`docs/legal-and-appstore.md`

99 lines
# Legal, Privacy & App Store Gates

These are launch **blockers**, not nice-to-haves. The single biggest risk is
**data rights**, not code.

## Tesla Fleet API — permitted use

- Registered developer app; OAuth authorization-code flow via Tesla's auth service
  + **server-side** token exchange. The iOS app uses `ASWebAuthenticationSession`,
  never an embedded username/password form.
- Backend (not the iOS binary) holds the Tesla app secret. Auth request carries a
  cryptographically random `state`, a nonce where supported, exact redirect-URI
  matching, replay protection, and **PKCE** if Tesla's config supports it.
- Refresh tokens are **rotating secrets**: commit the replacement atomically so
  concurrent refreshes can't clobber the newest. The app receives only a
  short-lived first-party session token — **never** Tesla refresh credentials.

### Scope policy

| Capability | v1 | Rationale |
|---|---|---|
| Sign in with Tesla | Include (optional) | Identity + authorization without in-app credentials |
| Offline access | Include (after explaining persistence) | Refresh tokens + charging alerts when app is closed |
| Vehicle data | Include | Battery state, charge status, limit, config |
| Vehicle location | Include (separate disclosure) | Highly sensitive; Tesla surfaces a sharing indicator |
| Vehicle commands | **Defer** | Needs virtual key + command proxy → big security/legal/review risk |
| Charging commands | **Defer** | Unnecessary for discovery |
| Broad profile data | **Exclude** | Home address / contacts not needed |

### Fleet Telemetry

Opt-in, field-level consent only. Minimum signals: `Soc`/`BatteryLevel`,
`ChargeState`, `TimeToFullCharge`, `FastChargerPresent`, optional `Location`. Use
minimum-change thresholds. **Never** silently enable on sign-in — separate toggles
for "Connect my vehicle", "Use live charging updates", "Use precise vehicle
location", "Save trip history". Keep our own disconnect/deletion/reconciliation.

## Supercharger data & licensing

Tesla's endpoint is **not** a bulk export / redistribution license. Therefore:

- **Do not** crawl Tesla's website, in-car endpoints, app traffic, or undocumented APIs.
- **Do not** sweep synthetic coordinates through `nearby_charging_sites` to build a DB.
- **Do not** store/redistribute Tesla fields beyond the Fleet API Agreement.
- **Do** license a station DB (NREL / HERE / TomTom / direct CPOs) and keep
  field-level provenance for every value.

## Trademark & affiliation

Brand as **Charge & Explore** / **ChargeStop** (cleared, neutral). Do **not** use
"Tesla" as the leading app-name word, Tesla's "T"/wordmark/Supercharger graphic/
vehicle silhouettes/UI imitation, or red-white treatments implying officialness.
A counsel-reviewed nominative phrase ("Find compatible charging stops for Tesla
vehicles") may be OK in descriptive copy **with** a conspicuous
independent/not-affiliated disclaimer. Run a trademark clearance search on the name.

## Privacy-law posture

Precise vehicle/phone location, trip history, VIN, and charging behavior reveal
home/work/routines. Precise geo = **sensitive** under CCPA; GDPR requires lawful,
transparent, purpose-limited, minimized, accurate, secure, retention-limited
processing. iOS permission dialogs alone are **not** a complete GDPR consent record.

Retention defaults (product decisions, not safe harbors): refresh token → until
disconnect/expiry/deletion · raw telemetry → 24h · precise route/location →
transient, no history by default · derived session → 30d when history enabled ·
search logs → 7d · security logs → 30–90d. Provide in-app access, export,
disconnect, history clearing, and **account deletion** (with token revocation +
auditable deletion jobs).

COPPA: not child-directed; no child profiles, no child-targeted marketing,
age-appropriate rating. Family-friendly recs are for adult drivers — don't collect
children's data.

## App Store review-risk matrix

| Risk | Mitigation |
|---|---|
| Background location | Default "While Using"; use server telemetry + APNs for charging alerts; add "Always" only if a later feature demonstrably needs it. |
| Misleading Tesla affiliation | Neutral branding, no Tesla logo, disclaimer, trademark clearance, license docs in review notes. |
| Unlicensed station/place data | Keep signed provider agreements + attribution; summarize licenses in App Review Information. |
| Vehicle-dependent review path | Complete **demo mode** with synthetic vehicle/route/station/telemetry + credentials + exact steps. |
| Vehicle-control scopes | Don't request command scopes in v1; explain read-only in review notes. |
| Privacy-label mismatch | Xcode privacy reports; audit every SDK; align code + `PrivacyInfo.xcprivacy` + policy + App Store answers. |
| Missing account deletion | Settings → Account → Delete Account with confirmation + revocation + deletion job. |
| Distracting in-car UX | Keep phone experience passenger/parked-oriented; CarPlay is a later entitlement. |
| Unsupported "live"/"safe" claims | Show provider + freshness + confidence + "estimate" labels; no real-time claims without an authorized dynamic feed. |

## Security baseline

OWASP **MASVS** as the standard, **MASTG** cases for release verification. OAuth
hardening (state/nonce/one-time code/confidential exchange/PKCE/atomic rotation),
KMS-encrypted tokens (never on device), Keychain session token, scope
minimization, TLS + schema validation + per-object authz + rate limits +
idempotency, data separation (PII / OAuth / telemetry / public / analytics),
log redaction (VIN, coords, tokens, codes, endpoints), provider isolation
(server-only keys, allowlists, timeouts, circuit breakers, cost ceilings), user-
content moderation, and a documented incident-response + token-revocation path.