I'm HerePrivacy Policy
“I'm Here” is an iOS app made by MooseQuest LLC (“we,” “us,” “our”), a single-member limited liability company. This policy explains what information we collect, how we use it, and your choices — in plain English.
Contact: support@moosequest.net
1. What I'm Here does
I'm Here lets a Tesla owner share a live “arriving in X minutes” link with a friend or family member. The owner opens the app, picks a destination, and the app generates a private web link. Anyone who holds that link can watch the owner's car approach on a map in real time. The share is time-limited and the owner can stop it at any moment.
2. Information we collect — and why
2a. If you are the vehicle owner (app user)
| What | Why | Where stored |
|---|---|---|
| Tesla OAuth tokens | So the app can poll your car's location on your behalf while a share is active | Cloudflare KV, encrypted at rest (AES-256). Refresh token retained until you delete your account or revoke access in Tesla. |
| Vehicle ID | To query the right vehicle via Tesla Fleet API | Cloudflare KV with the share record (24-hour TTL) |
| Vehicle make, model, color | To display an accurate image of your car to the rider | Cloudflare KV (7-day TTL) |
| Destination coordinates + optional label | To show the rider where you're heading and compute ETA | Cloudflare KV with the share record (24-hour TTL) |
| Live GPS location, heading, speed | The core data — where your car is right now, served to the rider, fetched ~every 12s while a share is active | Cached in memory-like KV for at most 60 seconds to serve concurrent viewers, then automatically expired; never stored long-term or used to build a location history. |
| License plate / vehicle description (optional) | If you choose to enter it in the app, shown on the rider page so the rider can spot your car | Cloudflare KV, keyed to your account. Kept until you remove it or delete your account (Section 6). |
| A random owner_key (pseudonymous) | An internal identifier linking your Tesla token to your shares — not your name, email, or Tesla ID | Cloudflare KV |
We do not collect your name, email address, Tesla account ID, or any payment information.
2b. If you are a rider / share-link viewer
By default, nothing at all — on our side. Riders need no account and we set no cookies, analytics, or trackers on the rider page. The page loads the car's live location using only the share ID in the URL. We do not log rider IP addresses beyond what Cloudflare automatically retains as a network operator (Section 4). The two opt-in exceptions below apply only if those features are switched on and only to riders who actively choose them.
2b-i. SMS arrival notifications (optional, opt-in)
If we have the SMS feature switched on, the rider page may offer a "Text me when they arrive" box. If you type your number and tap to confirm, we store it in Cloudflare KV tied to the share record — at most 24 hours — and send a single text when the car arrives, via Twilio (see Section 4). We never text anyone who hasn't asked, we don't use the number for marketing, and we don't log it. Reply STOP to any message to opt out; or simply don't enter your number.
2b-ii. Web Push arrival notifications (optional, opt-in)
If we have the Web Push feature switched on, the rider page may offer a "Notify me when they
arrive" bell button. If you tap it and grant notification permission, your browser generates a
push subscription that we store under the key push:<shareId> in
Cloudflare KV.
| Field | What it is | Why we store it |
|---|---|---|
endpoint | Browser-vendor-issued capability URL (e.g. https://fcm.googleapis.com/…). A one-time bearer token, not a stable identifier — you can reset it by clearing browser data or revoking notification permission. | To address the Web Push delivery to your browser. |
keys.p256dh | Your browser's public key (ECDH, P-256) used to encrypt the notification per RFC 8291. | Payload encryption — only your browser can decrypt the notification. |
keys.auth | 16-byte auth secret per RFC 8291. | Combined with p256dh for authenticated content encryption. |
subscribedAt | Unix timestamp of when you subscribed. | Internal audit only; never shown on the rider page or included in event logs. |
ua_hint | Short browser-family label (e.g. "web"), at most 16 bytes. | Diagnostic aid for the operator. Not PII. |
The subscription record does not contain your name, email, phone number, device
fingerprint, or any other personal identifier. The endpoint URL is never written to our
event logs.
Why: To deliver one "your Tesla has arrived" Web Push notification per share to a rider who opted in. At most one notification is sent, enforced by a one-fire sentinel.
Retention: The push:<shareId> record carries a TTL ≤ 86,400 seconds (24 hours) and is
also explicitly deleted when the owner stops the share, or when the push service returns HTTP 410 Gone
(meaning your browser has revoked the subscription). No subscription survives its share.
To unsubscribe: Remove notification permission for imhere.moosequest.app
in your browser's notification settings. Once revoked, the push service will reject further deliveries
and return 410, which causes us to delete the stored record.
2b-iii. iOS Live Activity push updates (optional, opt-in)
If you're using the I'm Here iOS app and start a rider Live Activity for a share, the app
registers an Apple Push Notification service (APNs) push token with us so we can push live ETA
updates to your Lock Screen / Dynamic Island via Apple. We store the token under the key
la:<shareId> in Cloudflare KV. The token identifies your device to Apple's push
service — it is not your name, email, or Apple ID, and we use it only to send ETA/status updates
for that specific share.
Retention: The la:<shareId> record has a TTL of 4 hours and
does not outlive the share it belongs to.
2c. What we do NOT collect
- We do not collect or store your Tesla account email or password. Authentication is handled entirely by Tesla's own OAuth login page.
- We do not use advertising SDKs or cross-app tracking. The app uses PostHog for product analytics (feature-usage events, no advertising identifiers; during TestFlight betas an opt-disclosed session-recording diagnostic can be enabled, always with an on-screen banner) and Sentry for crash reporting on real devices. Neither is used for advertising, and neither receives your Tesla credentials or your rider's phone number.
- We do not collect health data, financial data, contact lists, or any data unrelated to location sharing.
3. How we use your information
We use the data above only to provide the service you asked for: authenticate with Tesla, poll your vehicle's location while a share is active, serve the rider page, render your car image, and compute a driving route to draw on the map. We do not use your data for advertising, marketing, profiling, or any purpose beyond the above.
4. Third parties who receive your data
Tesla, Inc.
All vehicle location data originates from Tesla's Fleet API. Your consent is granted when you authorize the app via Tesla's OAuth login. You can revoke access any time in your Tesla Account → Security & Privacy → Third-Party Apps. Tesla's privacy notice: tesla.com/legal/privacy.
Cloudflare, Inc.
Our backend runs on Cloudflare. Tokens and share data are stored in Cloudflare KV, encrypted at rest (AES-256) and in transit (TLS). Cloudflare processes data as our sub-processor. Cloudflare privacy policy.
Apple, Inc. (APNs)
If you opt into an iOS Live Activity for a share (Section 2b-iii), we send ETA/status updates to your device through Apple Push Notification service (APNs). Apple receives the push token and the content of that update (ETA minutes, distance, status) solely to deliver it to your device. Apple privacy policy.
Driving-route rendering
The route line shown on the share page is computed by our own server, which requests driving geometry from a routing provider (currently Mapbox) using the car's current and destination coordinates. The rider's browser never contacts the routing provider and never sends coordinates to any third party; route results are not cached or stored. The core ETA comes directly from Tesla and does not depend on the routing provider.
Map tiles and script CDNs
By default, the rider page loads map tiles, styles, glyphs, and sprites from OpenFreeMap
(tiles.openfreemap.org) and its mapping library from the jsDelivr script CDN
(cdn.jsdelivr.net) to render a 3D map. If a rider's browser can't render the 3D map, or
they use the ?map=2d fallback link, the page instead loads map tiles from CartoDB and
the Leaflet mapping library from the unpkg script CDN (unpkg.com). In every case, the
tile/script provider receives the viewer's IP address and the map region or files requested, as a
normal web request — none of these providers receive the car's live location from us; the rider's
own browser draws the car's position on top of the map tiles locally. This applies whether the rider
opens the link in a regular browser or inside the I'm Here iOS app, which loads the same page in an
embedded web view. OpenFreeMap ·
jsDelivr · CartoDB privacy
policy · unpkg.
Twilio (SMS arrival notifications)
If a rider opts into the "Text me when they arrive" feature (Section 2b-i), the single arrival text is sent through Twilio, a messaging provider. Twilio receives the rider's phone number and the message text solely to deliver it, acting as a processor on our behalf; it may not use the number for its own purposes. Twilio privacy policy. Applies only when the SMS feature is enabled and only to riders who opt in.
No data brokers. No ad networks.
We do not sell, rent, or share your data with data brokers, advertising networks, or any party not listed above.
5. The share-link model — what the rider can see
When you create a share you receive a private link like imhere.moosequest.app/t/abc123…,
generated from a 96-bit random identifier (not guessable). Anyone who holds the link can see your car's
live location, speed, heading, and ETA while the share is active. The link is not password-protected and
is not limited to a single viewer.
6. Data retention
| Data | Retention |
|---|---|
| Live GPS coordinates | Cached in memory-like KV for at most 60 seconds to serve concurrent viewers, then automatically expired. Never stored long-term or used to build a location history. |
| License plate / vehicle description (optional) | Kept until you remove it in the app or delete your account. |
| Share record | 24 hours from creation, then automatically deleted. |
| Vehicle config (model, color) | 7 days from last fetch, then deleted. |
| Access token (short-lived) | Deleted automatically when it expires (~8 hours). |
| Refresh token (owner_key) | Retained until you revoke access. No automatic expiry. |
| Rider phone number (SMS opt-in only) | Stored for the life of the share — at most 24 hours. Deleted when the share stops or expires. |
Web Push subscription (opt-in only): endpoint, keys.p256dh, keys.auth, ua_hint, subscribedAt | TTL ≤ 86,400 seconds. Deleted when the owner stops the share, or when the push service returns 410 Gone. No subscription outlives its share. |
| Live Activity push token (opt-in only) | TTL ≤ 4 hours, and only for the life of the share. Deleted when the share ends. |
7. Your choices and rights
Revoke access any time via Tesla Account → Security & Privacy → Third-Party Apps; this immediately invalidates our stored tokens.
Delete your data right in the app: open the app's menu → Account & data… → Delete everything. This deletes your owner_key, refresh token, license plate, and active shares immediately. You can also email support@moosequest.net with subject “Delete my I'm Here data” and we'll delete your owner_key and refresh token within 30 days.
Stop a share with the stop button in the app — the link expires immediately.
California residents (CCPA/CPRA) and EU/EEA residents (GDPR) have additional rights regarding access, deletion, correction, portability, and limiting use of sensitive personal information (precise geolocation). Contact us to exercise them.
8. Security
- Tokens in Cloudflare KV are encrypted at rest (AES-256) and in transit (TLS).
- The iOS app stores tokens in the iOS Keychain — Apple's hardware-backed secure store.
- The share ID is a 96-bit random value, resistant to guessing.
- We do not log raw GPS coordinates to long-term storage.
No system is perfectly secure. If you believe your share link was compromised, stop the share immediately and contact us.
9. Children
I'm Here is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us information, contact us and we will delete it.
10. Changes to this policy
We will update the “Last updated” date above when we make material changes. If you have the app installed, significant changes will be communicated via an in-app notice on next launch.
11. Contact
MooseQuest LLC
support@moosequest.net
imhere.moosequest.app/privacy