FST Overseas Privacy Supplement

This notice covers data processing once the relevant overseas features are enabled. Availability is determined by the app and actual service entry points. Overseas real-vehicle validation is not complete; successful operation on every vehicle or network is not guaranteed.

Scope

Operator: Gu Zhentao (individual developer). Contact: gantzx@icloud.com. Applies to FST overseas services in North America and Asia Pacific outside mainland China. Actual availability is determined by App Store territories and the Tesla account region. Tesla's Europe API is excluded. Mainland China retains its original service and terms.

Processing Location and Purposes

The overseas backend runs on a Tencent Cloud host in Shanghai, China, using separate services, databases, login signing and storage encryption keys. It processes account authorization, vehicle identifiers and status, device notification identifiers, feature settings, consent records and subscription credentials for sign-in, vehicle status and authorized FST features, notifications, subscription access verification, fault diagnosis and security auditing. Authorization uses Tesla's North America Fleet API.

Separate Location Consent

Vehicle/phone location and related motion information are processed only after separate location consent for the current version and activation of location processing. Withdraw in the app. General privacy consent does not replace location consent. Withdrawal stops location processing and clears stored vehicle location that lacks consent.

Subscriptions and Recipients

Apple provides in-app purchases, signed subscription credentials and push infrastructure. Tesla provides account authorization, vehicle interfaces and telemetry. Tencent Cloud provides Shanghai server infrastructure. Subscription renewal or refund notifications are handled by the overseas service on the same host only after Apple signature verification and overseas account ownership checks. No new third-party forwarding or advertising use is added.

Retention and Deletion

Overseas climate records and high-beam events are each retained for 365 days, audit records for 180 days, consent records for 1095 days, and subscription notification deduplication hashes for 180 days. Service data is cleared within the 7-day window after service ends. Active subscriptions are not cleared under this window. Vehicle telemetry configuration must be removed successfully before clearing; failures are retried later. Inactivity does not automatically delete accounts. After account deletion, subscription financial statistics are retained for 2557 days after removing the original account association; these retained statistics are not described as fully deleted. The app provides account deletion. A failure to remove telemetry returns an error and must not be represented as successful deletion.

Contact and Clarifications

Contact the operator at the email above for privacy questions. This supplement adds no advertising or data sale use and makes no promise of absolute security, immediate deletion of every backup or unverified legal compliance. Overseas weather uses only Apple WeatherKit, after separate location consent and weather activation. No location is sent to weather providers without both.

Overseas Subscription Reconciliation and Out-of-Order Protection

Scope and Purpose

This section covers overseas subscription reconciliation. FST uses Tesla's America API region for North America and Asia Pacific excluding China, with the backend in Shanghai. China and overseas account data, Tesla authorizations, login signing and storage encryption keys are isolated. Apple WeatherKit and APNs authentication credentials for the same FST app are shared by both regions. Actual coverage depends on Tesla account and Fleet API support. Only subscriptions already bound to overseas FST accounts are queried for Apple transaction history and current status. Signatures, app identity, environment and account ownership are checked to determine subscription-dependent access. Reconciliation sends no vehicle commands, creates no users, and does not represent historical queries as received Apple notifications or new financial transactions.

Data Processed

In addition to existing subscription records, reconciliation state includes verification time, subscription record version, validation generation, current purchase time, bounded page counts, failure count and next retry time. Apple history continuation identifiers are encrypted with the separate overseas storage key. To prevent incorrect restoration from out-of-order renewals or refunds, account-linked original transaction hashes and verified refund purchase/revocation time thresholds are recorded. Pending refund facts may also contain transaction and original transaction hashes and signature dates. Hashes remain linkable to accounts and are not anonymous data. The reconciliation table does not store full signed payloads, plaintext transaction identifiers, vehicle identity or new financial event records. Encrypted original transaction identifiers in the existing subscription table follow that table's actual handling rules.

Validity, Retention and Cleanup

History continuation identifiers have a logical validity window of 24 hours. Enabled reconciliation maintenance clears expired identifiers and rescans. If maintenance is stopped or disabled, physical deletion at exactly 24 hours is not promised. Pending refund facts do not expire with continuation identifiers. They remain until verified resolution or associated account/service data cleanup; unresolved facts may persist throughout the account's lifetime. Successful reconciliation clears the pending facts for that attempt, while confirmed refund time thresholds remain to prevent incorrect restoration from later-arriving old transactions. Status verification, retry information and refund thresholds remain linked to accounts until account/service data cleanup. Enabled maintenance removes reconciliation records for soft-deleted or service-data-cleared accounts; physical account deletion removes them by foreign-key cascade. Disabled or failed maintenance does not guarantee immediate cleanup. Logical database cleanup does not promise immediate disappearance from all logs, storage pages or backups. Reconciliation does not extend existing financial record or notification receipt retention rules.

Behavior on Failure

Subscription-dependent execution pauses if ownership is uncertain, refunds remain unresolved, verified status is stale, the table is missing or Apple queries fail. Query failure alone does not establish a refund, fabricate notification delivery or claim financial data deletion. Without new valid evidence, suspension may continue until valid verification or authorized manual handling.