as the place "Home". You can move it or rename it; if you remove it, kWhKey works it out again.
• Photos. If you add a photo of your car, the phone sends it to kWhKey's server - cut down to the part around the car when the car does not fill the picture - to be cut out and cleaned up; the server sends the result back and keeps no copy of what it was sent. If you save the picture, it is stored on the server and shown on your household's phones and watches, and to friends you show that car to. It is stored as pixels only: the place, the time and the camera written inside a photo file are not kept. A photo you put behind a car on its card is not sent to kWhKey: it stays on your phone and goes to your own watch.
• Who can reach your car. For the account that owns a car, kWhKey looks up once a day who the car is shared with in the Tesla app. For each person it keeps a first name, the first letter of the last name, how many phone keys they have and a short fingerprint of each key - no email address and no account number. When you read a car's list of keys over Bluetooth, kWhKey keeps what kind each key is (a key card, a phone, an app's key), not the keys. It also keeps how many keys a car has had over time, so that a new one is noticed.
• Your phones and watches. For each one in your household: its name (the one it carries in its own settings, which the app sends by itself, or the one you typed), what kind of device it is, its public key (the private half never leaves the device), whether it is an owner's or a member's, when it was added and last used, the version of the app on it and - on Android and Wear OS - the address Google's push service reaches it by. A device that makes itself a Bluetooth key for a car also sends that key's public half; kWhKey keeps it with how often it was used.
• The activity log. Everything that changes something is written down with the time, the device and the IP address it came from: every command sent to a car and how it went (over the internet or over Bluetooth), sign-ins, phones and watches added, renamed or removed, invites, and changes to settings, places, routines, photos and subscriptions. A place you send to the car's navigation is passed on and not written down. Each time kWhKey wakes a sleeping car is written down too, with the device that asked. Your household can read its log in the Android app, IP addresses included. It is how misuse is noticed.
• Notices. Every notice kWhKey makes for your household - an alert, a reminder, a new device - is kept in a list, with who dealt with it.
• Your consent. When you agree on the consent screen of the Android app, kWhKey keeps a record of it: which version of the consent screen you saw, the dates of the terms and of this policy it linked to, whether you are an owner or a member, each box you ticked, the time, the phone that agreed, and the cars it covers. "What you agreed to" in the app's menu shows it. It is kept with your household and goes with it - or with your phone or watch, when that is deleted.
• Bluetooth reports. When a phone or watch searches for a car over Bluetooth or sets up a key, it writes down what happened, so that problems can be found. On Android and Wear OS a report goes to kWhKey when you tap "Send log", and by itself only after a search or a command that failed - and only if you said yes to "Send a report if something goes wrong?" (you can change that in the app's menu, under What you agreed to, "Bluetooth problem reports"). Such a report holds the steps and the errors, what your car broadcast and answered, the make, model, system version and build of the phone or watch, the app's version, and the car's VIN and public keys. Other people's Bluetooth devices are left out: a device that is not your car gets no line, and other devices' addresses and other cars' names are taken out of every line. A report never holds a private key, and it does not say where the phone or watch was. Everyone in your household can read its reports.
• Friends. If your household and another become friends, kWhKey keeps that, and what you chose to show them.
• What the rules remember. The rules that act for you - the off-peak window, the plug-in reminder, the one that turns cabin overheat protection back on - keep notes about each car: what they last did, what they told you, and for overheat protection the weather forecast near the car, with the rough position it was asked for (to 0.1 degree).
• Housekeeping. How many messages each car sent and how many commands went to it each day (Tesla bills kWhKey for them), when each background job last ran for a car, when a car's data link was set up, the errors that link reported, and how far each phone has read the activity log.
• Messages the server could not store. A message from a car that the server cannot put away is set aside whole, for troubleshooting, and deleted after 30 days. It can hold the car's VIN and its position.
• Your subscription. See "Subscriptions" below.
• Sign-up records. A sign-up keeps the name and the public key of the phone that started it. The tokens from Tesla wait on the server, encrypted, for about ten minutes at most, until the sign-up is finished. Invite and setup codes are stored as fingerprints, never as the codes themselves, and each works once and for a short time.
• The server's own logs. For each request: its time, the IP address it came from, what was asked for, and the device's ID and app version. And lines about what the server did: when a car parked and at which of your places, the text of each notice, when a car woke or fell asleep, a car's alerts and the state of its connection, the last six characters of a VIN, a device's name - and now and then a slow database request, with the values in it. Invite codes, sign-in codes and tokens are not written into the logs.

What stays on your phone or watch

• Where your phone or watch is. The apps do not read the position of your phone or watch, and no part of kWhKey asks for it. On Android, a search for a car over Bluetooth is only allowed to an app that holds the location permission; kWhKey holds it for that search and nothing else.
• Dashcam and Sentry videos. The clip viewer in the Android app reads the car's USB drive on the phone. The videos are not sent anywhere.
• Private keys. The key each phone or watch signs with, and its Bluetooth key for the car, are made on the device, are protected by the device's own key storage, and never leave it. Only their public halves are sent.
• Your fingerprint, face or PIN. Before it creates an invite to your household, makes a friend code or accepts one, or sets up your watch, the app asks your phone to confirm that it is you: with your fingerprint, your face or your PIN. Your phone does the checking and only answers yes or no. kWhKey never sees or stores a fingerprint or a face. A phone with no screen lock has nothing to ask, and the app says so.
• The apps' own copies. The apps keep a copy of what they show - your cars with their VINs and positions among it - so that they open fast and work at the car with no internet. None of it goes into a cloud backup or onto a new phone.
• Between your phone and your watch. A phone and its watch pass setup codes, settings, what was just done on the other one and the photo behind a car to each other directly, over the link that Google (Wear OS) provides between the two.

No ads, and no analytics code

kWhKey shows no ads and has no advertising code. It has no analytics code, and it does not use your advertising ID. kWhKey's own server counts, per day, how many households reach each step of setting up and paying (for example "car added" or "subscribed"); it keeps only the day, the step and the number - never who, which car or device, where, or an IP address - and no other company is involved. (To count each household once a day, the server holds a keyed fingerprint of it, under that day's random salt, until Pacific midnight.) The apps do contain four parts made by Google: the one that receives push messages (Firebase Cloud Messaging), the one that cuts a car out of a photo on the phone (ML Kit), the one that links a phone to its watch (Google Play services), and the one that takes a purchase (Google Play Billing). Those parts send Google their own technical data, under Google's terms.

What it is used for

Only to run kWhKey for you: to show your cars, to send the commands you ask for, to run the rules and routines you set, to send you its notices, to keep your household secure, to keep track of which cars are paid for, and to find and fix problems. It is not sold, not rented, and not used for advertising.

Some rules act on a car without a tap. In a household set up from the launch on, every one of them starts switched off, and each has its own switch: Sentry by place, the rule that turns cabin overheat protection back on (when the car gets home, is plugged in, or after some days), its part that acts before a hot day, the off-peak window and your routines. A household set up before the launch keeps the settings it had: there Sentry by place, and the overheat-protection rule with its hot-day part, are on until an owner switches them off.

Who else receives it

• The people in your household. Everyone in it sees its cars: where they are, their trips, the activity log. Everyone in it can send commands, unlock included. Owners also see the list of who a car is shared with - and when that list changes, everyone in the household is told the name. Owners decide who is in the household. Households are separate: another household does not see yours.
• Friends, if you add any. A friend's household sees your household's name and, for each car you show them, its name, picture, model, year and paint, and whichever of these you switch on for them (a new friend sees none of them until you do): miles, range when full, the share of its miles it drove itself, efficiency, software version, and what it is doing now (driving, charging, asleep or parked). Never where a car is, never its charge or range now, never a control.
• The maker of your car. Tesla provides the car's data and carries out the commands you send, so it learns of everything kWhKey asks of it for you. Tesla may use the information that passes through its systems as its own privacy notice says.
• Google, for push messages on Android and Wear OS. Changes reach your Android phone and Wear OS watch through Firebase Cloud Messaging. Passing through Google this way: a summary of each car (its name, VIN, model and look, battery, range, charging, locks, doors and Sentry, climate, tire pressures and which tire kWhKey's own tire warning points at, kWhKey's caution sign, odometer, whether it is at home, whether it is awake and when it was last heard from, how many alerts are open) and the text of each notice. A car's position on the map is not in that summary, and while a car is driving to a destination no summary is sent at all: the devices fetch both from kWhKey itself. Google holds a message for up to an hour for a phone or watch that is asleep or out of reach.
• The store you subscribe in. See "Subscriptions" below.
• The U.S. National Weather Service. kWhKey asks the National Weather Service (weather.gov, a U.S. government service) about the weather where your cars are, for two things. Weather alerts: every 15 minutes, which severe weather warnings are in force near each car, so kWhKey can tell you - unless you switch "Weather alerts" off in the app's notification settings, and then it is not asked at all. And the part of cabin overheat protection that turns it back on before a hot day: while that part is on and protection is switched off on a car, kWhKey asks for the forecast near the car, at most every 3 hours. Each request carries only the car's position rounded to 0.1 degree (an area of roughly 11 by 9 kilometres) - and nothing that says whose car it is. The hot-day part is on while "Turn it back on before a hot day" is switched on, and while "Off in my garage" or Away mode is on, which bring protection back before a hot day by their own words.
• Your phone's own map service. For the mileage report, the app asks the phone's map service (Google's) for the street address where a business trip began or ended, when that is not one of your saved places. This is on unless you switch it off when you export the report.
• The companies whose computers kWhKey runs on. DigitalOcean hosts the kWhKey server, its database and its backups (San Francisco, California). Cloudflare runs this website. kWhKey's sign-in requests to Tesla go through it, the tokens with them, and so do invite links and Tesla's answer to a sign-in on their way to kWhKey's server. Cloudflare also forwards email sent to support@kwhkey.com to our mailbox, which is at Google.
• A website about car software. "What's new" in the app opens a page at notateslaapp.com in your browser, for the software version your car has.
• The people who run kWhKey. They can reach the server and what is on it, to keep it running and to answer you. When a new household is set up, they are told its name and the last six characters of each car's VIN.
• The law. We would hand over data only when a valid legal order required it.

Subscriptions

You pay Google Play, not kWhKey. kWhKey does not take your payment and does not ask the store for your card, your billing address or the name on your store account.

• What kWhKey gives the store: with each purchase, one random value that stands for your household, so that the purchase can only be claimed by your household. It is not your kWhKey ID and says nothing else about you.
• What the store tells kWhKey about a purchase, and what kWhKey keeps: which product, whether it is active, when the paid month began and when it ends, whether it will renew, the store's order number, the country of the store account, whether it was a test purchase and why a subscription ended. So that it can ask the store again, kWhKey also keeps Google Play's purchase token (encrypted).
• What kWhKey adds: which car each subscription pays for, each time one was moved to another car, a line for every answer and notice the store gave, and any car that kWhKey itself made free of charge, with the reason. For a car nobody pays for, kWhKey also keeps when that began and when it stopped the car's live data.

Where it is kept, and how it is protected

kWhKey's server and database are in the United States (San Francisco, California). If you use kWhKey from another country, your data is sent there and kept there.

• The apps talk to the server over encrypted connections only, and so do the cars. The server talks to Tesla and Google the same way.
• Once a phone or watch is set up, every request it makes is signed with its own key, and is accepted once.
• The sign-in tokens from Tesla are encrypted on the server, with a key that is kept outside the database.
• The server answers each phone and watch for its own household only - and, between friends, with nothing but what the other household chose to show.
• Joining a household takes a one-time code. It is made by someone who is already in the household - or, for support, by the people who run kWhKey - and every new phone or watch is announced to the whole household at once.

How long it is kept

• As long as your household exists: everything above that has no shorter time below. That includes the whole history of what your cars reported, with their positions.
• 90 days: the working list of changes the rules react to (a door opened, charging began). The history itself stays.
• 30 days: the record of a sign-up, finished or not.
• Up to a day: the counters that stop guessing and flooding, per device or per IP address, and a count of the push messages sent to each phone and watch, hour by hour. They are held in memory only.
• A phone or watch an owner removes can no longer reach the cars, and what served only it is deleted at once: its Bluetooth reports, how far it had read the activity log, a sign-in it had started, its push address, and the IP address on its lines in the activity log. Its record, its name, its lines in the activity log and its Bluetooth key's public half stay until the household is deleted, or until the phone or watch itself is deleted - by its own user in the Android app, or by email.
• Backups: a copy of the database is made every night, and every copy - a nightly one, or one made before an update - is deleted before it is 48 hours old.
• Logs: the server's own logs are deleted after 14 days.
• 30 days: the messages the server could not store, and the lines it writes when a car goes on sending after it was deleted.

Deleting your data

An owner can delete the whole household, or remove one of its cars (not the last one: then delete the household). A member can delete their own phone and what kWhKey kept about it, and so can an owner while another owner's phone or watch stays in the household; a watch is removed by an owner on a phone (a car's Security tab, then Devices), and deleted by email. In the Android app this is under Delete my data in the app's menu; it can also be done by email: Delete your kWhKey data. That page also says what stays behind, and for how long: the copies in backups and logs; what a car sends after the deletion; what others were told about your household; and what Tesla, Google and the other companies named above hold themselves.

When a car is removed or a household deleted, kWhKey asks Tesla to stop the car sending its data. Until Tesla confirms it, for at most 7 days and 10 minutes, kWhKey keeps the car's VIN and which household it was in and - when the household was deleted - an encrypted copy of its sign-in to Tesla, for that alone, and asks again.

Your choices

• See it: most of what kWhKey keeps is on the screens of the app. For a copy of the rest, write to us.
• Correct it: names, places, records and settings are yours to change in the app. For anything else, write to us.
• Delete it: see above.
• Stop kWhKey's access to a car: remove kWhKey's key on the car's own screen (Controls > Locks) and remove kWhKey in the Tesla app (Profile > Security & Privacy > Third-Party Apps).
• Your rights by law: where you live you may have the right to know what is held about you, to have it corrected or deleted, and not to be treated worse for asking. kWhKey does not sell personal information and does not share it for advertising. To use a right, write to support@kwhkey.com.

Children

kWhKey is for adults: you must be 18 or older to use it (Terms of Service, section 2). It is not meant for children, and we do not knowingly collect data from anyone under 18; if we learn that we have, we delete it. Tell us at support@kwhkey.com if you think we have.

This website

kwhkey.com is plain pages: no cookies, no scripts, no pictures, and nothing loaded from anywhere else. Cloudflare, which runs it, sees the IP address of each visitor in order to answer. The one cookie kWhKey ever sets is on its server's own address, during a sign-up that is finished in a browser, and it lasts ten minutes.

Changes

When this policy changes, the new version is posted here with a new date.

Contact

Questions and requests: support@kwhkey.com. Write to us there and we will help you solve any issue. kWhKey is published by Malina LLC.