Privacy Policy & Data Sovereignty Specification

1. Fundamental Privacy Axioms

Most automotive telemetry platforms require cloud accounts, transmit unencrypted GPS and battery traces to corporate data centers, and monetize user driving profiles for insurance underwriting or behavioral targeting.

Exergy operates on fundamentally different architectural and cryptographic axioms:

• Zero Account Required: The in-vehicle application operates with zero registration, zero email verification, zero passwords, and zero mandatory internet connectivity.
• The Vehicle is Data Sovereign: The primary authoritative database is stored in SQLite format directly on the vehicle's internal flash storage.
• End-to-End Encryption by Default: When synchronization with companion mobile phones is enabled, all payloads are encrypted in vehicle memory before transmission.
• Blind Cloud Relay: Any cloud relay infrastructure is operated strictly as an untrusted, blind mailbox. The server has no technical capability to decrypt or inspect payloads.
• No Commercial Profiling: We do not track users, build behavioral profiles, or sell telemetry data to third parties under any circumstances.

2. Automotive Signals & Telemetry Processed

Exergy accesses vehicle properties via the official Android Automotive OS Car API (CarPropertyManager). All processing occurs locally within the isolated application sandbox on the vehicle:

• Vehicle Speed & Dynamics: Read via PERF_VEHICLE_SPEED and GEAR_SELECTION at 10 Hz, downsampled to 1 Hz for trip analysis.
• High-Voltage Battery Telemetry: Instantaneous voltage, instantaneous current, state-of-charge (SoC), and pack energy capacity via EV_BATTERY_LEVEL and EV_CURRENT_BATTERY_CAPACITY.
• Environmental Temperature: Ambient outdoor temperature via ENV_OUTSIDE_TEMPERATURE, used to calculate air density ($\rho$) corrections and HVAC thermodynamic heating coefficients.
• Climate Conditioning State: HVAC system power draw via HVAC_POWER_ON and thermal blower state to isolate cabin comfort energy from mechanical propulsion.
• Geolocation & Elevation: Android Location Services GPS coordinates and barometric elevation data, used strictly to compute gravitational potential climb work ($m g \Delta h$) and map trip segments.

Storage Location: All recorded telemetry resides in a private SQLite database inside the app sandbox (/data/data/science.exergy/databases/exergy.db). No other application on the vehicle has access to these records.

3. Optical QR Code Key Exchange (In-Cabin Ceremony)

Traditional applications require entering user credentials that authenticate against a remote identity provider. Exergy replaces this with an optical in-cabin key exchange:

• When pairing is initiated, the vehicle must be physically stationary in PARK.
• The vehicle generates a cryptographically secure 256-bit symmetric Pre-Shared Key ($K_{\text{shared}}$) using a cryptographically secure pseudorandom number generator (CSPRNG).
• The vehicle generates an ephemeral Ed25519 keypair and calculates a blind mailbox identifier: BLAKE3(PublicKey).
• The vehicle renders a high-density optical QR code on the central infotainment display:

  exergy://pair?v=1&box=<blind_mailbox_id>&k=<base64_psk>&relay=https://relay.exergy.science

• The companion phone camera scans the QR code directly. The shared key is committed to the mobile device's hardware-backed keystore (Android Keystore with StrongBox or iOS Keychain with Secure Enclave).
• Zero bytes are transmitted over the internet during the pairing process. The secret key never touches any server.

4. Cryptographic Envelope & E2EE Protocol

All synchronization chunks between the vehicle and companion mobile applications are encapsulated using authenticated encryption:

• Cipher: XChaCha20-Poly1305 (AEAD with 192-bit extended random nonce).
• Replay & Nonce Protection: The 192-bit CSPRNG-generated nonce ensures that nonce collision probability is cryptographically negligible, even across millions of synchronization chunks generated without central clock coordination.
• Integrity Verification: A 16-byte Poly1305 MAC tag guarantees that any altered or corrupted ciphertext blob is rejected immediately before decryption.

5. Blind Cloud Relay Operations & Data Retention

When remote synchronization is enabled over cellular networks:

• The vehicle pushes encrypted binary blobs to an endpoint: https://relay.exergy.science/v1/mailbox/<mailbox_id>/message.
• The relay server operates blindly: it stores only the mailbox_id (a one-way BLAKE3 hash), the ciphertext blob, and a monotonic sequence counter.
• Zero Knowledge: The relay operator cannot determine the driver's identity, vehicle VIN, GPS tracks, origin, destination, vehicle speed, battery state, or charging habits.
• Strict Ephemeral Retention: Ciphertext messages are automatically deleted from the relay mailbox immediately upon receipt of an authenticated client acknowledgement, or pruned unconditionally after 14 days.

6. 100% Offline Cabin Wi-Fi Direct Sync

Users who prefer not to utilize any cloud relay infrastructure may select local-only sync:

• When the companion phone is connected to the vehicle's in-car Wi-Fi hotspot, Exergy discovers the vehicle service using multicast DNS (mDNS: _exergy-sync._tcp.local).
• A direct, local TLS 1.3 socket is established between the phone and the vehicle head unit, pinned to the paired public key.
• All trip records and high-frequency telemetry synchronize directly over the vehicle cabin network at local Wi-Fi speeds.
• Zero bytes leave the physical vehicle cabin. No cloud servers or internet connections are involved.

7. Open Data Architecture & User Portability

We firmly reject proprietary data silos. All collected data belongs unconditionally to the vehicle owner:

• CSV Export: Second-by-second 1 Hz telemetry and per-trip summaries compatible with spreadsheets, Python pandas, and data science tooling.
• JSON Schema: Full hierarchical object graphs including physical aerodynamic attribution, rolling resistance values, and HVAC thermal splits.
• Enhanced GPX: Standard GPS Exchange Format tracks augmented with custom XML extensions recording power, efficiency, and elevation for spatial GIS analysis.

8. Optional Third-Party Integrations

Exergy offers optional integrations with external services. These features are strictly opt-in and disabled by default:

• A Better Routeplanner (ABRP): If enabled, Exergy forwards instantaneous battery SoC, speed, and charging power to the official Iternio ABRP Telemetry API using a user-provided API token. Data transmission is subject to Iternio's privacy policy.
• Home Assistant (MQTT / Webhook): If enabled, Exergy publishes vehicle arrival and battery state to the user's private local Home Assistant instance for solar charging automation. All credentials and network targets remain local to the user's network.

9. User Rights (GDPR, CCPA/CPRA, Global Compliance)

Under global privacy frameworks including the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA/CPRA):

• Right to Access & Portability: You can export 100% of your records at any time from the vehicle or mobile companion in open formats.
• Right to Erasure (De-Identification): You may purge all historical trips, charging curves, and paired device associations with one tap in vehicle settings (Settings > Storage > Factory Reset Database). This writes zeroes to the local SQLite database files.
• No Data Sales: Exergy does not sell, license, or transfer personal or vehicle data to third-party data brokers, insurers, vehicle OEMs, or ad exchanges.

10. Inquiries & Cryptographic Audit Inquiries

For legal questions, cryptographic protocol reviews, or data sovereignty inquiries, contact our team: