Privacy Policy

EVConduit is a personal project run by Steve Lea, trading as EVConduit (“we”, “us”). We are the data controller for the information described here. You can reach us about anything on this page at [email protected].

This policy covers both the website at evconduit.com and the XPengCarData mobile app. They are one service sharing one account and one set of data, so this is one policy rather than two.

• We collect what the service needs to work, and nothing is sold or used for advertising.
• There are no tracking cookies and no advertising identifiers.
• An XPENG data export contains no location data, so we have none to leak.
• Location is only ever involved if you connect a logger of your own, or link a car that reports it.
• You can delete your account and everything in it yourself, at any time.

Account details. Your email address and, if your sign-in provider supplies it, your name. Sign-in is handled by Supabase, and you can sign in with an email link or with Google. We never see your Google password.

Vehicle data. If you link a car through Enode, we receive what the manufacturer reports: charge level, plug and lock state, odometer, and whether the car is reachable. This is what drives the dashboard and the Home Assistant integration.

Your XPENG export. XPENG’s data request produces a file containing trips and charging sessions. If you ask us to fetch it, or upload it yourself, we process what it contains: trip times, distance, speed, energy used and recovered, consumption, state of charge and odometer readings; and for charging, the times, power, energy, battery temperature and whether it was AC or DC. From these we derive figures such as estimated pack size and range.

An XPENG export contains no location data at all — no GPS coordinates, no addresses, no start or end points. It cannot tell us where you drove, and we do not try to work it out.

What you write. Trip notes and logbook entries (the From, To, purpose and notes fields), and the tyre records you keep.

Location, only where you opt in. Two things can involve location, and both are off unless you turn them on. If you link a vehicle, the manufacturer may report its position, and we turn that coordinate into a street address so the app can show where the car is. If you point a GPS logger of your own at us, we store the positions it sends and use them to draw the route of a drive on that trip’s page. Nothing else is done with either.

Integrations you choose. If you connect A Better Route Planner, Tibber or Pushover, or set up the Home Assistant webhook or MQTT output, we store the credentials or keys that connection needs. If you enable SMS alerts, we store your phone number and whether it has been verified.

Payments. Subscriptions are handled by Stripe. We store a customer reference and whether your subscription is active. We never receive or store your card number.

Community benchmarks, if you opt in. Your efficiency, consumption and charging figures are contributed as anonymous aggregates — averages and percentiles pooled across everyone who opted in, tagged only with the model and country. They are not linked to your account. You can turn this off at any time.

Technical data. Our servers keep short-lived request logs (which endpoint, when, and which account) so we can apply rate limits and diagnose faults. The website uses Umami for analytics, which is cookie-less and records no personal or identifiable data.

• Card or bank details — Stripe holds those, not us.
• Your passwords for anything — sign-in is delegated to Supabase and Google.
• Location from your XPENG export, because there is none in it.
• Advertising identifiers, and anything used to track you across other sites.
• Your contacts, photos, files or messages. The app asks for no such permission.

To provide the service you asked for — showing your charging history, trip log and insights, and syncing to Home Assistant. Under the GDPR this is performance of our contract with you.

For the optional parts, we rely on your consent, which you can withdraw at any time by turning the feature off: contributing to community benchmarks, storing GPS positions from your own logger, SMS alerts, and the other integrations.

For keeping the service running and secure — rate limiting, abuse prevention, error monitoring — we rely on our legitimate interest in doing so. For invoices we keep, we are meeting a legal obligation.

We do not sell your personal data, and we do not use it for advertising.

We do not share your data with anyone except the providers that make the service work. Each is bound to use it only for that purpose:

Supabase

Account sign-in and the database that holds your data

Contabo

The servers the service runs on

Enode

Connecting to your vehicle, when you link one

XPENG

Produces the data export you request from them and upload

Stripe

Card payments and subscriptions

Brevo

Transactional and newsletter email

Twilio

SMS alerts, only if you turn them on

Pushover

Push notifications, only if you connect it

Anthropic

The in-app AI assistant, when you use it

OpenStreetMap (Nominatim)

Turning a vehicle coordinate into a street address

Sentry

Error monitoring, so faults get found and fixed

Umami

Cookie-less website analytics

Two of these are worth spelling out, because they involve data leaving our servers. To show a street address for a vehicle we send its coordinates to OpenStreetMap’s Nominatim service, which returns an address and nothing else. And if you use the AI assistant, a summary of your configuration and charging statistics plus the messages you type are sent to Anthropic to generate the reply.

Error monitoring. Sentry receives crash and error reports, which include the IP address the request came from and details of the failing request. This is to find and fix faults.

Some of these providers are outside the UK and the EEA, including Anthropic and Sentry in the United States. Where data is transferred, it is covered by that provider’s own safeguards, such as standard contractual clauses.

Your account, and the insights built from your data

Until you delete it

Uploaded XPENG export files

30 days, except your newest file and any file that has not been read yet

Historical charging samples

180 days

GPS positions from your own logger

400 days

API request logs

14 days

Error reports

Per Sentry’s own retention settings

Payment records

As long as tax and accounting rules require

Export files are deleted long before your parsed data is, because the file is large and the trips and charges it produced outlive it. If a file has not been read yet, or failed to read, we keep it — until we have its contents, that file is the only copy.

You can delete your account and all of the data in it yourself, whenever you like:

• In the app: Settings → Delete account
• On the website: Profile → Delete account
• If you cannot sign in: use the delete your account page, or email us.

It removes your account and email, your trips, charging sessions and the insights derived from them, trip notes, tyre records, uploaded export files and any stored GPS positions. Your vehicle is unlinked from the provider and any active subscription is cancelled, so you are not billed for an account that no longer exists.

One thing cannot be undone. If you opted in to community benchmarks, your figures were already pooled into anonymous averages. An aggregate is not tied to your account and cannot be traced back to it, which also means it cannot be picked out and removed again. Deleting your account stops any further contribution.

Depending on where you live, you have the right to access your data, correct it, delete it, receive a copy of it in a portable format, object to some processing, and withdraw consent you previously gave. Under the GDPR you may also complain to your local supervisory authority.

Deletion and correction you can do yourself, as above. For anything else, email [email protected] and we will respond within 30 days.

Data is encrypted in transit, access to the production database is limited to the service itself, and account data is separated so one user cannot read another’s. No system is perfect, and this is a small project rather than a large company — if we ever became aware of a breach affecting your data, we would tell you and the relevant authority as the law requires.

The service is not intended for children. We do not knowingly collect data from anyone under 13, or under the age of digital consent where that is higher in your country. If you believe a child has given us their data, contact us and we will remove it.

If the way we handle data changes, this page changes with it and the date at the top moves. Material changes will be announced in the app or by email rather than only here.

Questions about this policy, or about your data: [email protected].