Privacy Policy
CyberDeduct helps self-employed drivers keep a mileage log with the details the IRS asks for. This policy explains what we collect, why, who we share it with, and your choices.
1. Information we collect
You provide / your account
- Email, name, and a password (stored only as a scrypt hash with a per-user salt — we never store your actual password).
- Subscription status; payments are processed by Stripe (we never see or store your full card number).
- Business/tax profile you enter (business type, entity, business address) and a vehicle's purchase price / in-service date for deduction estimates.
From your Tesla (only after you connect it)
- Via the Tesla Fleet API/Telemetry: vehicle location, odometer, battery, charging sessions and cost, and navigation destination — used to assemble your trips.
- Trips we build from this: start/end places + coordinates, miles, category, purpose, notes.
- To fetch this on your behalf, we store your Tesla authorization — an encrypted refresh token — on our servers. Disconnect Tesla deletes that token. Unlink one vehicle stops tracking that VIN only; your Tesla login stays. Delete account stops Tesla tracking immediately and keeps the token with the rest of the account for 30 days.
On your device only — NOT sent to our servers
- SSN/EIN are encrypted on your device (Android Keystore or the iOS Secure Enclave, via secure storage) and never transmitted to us.
- Contacts and Calendar are read on your device to match a trip to a client/meeting; the matched name/title may be saved to that trip, but we do not upload your contact list or calendar.
- Location (phone) is used only to help fill a trip's place.
Automatically
- Device identifier, app version, platform; product events (e.g. signup, export) and crash/error reports (message, stack, version), associated with your account — used to operate and improve the app.
- Your device's time zone (for example "America/New_York"), saved to your profile when you sign in and when it changes. We use it to work out when each tax period ends and closes in your local time.
Connected services (optional, you initiate)
- Zoho Mail — if you connect it, we store an OAuth refresh token so the app can send follow-up emails from your address (only when you tap to send).
- Square — appointment matching, if you connect it.
- QuickBooks Online — if you connect it, we store an OAuth refresh token so you can post a vehicle-deduction journal entry to your books (only when you tap to send).
2. How we use it
To provide the mileage log and tax estimates; classify trips; sync across your devices; process your subscription; send service emails; provide support; secure the service and prevent abuse; and comply with law. We do not sell your data and do not use it for third-party advertising.
3. Who we share it with (service providers / sub-processors)
- Microsoft Azure — hosting and storage.
- Stripe — payments/subscriptions.
- Tesla — vehicle data you authorize.
- Zoho — email delivery (our notifications; and your mailbox if you connect it).
- Intuit (QuickBooks Online) — accounting export, if you connect it.
- Geoapify / OpenStreetMap — nearby-place lookups (we send coordinates, not your identity).
- xAI (Grok) — AI features (trip purpose, contact enrichment); we send the minimum context needed and no SSN/EIN.
We share only what's needed for these functions, and require them to protect it.
4. Data retention & deletion
We keep your data while your account is active. You can delete your account and data in the app (Settings → Delete my account) or by emailing info@initial-energy.com — see our Account & Data Deletion page. A delete request schedules removal: Tesla tracking stops immediately, and we keep the account for 30 days so you can sign in and cancel. After 30 days we permanently remove your account, trips, connected-service tokens, events, and error logs. Deleted data is removed from our backups within 90 days. Stripe retains billing records as required by law.
Tax period close & archives
- Tax periods / IRS-period close. We use the IRS estimated-tax periods, not calendar quarters: January 1–March 31, April 1–May 31, June 1–August 31, and September 1–December 31. After a tax period ends, you can still edit that period's trips for about 45 days (until 23:59:59 in your local time zone on day 45). The period then closes at 00:00 on day 46. The current tax period stays editable. This applies starting with September 1–December 31 2026 (first close about mid-February 2027).
- Reminders. After a tax period ends, we automatically email you three reminders over the following weeks to review and fix that period's trips before it closes, because once it closes it cannot be changed. We skip them if you had no trips that period.
- Archive at close. When a quarter closes, its records are saved to an archive with a checksum and kept for 3 years. The app cannot edit or delete a closed archive, and a changed file fails the checksum check.
- How long we keep archives. Each closed tax period's archive is kept for 3 years from the date that period closed, then deleted. Archives build up period by period, so each has its own 3-year clock.
- Download and re-import. At any time during those 3 years you can download a closed tax period as (1) a PDF mileage log and (2) a JSON data file with a checksum signed by our server. When you re-import an archive file, we check its checksum and our signature; a file that fails the check is not shown as a verified log.
- After closing, the records are your responsibility. Keep your downloaded files for as long as you may need them for taxes or an audit; after an archive's 3 years end we can no longer provide it.
- Account deletion. Deleting your account removes your live data as described above, but closed tax-period archives are not deleted early: each is kept until the end of its 3-year period and then removed. We keep them only to preserve your tax records and do not use them for anything else.
- Unknown time zone. If your device has not reported a time zone, we use the time zone of your business (LLC) location if we know it, otherwise the location you gave when you registered, and New York (Eastern) time only as a last resort. Whenever the zone was not reported by your device, we extend the close by 24 hours.
5. Your rights
Depending on where you live (e.g. GDPR/CCPA), you may request access, correction, deletion, or export of your data (closed tax-period archives cannot be corrected or deleted before their 3-year period ends, as explained in section 4), and may object to certain processing. Use the in-app delete, or email info@initial-energy.com. We don't discriminate for exercising these rights.
6. Security
Encryption in transit (TLS); passwords hashed (scrypt); tax IDs encrypted on-device and never sent to us; secrets stored server-side in managed configuration/Key Vault. No system is perfectly secure, but we work to protect your data.
7. Children
CyberDeduct is for adults running a business; it is not directed to children under 18, and we do not knowingly collect their data.
8. International
Data is processed in the United States. By using the app you consent to processing in the US.
9. Changes
We'll post changes here with a new effective date and, for material changes, notify you in the app or by email.
10. Contact
LIKE LLC — info@initial-energy.com
8401 Mayland Dr, Ste A, Richmond, VA 23294, USA