Privacy policy

We take data protection seriously and process as little data as possible (data minimisation / privacy by design). This page explains what happens.

1. Controller

Green Chili Productions – Alfred Aigner, Kaiserschützenstraße 10, 5020 Salzburg, Austria.
Email: office (at) photo-aigner.at · Tel.: +43 676 7901777. See also the Imprint.

2. What data we process and why

When you add yourself to the map, we store:

• Nickname (freely chosen, no real name needed), public on the map.
• Vehicle model, public on the map.
• Approximate location: We store no exact position. The coordinates are rounded to a coarse grid of about 11 km (1 decimal place) before they are stored. In addition, a freely chosen region label (e.g. “Salzburg, AT”). Public on the map.
• Email address: not public, used only for the confirmation (double opt-in) and your personal deletion link.
• Hashed IP address (with a secret salt, cannot be reversed), used solely to prevent mass or spam entries. We store no plain IP address.

3. Legal basis

• Showing your entry on the map: your consent (Art. 6(1)(a) GDPR), which you actively give when you sign up and can withdraw at any time.
• Hashed IP for abuse prevention: legitimate interest (Art. 6(1)(f) GDPR) in a working, spam-free service.

4. Double opt-in

After you submit the form, you receive an email with a confirmation link. Only after you click it do you appear on the map. This way nobody can enter someone else's address without their consent.

5. Storage period & deletion

Confirmed entries stay until you delete them. Your personal deletion link is in the confirmation email. One click removes your entry completely. Unconfirmed entries are removed automatically after a short time. Lost the link? You can request it again at any time using the form “Delete entry” on the home page (we send it to the address you registered). You can also ask for deletion by email, without any formalities.

6. Recipients & hosting

Your data is not passed on for advertising purposes. The website and the database run on a server operated by us within the EU. There is no tracking by third parties, no cookies, no advertising networks, and fonts are served locally (no external font CDNs). How we count visits and downloads is explained in section 6a.

6a. Counting: visits, downloads, installations

We want to know whether pages and programs are used, but not who uses them. That is why we count without third-party services, on our own server in the EU:

• Visitor counting (Umami, self-hosted at analytics.serveone.at): on byd.serveone.at (home page, guides, Panoptes page, EV Cockpit page, phone app page, route planner, each also in English). Without cookies and without storing your IP address. What is stored: the page visited, the referring page, browser, operating system, device type, screen size, language, and country, region and city (derived from the address, but not the address itself), plus a random identifier that cannot be traced back to you and changes regularly. A click on a download button is counted as a “download” event, without us knowing who clicked. If your browser sends “Do Not Track”, we do not count. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in an overview of usage. You can object at any time (by email without any formalities, or with “Do Not Track”).
• Downloads: Panoptes is downloaded from GitHub. GitHub counts the downloads itself, and we only read the total per version. GitHub's privacy notices apply there. Panoptes also checks there for a new version every 6 hours unless you switch that off; GitHub then sees the car's IP address and the time. We count the EV Cockpit packages from the web server's access log, in which the IP address is shortened before it is written (last part removed). We count the phone app (file under /app/) from a separate log that contains no IP address at all and no browser identifier, only time, file, response code, size and whether the request came from a program such as a search engine robot. From this we get one number per day and version.
• Route plans: We count only the number per day (from the same shortened log). Start, destination and route are not recorded there.
• Installations (voluntary): The EV Cockpit and Panoptes can report regularly with a random identifier, the program version and the day (for the Cockpit also the vehicle model; for Panoptes from 0.1.31 the model and the DiLink version, but only once you have confirmed this new text, otherwise none of that). This is off by default and happens only if you agree in the program (Art. 6(1)(a) GDPR). No IP address, no VIN, no licence plate, no location. The service has no field for them and writes no log. If you untick the box, the program deletes all entries for your identifier, including model and DiLink version. Entries with no report for 90 days are combined into an anonymous monthly figure per program and version, and the individual entries are deleted.
• Counting the phone app (voluntary): The Panoptes phone app can report at most once a day that it is being used. It sends only a random identifier of the app and the app version; the day (no time) is stored with it. This is off by default and happens only if you switch on “Count anonymously” in the app (Art. 6(1)(a) GDPR). No IP address, no vehicle data, no location, no phone model. The same applies as above: no log, switching it off deletes all entries for your identifier, and after 90 days without a report only an anonymous monthly figure remains.
• Panoptes web app: Only if you switch on “Count anonymously” in the web app (default: off) does it send a random identifier and its version number at most once a day; no IP address, merged anonymously after 90 days without contact, deleted immediately when you switch it off (Art. 6(1)(a) GDPR). You find the switch in the web app under settings.
• Update check of the phone app: From Beta 3 the Panoptes phone app loads the small file /app/version.json at most every 6 hours to see whether there is a new version. It sends no identifier and no data about you or your car. Your IP address is technically needed for the connection; we do not log this check and store nothing from it (Art. 6(1)(f) GDPR, legitimate interest in safe, up-to-date versions). If you then download the update, what is written above under “Downloads” applies.

7. Map display (OpenStreetMap)

The map uses map tiles from OpenStreetMap. When the tiles load, your IP address is technically transmitted to the OSM servers. Details: OSMF Privacy Policy. We deliberately do not use any Google Maps services.

If you enter a city or region in the form, our server (not your browser) looks up the approximate coordinates through the OpenStreetMap service Nominatim. Only the place text you entered is sent to Nominatim, not your IP address. The result is immediately rounded to the ~11 km grid.

8. EV route planner & member access

Anyone can use the EV route planner without signing in. We store neither start nor destination nor your IP address. To protect against overload, the web server briefly counts requests per address in memory (rate limit), without logging them.

If you use a personal planner link as a confirmed member of the map, the following also applies:

• The link contains a random key, which we store in your map entry. It is in the fragment of the address (after #) and is therefore not transmitted to the server. Your browser sends it only when the planner is called.
• Saved own vehicle profiles (name, battery, charging power, consumption; at most 5) are visible only to you. The planner knows you only under a derived identifier, not by name or email.
• Price reports are counted via this derived identifier, so that three different members are needed before a price is accepted. The identifier is stored hashed. So that we can check new reports, the operator gets a short email with tariff, provider, country, price and, if given, the receipt link and note, without your identifier. The mailbox is hosted by Google (Gmail).

Further planner functions in detail:

• Weather and elevation profile: For the consumption calculation, our server (not your browser) asks Open-Meteo (France/Switzerland, CC BY 4.0) for temperature, wind and terrain elevation. Only individual waypoints of the route are sent (elevation about every 2 km, weather about every 60 km), no IP address and no indication of who is asking. We do not store start and destination in this process. The answers are cached briefly.
• Traffic and charger occupancy: For the planned route, our server asks TomTom (Netherlands) for traffic reports. TomTom receives only rectangles around the route and a few points on it. For the chosen charging stops, our server asks for live occupancy at the Swiss Federal Office of Energy (Switzerland) and at MobiData BW (Germany), and only the coordinates of the chargers are sent. In all cases there is no IP address and no indication of who is asking. Nothing of this is stored except a brief caching of the answers.
• Learning consumption (members only, voluntary): Your trips stay on your device (browser, EV Cockpit or car). A trip log is never stored on our server. For each trip, your device only requests the planner's calculation value (kilometres, travel time, optionally temperature and elevation gain; nothing is stored in the process) and at the end sends us only a finished consumption correction factor per vehicle, with the number of trips. For general vehicle profiles, this factor feeds into the community correction.
• Send route to the car (members only, only on button press): The route with start, destination, charging stops and path is kept ready for your car for at most 48 hours (one route per member and car) and is then deleted automatically. You can delete it yourself at any time. Only someone who has your personal key can retrieve it. If the car reports back whether it accepted the route or is navigating (status and number of the next charging stop, without location), this is stored with the route and deleted together with it.
• Several cars: If you have several cars, the planner tells them apart only by a random identifier that your car or your app creates, never by the vehicle identification number (VIN). Optionally, your app can send a display name you chose yourself (e.g. the model).
• Favourites (members only): Places you save as favourites yourself (e.g. “Home”, “Work”), we store with name, type, coordinates and optionally an address in your profile, so that they are the same in the planner, in the EV Cockpit and in Panoptes (at most 50). You can delete them at any time. Without member access, favourites stay exclusively in your browser.
• Own charge level (members): If your car reports its charge level, we store only the latest value, no history and no location.
• Sharing and saving: A shared link contains start, destination and settings in the address itself (after the #, so it is not transmitted to the server), but never your member key. Saved routes stay exclusively in your browser without a login. As a member, we store them on request in your profile (at most 50) so that they are the same in the planner, in the EV Cockpit and in Panoptes: only the plan (name, start, destination, waypoints, planned charging stops, settings) and the date of the last change, never a route driven, no travel times. You can delete them at any time.
• My charge cards: If you select which charge cards or tariffs you have, we store for members only this selection (which tariff, since when) in your profile, no charging sessions. Without a login, the selection stays in your browser and is sent along only with the respective request, not stored.
• Consumption factor and community value: Your device sends only a finished correction factor per vehicle model (no trips). It is always used for your own planning. It feeds into the community value of other drivers only if you expressly agree (switch under “Member”, default: off). Withdrawal takes effect immediately.
• Disconnecting a device: If you disconnect a car or the EV Cockpit from the planner, the device immediately deletes its key as well as the charge level, factor, route ready for pickup and arrival link of this car on the server.
• Viewing the trip log: Your trip log stays in the car. If you open it at /ev/, we only pass through a request and your car's encrypted answer (end to end: it is decrypted only in your browser, we cannot read the content). Both stay in memory for at most 2 minutes, are not stored and are not logged.
• Sharing arrival time: If you share your arrival time from the car, we store only the destination and stop name and the times (no position) for a secret link. It ends on arrival, on request, or after 12 hours at the latest.
• Connected devices: If you connect your car (Panoptes) or the EV Cockpit to your account, the device gets its own key with restricted rights. We store the device name, type, date of connection and the day of last use, and the key itself only as an irreversible checksum. You can remove any device at any time under “My devices”. Open connection requests expire after 10 minutes.
• To your phone (Google Maps, QR, GPX): The link, QR code and GPX file are created only in your browser, nothing goes to our server. If you open the link, your device sends start, destination and charging stops to Google (Google Maps). That is your decision and is subject to Google's terms.
• Installable app: The planner creates a small cache of the program files in your browser so that it also starts on a poor network. Calculations always run over the network.

The legal basis is your membership relationship or your consent (Art. 6(1)(a) and (b) GDPR). When you delete your map entry, access ends and all planner data is deleted automatically as well: own vehicle profiles, correction factors, charge levels of all cars, routes ready for pickup including feedback, favourites, saved routes, connected devices, your charge card selection and your price reports.

Where the charging stations in the route planner come from

The charging stations come from official, open national registers:

• Austria: charging point register of E-Control (with prices and availability).
• Germany: charging station register of the Bundesnetzagentur. Source: Bundesnetzagentur.de, licence CC BY 4.0. Availability and some prices: MobiData BW / Open Charge Point Database (only sources licensed CC0 or CC BY 4.0).
• Switzerland: Swiss Federal Office of Energy SFOE, charging stations for electric mobility (opendata.swiss).
• France: Base nationale des IRVE, data.gouv.fr, Licence Ouverte 2.0 (Etalab).

Prices reported by members only count once three members report the same price independently. No name is stored, only a non-reversible hash per member. All information without guarantee; prices and availability can change at any time.

8a. Panoptes community (shared rules & road condition)

More about the Panoptes community: byd.serveone.at/community.

In the Panoptes app, members can share automation rules (without personal data) and report road damage. For road reports, we store only the location and type of damage and the date rounded to the day, without lane and without vehicle identifier. The service knows you only through an irreversible checksum of your member identifier, not through an account of its own. Reporting and sharing are for members only. The catalogue of rules is publicly readable. When you delete your membership, your rules, ratings and reports are deleted automatically as well. Your IP address is only held briefly in the memory of the rate limiter and is not stored. Road contributions are anonymised after 90 days. Backup copies of the service are deleted after 7 days. You can delete individual categories (or everything) yourself in the app at any time.

8b. Panoptes: phone and PC over the internet (bridge)

When you are on the road, the Panoptes phone app or EV Cockpit on your PC reaches your car through a small relay service on our server, the “bridge”. It is off until you switch it on in the car yourself.

• End-to-end encrypted: phone app or EV Cockpit and car exchange the key directly when you pair them (for example via QR code); it never passes through the server. The server only forwards unreadable data. It cannot see vehicle data, places or commands. This also applies to recordings you watch on your phone on the road: it cannot read them and does not store them.
• We only store: a random mailbox ID (no name, no VIN), check values of the access keys of car, phones and EV Cockpit (the key cannot be calculated back from them), the day the mailbox was created and the day the car last connected.
• No IP logs: your IP address is only held briefly in memory to slow down abuse (at most about 24 hours) and is not stored. The web server's access log is switched off for the bridge.
• Only one count line per hour for the whole service: number of connections and rejections, total data volume. No mailbox ID, no IP, no content. It is overwritten with the system log as space requires, currently after about four weeks.
• Deletion: if you switch the bridge off in the car, your mailbox and all its entries are deleted. Unpairing a phone or EV Cockpit removes its access. If the car does not connect for 90 days, the server deletes the mailbox itself.
• Server: run by us, in the Hetzner data centre in Falkenstein, Germany.
• Legal basis: Art. 6(1)(b) GDPR, because you use a feature that you switch on yourself.

8c. Wish box on the start page

On the start page you can send us a wish. You do not need a name or email for it. Please do not enter any personal data in the text field.

• We only store: your text (at most 1000 characters), the app if you pick one, and the day (no time). This stays on our server only.
• No IP address: to prevent abuse we allow at most 5 wishes per day and connection. For this the server forms a non-reversible checksum from your IP address, which is held only in memory and forgotten at midnight. Neither the IP address nor the checksum is stored.
• Counting: our own visitor counting (section 6a) only counts that a wish was sent, without content and without the app.
• Notification: so that we read new wishes quickly, the operator gets a short email with the day, the app and the text of the wish, without IP address and without identifier. The mailbox is hosted by Google (Gmail).
• Deletion: wishes are deleted automatically after 12 months. As we do not know who sent a wish, we cannot link it to you. Tell us which text you sent and we will delete it at once.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to improve the tools according to what drivers wish for.

8d. Panoptes: weather in the car

Panoptes can show the weather in the car. This is off by default. Only when you switch it on in Panoptes is weather fetched from the internet (Art. 6(1)(a) GDPR). You can switch it off at any time.

• Today (up to version 0.1.26): the car asks the weather service Open-Meteo (France/Switzerland) directly. Only the position is sent, rounded to about 1 km, without an identifier, name or vehicle data. Because the car asks itself, Open-Meteo technically sees the IP address of the car's internet connection; Open-Meteo's privacy policy applies to this. The answer is kept in the car for 10 minutes.
• From version 0.1.27: the car no longer asks Open-Meteo, only our server byd.serveone.at (this service is already running). Only a rough area of about 10 km (0.1 degrees) is sent, without an identifier. The server does not accept more precise values. Our server then asks Open-Meteo, at most every 15 minutes per area, without Open-Meteo learning who is asking. Neither the area nor your IP address is logged, neither by the web server nor by the service. We only count how many requests there were per hour, and only in memory.

Weather data: Open-Meteo.com, licence CC BY 4.0.

8e. Panoptes phone app: notifications, videos and map

Applies from Android beta 4 of the phone app (0.3.0-beta4).

• Android: If the “ntfy” app is installed, notifications use it. Otherwise the app uses Google's delivery service (Firebase Cloud Messaging). Messages are end-to-end encrypted (Web Push): Google only sees that a message for this phone arrives and its approximate size, not its content. The app itself contains no Google library.
• Switching off: anytime in the app under “Diese App” (This app) → “Meldungen aufs Handy” (Notifications).
• iPhone: notifications currently go via Telegram. If you set up Telegram, the guard also sends pictures and clips there (on by default, turn off with /bilder aus).
• Videos and trip log: a video from the car or a trip log table only comes to your phone when you tap it, straight from the car and end-to-end encrypted (see 8b). It is stored only on your phone, in the folder Download/Panoptes. The app has no upload and no share button. Its cache is deleted as soon as you close the clip list. The trip log table contains no places.
• Web app for iPhone (panoptes.serveone.at): the page comes from our server, without cookies and without an access log. It connects to the car like the phone app through the bridge, end-to-end encrypted. The pairing key stays on your iPhone.
• Place search (phone app and web app): when you search for a place, your search text goes to our server byd.serveone.at. It asks the OpenStreetMap service Nominatim; your phone does not talk to Nominatim itself, so your IP address does not go there. We do not log the search and keep it only briefly in memory.
• Map in the app: it uses the same map source as your car; under “Erweitert” (advanced) you can pick your own in the app. If no source is chosen, the app loads no map. With “community” it loads map tiles from our server byd.serveone.at. It technically sees your phone's IP address and the map area, but does not log these requests. With “osm” it loads map tiles directly from tile.openstreetmap.de; that service sees your phone's IP address and the map area around the car, but no account, no identifier and no car data.

8f. Panoptes: reporting a problem

From Panoptes 0.1.31 you can report a problem to us from within Panoptes. Something is only sent when you send it yourself (Art. 6(1)(a) GDPR). Nothing goes out in the background.

• What is sent: your text, the Panoptes version, the car model, the DiLink version and the language. A diagnostic extract only if you tick the box (off by default); it is redacted in the car, and you see beforehand what goes out.
• Not stored: no IP address, no identifier of your car, no time (only the day), no location. The request is not in any access log. Please do not put personal data in the text.
• Notification: the operator gets a short email with the text and the details above, without the diagnostic extract. The mailbox is hosted by Google (Gmail).
• Cluster test: with “Send result” you send the report of the cluster test to us the same way. It contains the result, model and software version, no identifier and no location. You see it first and send it yourself.
• Deletion: reports are deleted automatically after 180 days. We delete them earlier on request: just give us the code that Panoptes shows you after sending.

8g. WhatsApp community

On the start page and for Panoptes we link to our WhatsApp community. The page loads nothing from WhatsApp and does not count clicks on the link. Joining is voluntary. WhatsApp is a service of Meta and its own rules apply there. Anyone who joins sees the admin's phone number; your number may also be visible to others.

8h. Panoptes: map in the car

When you search in the map in the car, your search text and, to find results nearby, the car's position rounded to about 1 km go directly from the car to public services: Photon (komoot), Nominatim (OpenStreetMap), depending on settings Stadia Maps. If you ask for the address of a point on the map, that exact point is sent. For chargers and fuel stations along the route, a rounded map area goes to Overpass (overpass-api.de). These services see the car's internet address, and their own privacy policies apply. This only happens when you search or use this display; from Panoptes 0.1.32.1 you can switch it off in the settings (on by default). Panoptes only fetches addresses for parking spots and recordings from Nominatim with the online switch turned on (off by default); the coordinates and the language are sent. If you paste a Google Maps short link (from Panoptes 0.1.36) and tap “Nachfragen” (ask), the car asks Google (maps.app.goo.gl) where the link points; only this link is sent, no position. Panoptes reads long links and Waze links without any request.

9. Your rights

You have the right to access, rectification, erasure, restriction, data portability and withdrawal of your consent (at any time, with effect for the future). Please contact the email address given above for this. You also have the right to lodge a complaint with the supervisory authority, in Austria the Data Protection Authority (DSB).