BYD Toolbox privacy policy

Last updated: 10 November 2026

The 10 November change: bydtoolbox.com now uses website analytics by default, with no consent banner. Google Tag Manager, Google Analytics 4 and Microsoft Clarity run when you open the site. Advertising storage stays off. See "Website measurement" below. Measurement of the app itself is separate and unchanged. Our contact address is now hi@bydtoolbox.com.

Who we are

BYD Toolbox is made by Bayside Technology Group ("we", "us"), with support from our partner Tech In A Sec. We are not affiliated with BYD.

Operator: Bayside Technology Group Pty Ltd (ACN 666 729 166)
Address (business and postal): 2/285 Carlisle St, Balaclava VIC 3183, Australia
Privacy contact: hi@bydtoolbox.com (general IT line, not free app support: 1300 403 404)

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we send marketing only in line with the Spam Act 2003 (Cth).

Summary

To download the app from the install page we ask for your email address and/or mobile number.
If you ask for a partner to install the app in Melbourne, or register interest for another state or territory, a separate Google Form asks for your name, email, mobile, and your address (street, suburb, state and postcode separately). That form is optional.
We only send you important updates and critical patch information (by email and/or SMS/phone) if you tick the separate box saying you want them. You can unsubscribe at any time.
In the app, usage analytics use a random install ID only. They contain no name, account, VIN, location or device ID, and you can turn them off.
Sharing data about your car model, and firmware reports, are separate opt-ins that are off by default.
If you report a bug or (on a paid plan) open a support ticket in the app, what you type is sent to our issue tracker so we can fix it; we automatically remove things like email addresses and keys from the text. A paid ticket also includes the contact email you give so we can reply.
Our servers do not store your IP address, browser headers or cookies. We do not sell your information.
bydtoolbox.com uses Google Tag Manager to run Google Analytics 4 and Microsoft Clarity for every visitor, with no consent banner. The install page (bydsetup.tias.com.au) still asks first, with an "Allow analytics" banner. Firebase is not used. See "Website measurement" below.

What we collect and why

1. Install page (bydsetup) and the in-app "Stay in the loop / Fleet & business" form

What	Why	How long
Email address and/or mobile number (at least one)	So we can contact you about BYD Toolbox, for example about your download, support or important updates	Until you ask us to delete it, and automatically 24 months after you last submitted the form (each new submission restarts the 24 months)
Whether you agreed to receive important updates and critical patch information by email and/or SMS/phone, and when	To send these messages only if you said yes, and to prove consent	As above
Topics you picked in the app (e.g. fleet, business, Starlink, IT support)	So we contact you about the right things	As above
Where the form was filled in (install page or app) and the app or page version	To tell the forms apart	As above
An unsubscribe token and whether you unsubscribed	To honour unsubscribe requests	The token is deleted with your record. If you unsubscribe we also keep a one-way keyed hash of your email address and/or mobile number (not the details themselves) with no end date, so we keep honouring your opt-out if you fill in the form again later

We store your email address and mobile number encrypted. If you send the same email or mobile again, we update your existing record instead of making a new one. To do this we store a one-way keyed hash of the email and mobile number.

Contact details are never needed to use the app. The install page shows the download once you submit the form, even if our server can't be reached. The page remembers in your browser's local storage that you have filled in the form, so it doesn't ask you again. The install page itself sets no cookies. If you choose "Allow analytics", the website measurement tags described under "Website measurement" may set their own cookies. The optional install-help links open a Google Form in a new tab (section 7).

2. Usage analytics in the app (on by default, can be turned off: Admin → Privacy)

What we collect: a random install ID made by the app, the event type (app opened, activated, feature used or export generated), the feature name and the app version.
What we keep: daily totals per event, which contain no install ID and are kept indefinitely. We also keep a per-install "active today" marker, which is deleted automatically after 2 days.
Why: to understand how many people use the app and which features they use, to improve it, and for our business purposes.

3. Firmware reports (opt-in, off by default)

What we collect: when the car's head-unit software version changes, the app sends the build name and the date of the change.
What we keep: a running count per build per day. We collect no identifiers. These totals are kept indefinitely.
Why: to see how BYD firmware updates are rolling out.

4. Data about your car model (opt-in, off by default: "Share read-only data for my model")

What we collect: the random install ID, the car model (e.g. SHARK_6), the powertrain (e.g. PHEV), and the PASS/WARN/FAIL results of the app's read-only checks.
What we keep: only the latest snapshot per install. It is deleted automatically if it isn't refreshed for about 13 months.
Why: to support more BYD models.
Status: collection is currently switched off on our server.

5. Test (developer) builds only

Test builds are only given to testers. The public app doesn't do any of this.

Check-ins: each launch sends a random install ID, the app version and the device model name. We keep the latest check-in per install, and a history that is deleted after 30 days.
Diagnostics reports: a tester can send a read-only diagnostics report. It contains technical details about the head unit, such as software versions, system apps and camera availability, and no VIN, location, account or serial number. We keep the latest report per install, and it is deleted automatically 90 days after it was sent. The latest check-in per install is deleted automatically after 90 days without a new check-in.

6. In-app bug reports and support tickets

Opening a report or ticket is your choice; the app never sends these on its own.

Bug report (any plan, free). When you tap "Report a bug" we send a random install ID, the app version, optionally your car model, and the text you write (a summary, optional detail, and, if you choose, read-only diagnostic logs). Before anything leaves the app and again on our server, we automatically strip things that look like email addresses, licence keys and access tokens from that text. We collect no contact details for a bug report and don't reply to it, it's opened for our team to triage.
Support ticket (paid Fleet/Business plan only). In addition to the above, you provide a contact email so we can reply, and the app sends your licence details so our server can confirm your plan.
Where it goes / how long: each report or ticket becomes an entry ("issue") in our private software issue tracker (GitHub) so we can act on it; it stays there until we close or delete it. We briefly keep a marker (about an hour) to avoid duplicates and to limit how many reports can be sent at once.
Why: to find and fix problems in the app, and to provide support to paying customers. Phone support is not offered for software, billing or licensing, these are handled in the app and in writing.

7. Partner install and interstate interest (optional Google Form)

The install page links to a Google Form. You can use it to request a partner job in Melbourne (VIC) to sideload and install BYD Toolbox, or to register interest for another Australian state or territory. Sending the form lodges a request. It does not confirm a time, and this policy does not set a price.

What	Why	How long
Request type: a Melbourne partner install, or interest for another state or territory	So we know which request you are making	Until you ask us to delete it, or until we no longer need it to handle that request
Full name, email and mobile	So we can contact you about the request	As above
Street address, suburb or city, state or territory, and postcode, in separate fields	So we can sort requests by region and, for a Melbourne job, know where to attend	As above
Notes, if you write any	Anything else you choose to tell us about the request	As above

Google LLC (United States) hosts the form. Responses are stored in a spreadsheet that Bayside Technology Group controls. We do not publish that spreadsheet. These answers are not stored on the install-page servers. For a Melbourne install, we may give the partner who does that job the name, address and contact details they need to attend. We use this form for install logistics, and to contact you when install dates open in your area.

Who can see it

Only authorised Bayside Technology Group / Tech In A Sec staff, through password-protected admin tools.
Partner-install requests (section 7) sit in a spreadsheet we control. The partner who attends a Melbourne job may receive the name, address and contact details needed for that visit.
We don't sell or rent personal information.
We don't share it with other organisations for their own marketing.

Service providers and overseas storage

Our servers and data storage run on Cloudflare (Cloudflare Workers, Workers KV and R2). To deliver and protect the service, for example by rate limiting, Cloudflare processes connection information such as your IP address. Our own code doesn't store it.

Bug reports and support tickets (section 6) are stored as issues in GitHub, a service of GitHub, Inc. / Microsoft (United States); GitHub processes and stores that content on our behalf, which may be outside Australia.

Partner-install requests (section 7) are processed by Google LLC (United States) through Google Forms, and stored in a spreadsheet we control.

Our service provider is Cloudflare, Inc. (United States). Cloudflare runs our code on its global network, so a request is handled in the Cloudflare data centre nearest to you, which may be outside Australia. Workers KV, where we keep the records described above, is in Cloudflare's words "a global, low-latency, key-value data store. It stores data in a small number of centralized data centers, then caches that data in Cloudflare's data centers after access" (developers.cloudflare.com/kv/concepts/how-kv-works). Cloudflare doesn't say which countries those central data centres are in, so your information may be stored or cached in the United States, Europe, Asia-Pacific or other countries where Cloudflare operates. App downloads and update files (no personal information) are stored in Cloudflare R2 with an Eastern Europe location hint.

Website measurement

This section covers bydtoolbox.com and the install page (bydsetup.tias.com.au). It does not cover the app. The download host updates.bayside.technology serves files only and runs no measurement. Files you download from bydtoolbox.com/download come from our own Cloudflare storage.

bydtoolbox.com: analytics are on. The site loads Google Tag Manager with analytics storage granted for every visitor. There is no consent banner. Advertising storage, ad personalisation and ad user data are never granted. Cloudflare Web Analytics also counts page views on this site. It does not set cookies.

Install page (bydsetup.tias.com.au): you choose. The install page starts with analytics storage denied, and anonymous page analytics stay off until you choose "Allow analytics" in its banner. Your choice there is kept in your browser's local storage (btg_web_analytics_consent).

What the tags measure: pages visited, the ?src= tag in the address (for example landing), device and browser type, approximate location from your IP address, and whether you tapped a download or install button. We do not send the email address or mobile number you type into the install form to Google Analytics, and Clarity masks form input fields by default. Google Analytics and Clarity set cookies in your browser.

Processor	Product	Role	Status
Google LLC (United States / Google Ireland Ltd)	Google Tag Manager and Google Analytics 4 (measurement ID G-NB948Y73YS, property 560667411)	Serves the tag container (GTM-TVTGLXDV) and measures page visits and download taps. The GA4 tag is not hardcoded on the page.	On for every visit to bydtoolbox.com. On the install page, only after you allow analytics.
Microsoft Corporation (United States)	Microsoft Clarity	Session and interaction measurement (heatmaps, recordings), injected through Google Tag Manager. Not embedded in the page HTML.	Same as above.
Cloudflare, Inc. (United States)	Cloudflare Web Analytics	Cookie-free page view counts for bydtoolbox.com.	On for bydtoolbox.com.
Google LLC	Firebase	Would process app analytics if that path is switched on later.	Not used. In-app analytics stay on our own servers, as described above.

We do not use any other tag container.

Turning website analytics off on bydtoolbox.com: block third-party cookies or scripts in your browser, use a content blocker, or install Google's Analytics opt-out add-on (tools.google.com/dlpage/gaoptout). You can also email hi@bydtoolbox.com and ask us to delete analytics data we can link to you.

Your choices and rights

Unsubscribe: use the unsubscribe link in any message we send, or contact us.
Analytics: turn them off in the app (Admin → Privacy). The opt-in features can be switched off the same way. On the install page, use "No thanks" or "Analytics choices". On bydtoolbox.com analytics are always on; see "Website measurement" for how to block them in your browser.
Access, correction or deletion: email hi@bydtoolbox.com and we'll help. Because analytics use only a random install ID, we may not be able to link that data to you.
Complaints: contact us first. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Security

Your email address and mobile number on the download form (section 1) are encrypted at rest. Partner-install responses (section 7) are stored by Google in the spreadsheet we control.
All connections use HTTPS.
Admin access needs a secret token.

Changes

We may update this policy. The current version is always at https://bydtoolbox.com/privacy.