Privacy policy

Effective date: 2026-10-24

This policy covers the Cabin Climate phone app, the Cabin Climate watch app and our server at cabinclimate.nationalcourseportal.com. We wrote it to be read. If something here is unclear, write to us.

Who we are

Cabin Climate is made and run by Ankur Fadia, an individual developer in Virginia ("we" on this page). Contact: accounts@auraliris.com.

What we keep

To warm up or cool down your car for you, our server keeps only this:

• An account record. It is keyed by a one-way hash of your Tesla user ID. We cannot turn the hash back into your ID, and we do not store your name, email address or phone number.
• Your Tesla sign-in tokens. These are the access and refresh tokens Tesla gives us after you sign in on Tesla's own page. We never see your Tesla password. We store the tokens encrypted. They let us send the commands you ask for. We ask Tesla for permission to read vehicle information and to send vehicle commands, plus the basic sign-in permissions Tesla requires. We do not ask for your car's location.
• Your cars. For each car we keep its VIN, the name you gave it, and the last status we read from it: cabin and outside temperature, battery level, whether climate is on, and whether it is locked. We keep the last status so the app can show it while your car is asleep. All of this is encrypted in our database, and we find a car by a one-way hash of its VIN.
• Your app sessions. One for each phone and watch you connect. We store only a hash of each session token, the device name, an install ID (a random ID the app makes on your phone) or the watch's connection ID, which phone session a watch belongs to, and when the session was last used. A watch connection ends whenever the phone connection that created it ends, for any reason.
• Daily usage counters. How many commands, wake-ups and status reads your account used today, so the daily limits work.
• Command records. Which action you tapped and how it turned out. They keep a repeated tap or a bad connection from sending the same command twice. A record is valid for 15 minutes. A cleanup that runs every 5 minutes deletes it after that, so none stays longer than 20 minutes. They are also deleted when you delete your account.
• Sign-in records. A sign-in in progress is valid for 10 minutes. The one-time code that hands your sign-in from the browser to the app is valid for 5 minutes, and never past 15 minutes after the sign-in began, however long Tesla takes to answer. The same cleanup deletes these records after they expire, so none stays longer than 20 minutes.
• A request in progress. While our server sends a request to Tesla, it holds a short record of it (which account, which car by its one-way hash, and what kind of request) so that spending is counted before it happens. When the request ends, the record becomes part of the daily counters below. If the server crashes in the middle, the leftover is turned into counters when it restarts, and in any case within 24 hours and 5 minutes (24 hours, plus the 5 minutes until the next cleanup).
• A deletion marker. When an account is deleted we keep, for 15 minutes, a second one-way hash of the Tesla user ID and the time of the deletion. It stops a sign-in that you started before deleting from bringing the account back. The cleanup deletes it after 15 minutes, so it stays at most 20 minutes.
• Totals for the whole service. How many calls we made per day, by category. There is no link to any person or car. We keep them for our billing records.

We keep no location at all. The app does not ask for the location permission on your phone or watch. We do not ask Tesla for its location permission. We never read or store your car's location, and nothing in our code, logs or web pages deals with location.

Like any web server, ours sees your internet address when your phone connects. We use it to limit abuse, such as too many sign-in attempts in an hour or more than 3 new accounts from one address in a day. We do not store it in your account. Our web server's access log holds the time, the page, the status and the address. In that log the page name has car VINs replaced, and there is no query string, no referring page, no cookie, no authorization header and no user agent. Every day the server starts a new log file and deletes log files older than 12 days, whether or not anyone used the service, so no entry is kept longer than 14 days. The system journal is trimmed every day too, and no entry in it is kept longer than 14 days. Our application logs hold route names and status codes only, never a token, code, VIN or location. We take no backups or snapshots of the server.

What we never do

• We never sell or share your data with anyone, except Tesla as described below.
• We use no ad networks, no tracking tools in our apps and no analytics services.
• We set no cookies, with one exception. While you delete your data on the web, we set one short-lived cookie (HttpOnly, SameSite=Strict, valid for a few minutes) that ties the Delete button to your browser. It is the only cookie we ever set, and it exists only during that web delete flow. The apps and the rest of this website set none.
• We never send commands to your car on our own. Every command starts with a tap of yours. There are no timers and no schedules.
• We never read or store your car's location.

Promotions in the app

The phone app shows one small card on its More (About) screen promoting QuickVisitMD, National Course Portal or Aural Iris, businesses connected to the app's developer. The card is labeled Ad. It never appears on the Home screen, and never while a command is running. The watch app shows at most one line of text, on one day a week, on its More (About) screen.

The promos are built into the app, and the card changes from day to day. They load nothing from the internet, send nothing about you or your car, and have no tracking. We use no ad network, so no outside company serves ads in our apps or collects information through them. In Settings, the Hide house promos switch turns them off.

If you tap a card, that business's website opens in your browser, like any link. Cabin Climate sends that site nothing. Your browser connects to it the way it connects to any website, and that site's own privacy policy and cookies apply.

Tesla

When you use Cabin Climate, our server calls Tesla's Fleet API for you, with the access you granted (vehicle information and vehicle commands), to read your car's status and to send your commands. Tesla processes that information under Tesla's Privacy Notice, and Tesla may use the information submitted through its API as that notice describes. You can see and remove the apps connected to your Tesla account in the Tesla app, under third-party apps in your account security settings.

Where it works

Cabin Climate works with cars in the US and Canada for now (the North America region of Tesla's service). If your Tesla account belongs to another region, we turn the sign-in away and keep nothing.

Where it is kept and how it is protected

Our server runs on a rented cloud server that we manage ourselves. Traffic between your phone or watch and our server is encrypted. Your Tesla sign-in tokens, and the VIN, name and last status of your cars, are encrypted in our database with keys that are not stored in the database. Session tokens and sign-in codes are stored only as one-way hashes. So are your Tesla ID, the VIN lookup and the internet-address counters, and those hashes use a secret that is also kept outside the database. We take no backups or snapshots of the server.

How long we keep it

• Your account: until you delete it. Signing out of the app does not delete it. If your Tesla sign-in stops working (for example, you changed your Tesla password or removed our access) we delete the account automatically: 90 days after our server first saw Tesla refuse the saved sign-in, or, if the saved sign-in has not been renewed for 180 days, then. (The app renews it every time you use it, so the 180 days run from your last use.) A cleanup that runs every 5 minutes does the deleting.
• App sessions: they expire after 90 days without use, and in any case after 365 days. An expired session stops working at once and is deleted by the next cleanup (every 5 minutes).
• Command records, sign-in records, one-time codes and the deletion marker: valid for 15 minutes, 10 minutes, 5 minutes and 15 minutes (a sign-in and its one-time code together never last past 15 minutes after the sign-in began), and deleted by the 5 minute cleanup after that, so none stays longer than 20 minutes.
• Daily usage counters for your account: each day's counters are deleted 35 days after that day ends.
• Web server access log and system journal: no entry is kept longer than 14 days.
• Per-car and per-address counters: deleted 48 hours after they were last used, as described in the next section.
• Totals for the whole service: kept for our billing records. They are not linked to any person or car.

Counters that outlive deletion

Two kinds of daily counters stay until 48 hours after they were last used, even if you delete your account, and are then purged. One counts what each car used, keyed by a one-way hash of the VIN (not the VIN itself). The other counts new sign-ups from each internet address, keyed by a one-way hash of the address, so that we can allow 3 new accounts per address per day. We keep them so that the daily limits cannot be reset by deleting your account and signing up again.

Deleting your data and asking for a copy

In the phone app: Settings, then Delete my data. Or on the web: cabinclimate.nationalcourseportal.com/delete. On the web you sign in with Tesla. We ask Tesla only for your identity, so we get no access to your car. Then we show a page that asks "Delete Cabin Climate data for this Tesla account?" and lists the names of the cars on that account, so you can tell which account it is, with a Delete button. Only pressing that button deletes anything. The web page works even if you signed out of the app, uninstalled it, or your app sign-in expired or was revoked.

Signing out of the app does not delete your data on our server. It only removes the sign-in from that phone or watch. Use Delete my data, or the web page, to delete.

Deletion is immediate. It removes your account, your Tesla tokens, your sessions, your cars, your last status, your command records and your usage counters at once, and it overwrites the freed space in our database. Commands we already sent to your car cannot be recalled. Only the deletion marker described above stays, for 15 minutes.

To finish up, also remove Cabin Climate's key from your car: open the Locks screen in the car and delete the key listed for cabinclimate.nationalcourseportal.com.

If you cannot sign in with Tesla, we cannot delete your data on request: we keep no names or email addresses, and knowing a car's VIN or name does not prove that the car is yours, so nobody, including us, can delete an account on that basis. Your data is deleted automatically instead, on the schedule under "How long we keep it": at most 90 days after our server first sees Tesla refuse the saved sign-in, or 180 days after the last time it was renewed. If you want to know what we hold, or have any question, email accounts@auraliris.com and we will answer within 30 days.

Children

Cabin Climate is for people who own or are allowed to use a Tesla vehicle. It is not directed to children under 13 and we do not knowingly collect information from them.

Changes

If we change this policy, we will post the new version here with a new effective date. If a change is significant, we will say so in the app.

Contact

Ankur Fadia, an individual developer in Virginia. accounts@auraliris.com

Cabin Climate is not affiliated with, endorsed by, or sponsored by Tesla, Inc.