CyberFreq is a push-to-talk (PTT) voice communication app for verified Tesla vehicle owners. The app pairs to your Tesla, opens proximity-based voice channels with nearby drivers, and includes a community driver-rating system. This policy explains what data we collect, why, and your rights under GDPR (EU/EEA/UK residents), CCPA/CPRA (California residents), and Google Play's User Data policy.
We do not sell your data. We do not run ads. We do not use third-party analytics trackers.
The data controller is AICrownz LLC, operating the CyberFreq service. Contact for any privacy matter: aicrownzllc@gmail.com.
When you sign in with Tesla, we request the following Tesla Fleet API scopes — read-only; no commands; no energy:
| Scope | What We Read | Why |
|---|---|---|
profile | Name, email, Tesla account ID | Account identity, profile display |
vehicle_information | Vehicle model, VIN (hashed), region | Verification badge, fleet grouping |
vehicle_location | Approximate location during active session | Proximity matching for PTT radius |
We never request: unlock, start, climate, charging control, energy products, or any write-access / command Tesla scopes. CyberFreq cannot send commands to your vehicle and cannot read or control any Powerwall, Solar, or energy product on your account.
Location handling: Vehicle location is read from Tesla only while you have an active CyberFreq session. Server-side, raw coordinates are immediately resolved to a coarse grid cell (≈1 km resolution) for proximity matching. Precise coordinates are never transmitted to other users' devices and are not retained after the session ends.
CyberFreq requests the microphone (RECORD_AUDIO) permission so you can transmit on push-to-talk channels. The microphone is only active while you are actively pressing the talk button.
CyberFreq can automatically open a session when your phone connects to your verified Tesla's Bluetooth (a feature you can disable in Settings). To support this, the app uses the Android BLUETOOTH_CONNECT permission to detect connection events.
The Android manifest declares READ_MEDIA_IMAGES because the React Native / Expo media stack used by the app references the system image picker. This permission is only used if you choose to upload a profile picture from your device's photo library.
Account and rating data are kept in a SQLite database on our server. The geospatial index used for proximity matching stores only the active-session grid cell described in §2.1; it is not a long-term location history.
| Field | Stored | Retention |
|---|---|---|
| Tesla account ID (hashed) | Yes | Until account deletion |
| Display name | Yes | Until account deletion |
| Vehicle model + region | Yes | Until account deletion |
| Profile image (if you upload one) | Yes | Until you remove it or delete account |
| Driver rating score (4 dimensions: language, aggression, spam, helpfulness) | Yes | Until account deletion |
| Active-session grid cell (≈1 km) | Session only | Cleared when session ends |
| Session timestamps (login/logout) | Yes | 90 days, then purged |
| Premium subscription state & purchase records | Yes | Per legal/tax requirement (up to 7 years) |
Driver ratings: The 4-dimension rating system aggregates community feedback. Premium-tier members can vote; ratings are stored against your account so other drivers can see your tier badge. Individual votes are anonymized — you cannot see who rated you.
We log standard server-side data needed to operate and secure the service:
We do not use: advertising IDs, fingerprinting SDKs, or behavioral tracking tools (e.g., Firebase Analytics, Mixpanel, Amplitude, Meta Pixel).
| Purpose | Legal Basis (GDPR) |
|---|---|
| Account authentication via Tesla OAuth | Contract performance |
| Proximity matching for PTT channels | Contract performance |
| Driver ratings and community features | Legitimate interest |
| Abuse prevention and security | Legitimate interest |
| Premium subscription management | Contract performance |
| Legal compliance (purchase records) | Legal obligation |
We share data only with the following service providers (sub-processors), each under a data processing agreement with GDPR-compliant terms. None of them receive payment for the data — they process it on our behalf to deliver the service.
| Provider | Purpose | Data Shared |
|---|---|---|
| Tesla, Inc. | Vehicle owner verification & Fleet API (read-only) | OAuth identity tokens |
| Stripe, Inc. (via ExtensionPay) | Premium subscription payments | Email, billing details (handled directly by Stripe; CyberFreq never sees card numbers). Stripe account: acct_1TNLS2IUrGu95Vjv. |
| ExtensionPay | Subscription/checkout flow that fronts Stripe | Email, subscription state |
| Render, Inc. | Server hosting (API, WebSockets, SQLite) | All server-side data described in §2 is processed on Render infrastructure |
| Cloudflare, Inc. | CDN, DNS, edge security for cyberfreq.app | Connection metadata (IP, user agent) for the marketing site and any edge-routed traffic |
| Anthropic, PBC | AI moderation / "super-brain" classification of community reports | Anonymized text snippets from user-submitted reports (no identifiers attached) |
| OpenRouter | Routing layer for the moderation/AI super-brain calls | Same anonymized content as Anthropic; OpenRouter relays the API call |
| Sentry (if enabled in a build) | Crash & error reporting | Stack traces and device metadata; user identifiers are scrubbed where present |
| Google Play / Google LLC | App distribution & install integrity | Standard Play Store install metadata governed by Google's policies |
We do not share your data with data brokers, advertisers, or third-party analytics companies. We do not sell or "share" personal information for cross-context behavioral advertising as defined by CCPA/CPRA.
International transfers: Several sub-processors above are based in the United States. Where required, transfers from the EU/EEA/UK rely on Standard Contractual Clauses or equivalent safeguards published by each provider.
CyberFreq is a mobile app. We do not use web cookies. On-device, we store:
No cross-app tracking. No advertising identifiers.
You have the right to:
To exercise any right, email aicrownzllc@gmail.com with subject "GDPR Request". We will respond within 30 days.
If you are unsatisfied with our response, you may lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or your EU member state's DPA).
Under the California Consumer Privacy Act, you have the right to:
To submit a CCPA request: email aicrownzllc@gmail.com with subject "CCPA Request". We will respond within 45 days.
| Data Type | Retention Period |
|---|---|
| Account data (active user) | Until account deletion |
| Session location (grid cell) | Session duration only |
| PTT audio | Never stored |
| Server logs (IP, errors) | 14–30 days |
| Purchase records | 7 years (legal obligation) |
To delete your account: Settings → Account → Delete Account, or email aicrownzllc@gmail.com.
CyberFreq is not directed at users under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact aicrownzllc@gmail.com and we will delete it promptly.
We implement:
No security system is perfect. If you discover a vulnerability, please disclose responsibly to aicrownzllc@gmail.com.
We will notify users of material changes via in-app notification at least 14 days before changes take effect. The "Last Updated" date at the top of this document reflects the current version.
CyberFreq Privacy
Email: aicrownzllc@gmail.com
Website: https://cyberfreq.app