Delete your account and your data

How it works

1. 01

   You enter your email

   The address of the account you want to delete. For security, this page answers exactly the same whether or not an account exists with that address.

2. 02

   You open the link we email you

   It only reaches the account's mailbox, works once and expires after 24 hours. Opening it deletes nothing.

3. 03

   You confirm on that page

   You will see exactly how many records are about to be erased. Deletion happens when you press the button, and it is final.

Version without JavaScript

The server itself serves this same page as plain HTML, with no JavaScript and without depending on this website. If anything here fails, use that one:

Deletion page served by the server

What is deleted

All of this is removed from our servers immediately:

• Your account and your profile

  Email, name, avatar, preferences, the link with Google or Apple, the Home Assistant key and your session keys.

• Stored credentials and secrets

  Your carmaker account password (stored encrypted), your Google Maps, Open Charge Map and TomTom keys, the two-step verification secret and its recovery codes. They go with the profile: they are never exported and never kept.

• Your vehicles

  The whole garage: nickname, number plate, VIN, catalogue photos, capabilities and settings for every car.

• Trips, charging sessions and telemetry

  Every trip with its route and consumption, charging sessions with their energy and cost, the history of readings from the car (battery, range, odometer, position) and the car loans you noted down (who you lent it to, when and at what mileage).

• Maintenance and expenses

  Services, repairs and expenses you have recorded.

• Planned routes and shared trips

  The routes saved in the planner and the public shared-trip links —both the ones sharing the plan and the ones showing where you are live—, which stop working immediately. Of the live sessions only the times they were opened and the addresses notified were ever recorded: your location is never stored in the database.

• Convoy mode

  The convoys you created and your membership of other people's: the alias others saw you as, the join and leave times and the proposed meeting point. Your position during a convoy is never stored in the database: it lives in memory for a few minutes and vanishes on its own.

• Routines, smart charging and saved destinations

  Your automations, the smart-charging setup of each car, your address book of destinations (home, work and favourites), your favourite chargers and the charging tariffs you have registered.

• Linked carmaker accounts

  The Tesla or Mercedes-Benz OAuth grants and their access and refresh tokens. They are deleted from our server; revoking the grant in the carmaker's own portal, if you also want to do that, is a separate step only you can take.

• Notifications and devices

  Alert preferences, browser subscriptions, mobile push tokens, signed-in sessions, QR pairings of the car browser and the copilot, and any pending links or codes to verify your email or reset your password.

• Activity and security log

  Your event history, efficiency badges, the suggestions you sent, your charger reports and the failed sign-in attempts made with your address.

• Company fleet membership

  Your membership of organisations, the driver assignment history and any invitations sent to your email address. The organisation itself and other people's cars are untouched: only your link to them disappears.

• API tokens and webhooks

  Your personal read-only tokens (the name you gave them, their prefix and when they were last used; the token itself is never stored, only its fingerprint) and your outgoing webhooks with their URL, their events and their signing secret. Once deleted, any integration using them stops working immediately.

• Subscription and charges

  Your subscription and the history of payment attempts. INVOICES already issued are not included: see below why.

• Server cache

  The last known state of each car, which we keep in memory so we do not have to call the carmaker on every screen.

What is kept, and why

Promising a total wipe would be a lie. This is the only thing that survives:

• Invoices already issued

  If you ever paid for a subscription, the corresponding invoice is kept as an accounting document, but DETACHED from your account: it is no longer linked to your user and can no longer be consulted from the app. It still contains the tax data the law requires an invoice to show (name or company name, tax ID, billing address and amount).

  Why

  An issued invoice is an accounting and tax document: deleting it would be a breach of the law, not a privacy improvement.

  Legal basis

  Article 30 of the Spanish Commercial Code and articles 66 to 70 of the General Tax Act; the GDPR recognises this as an exception to the right to erasure in article 17.3.b.

  How long

  6 years from the date of issue.

  When it applies

  Only if you actually paid. If you never paid, there is no invoice.

• The record that the deletion was carried out

  One log line with the numeric identifier the account had, the cryptographic fingerprint (SHA-256) of your email address — not the address itself — and how many records were erased. It does not allow anyone to reconstruct who you were or to contact you.

  Why

  It is the only way to prove to an app store or to the data protection authority that your request was honoured, and to detect a deletion you did not ask for.

  Legal basis

  Legitimate interest in demonstrating compliance (GDPR article 5.2, accountability principle).

  How long

  Indefinite, in pseudonymised form (no readable personal data).

  When it applies

  Always.

• Administrative record, pseudonymised

  The admin panel's notes about your account (for example, when a licence was granted or revoked) and the notices the payment gateway sent us about your charges. They are kept, but deleting the account strips your identifier and your email address from them and replaces both with a cryptographic fingerprint. After that they cannot be traced back to you.

  Why

  Without the panel's notes there would be no way to justify why an account did or did not have a licence; without the gateway notices, the same charge arriving twice would be processed twice.

  Legal basis

  Legitimate interest in demonstrating compliance and in accounting integrity (GDPR articles 5.2 and 6.1.f).

  How long

  Indefinite, in pseudonymised form (no readable personal data).

  When it applies

  Only if an administrator acted on your account or there was any payment activity.

• Backups taken before the deletion

  Backups the administrator had downloaded BEFORE your request still contain your data until that copy is replaced or destroyed. They are never used to restore a deleted account.

  Why

  A backup is a sealed file: it cannot be edited without invalidating it as a backup.

  Legal basis

  Legitimate interest in service continuity; the GDPR accepts the technical delay of backup systems.

  How long

  Until the copy is replaced by one taken after the deletion, or deleted.

  When it applies

  Only if a copy existed before your request.

Invoices already issued are kept for 6 years, detached from your account. This policy is published by the ToyControl server itself, in both languages. The Spanish original is the binding version.

You can also do it from the app

If you can still sign in, open the app and go to Settings › Account › Delete my account. The result is exactly the same as on this page.

The app will ask you to confirm by email, just like here: you receive a link, and deletion runs when you open it and confirm.

Need help?

If you cannot complete the process, write to us and we will sort it out with you. Contact