Privacy policy

About this policy

This policy covers the Strike car app, the Strike phone app (project name Strike Connect), optional Strike Services, and strikebyd.com. Strike is an independent project maintained by UnrealSalty and is not affiliated with BYD.

No account registration is required. Pairing a phone still creates device identifiers and credentials. This policy explains those records as well as clips, alerts and technical information.

For privacy questions or requests, email [email protected].

On your devices

The car app accesses supported vehicle cameras and readings, such as battery or fuel levels, range, gear, ignition and lock state, to provide recording, surveillance and live view. Cabin audio is included when you enable it. Detection runs on the car. Clips, event details and recording settings are stored on the car or the storage you select.

The phone app receives the car information, video, audio, clips and logs needed for the features you use, including automatic status and log refresh and enabled alerts. It keeps paired-car profiles, preferences, alert history and fetched logs locally. Clips you save to the phone remain available offline; temporary playback buffers are kept in memory.

The phone camera is used to scan a pairing QR code. Scanner images are not uploaded by Strike. You can enter the pairing code instead. Live audio comes from the car; Strike does not use the phone microphone for this feature.

Strike Services

When you enable Strike Services, the service handles car and phone identifiers, pairing requests, credential hashes, connection information and notification settings. These records let an approved phone reconnect to its car and let you revoke access.

The service exchanges connection setup information and uses network addresses to protect against abuse. It also processes alert metadata, including event identifiers, types and times, so notifications can be delivered and synchronized.

The service database does not store your camera footage, cabin audio, downloaded clips or exported diagnostic logs. Media and requested car information travel between the car and phone through an encrypted WebRTC connection carried by a relay.

Notifications

If you enable push notifications, Strike registers a delivery token and your notification choices. Firebase Cloud Messaging handles delivery; on iPhone, delivery also uses Apple Push Notification service. Messages contain the alert text and an event identifier, rather than camera images, clips or cabin audio.

Delivery providers process device and network information under their own policies. Disabling push notifications removes the service registration when the request can be completed. In-app alert history is separate from push delivery.

Service providers

Strike uses providers to run the website and optional remote features. They process information needed to provide their part of the service:

• Railway hosts the website, service and PostgreSQL database.
• Cloudflare provides network and relay services. Relays carry encrypted phone connections and process connection metadata.
• Google / Firebase and Apple provide push notification delivery.
• GitHub hosts releases and project resources. The website requests current release information from GitHub.

If you choose Cloudflare or zrok browser access instead of Strike Services, your chosen tunnel provider carries the browser traffic under its own terms and privacy policy. Information may be processed in countries where the relevant providers operate.

We do not sell your data or use camera footage for advertising. Strike does not include advertising, analytics or crash-reporting integrations.

Storage and deletion

Clips on the car

Kept until you delete them or your recording and storage limits remove older clips.

Phone copies and history

Saved clips, fetched logs and local alert history remain until removed through the app, removal of the paired car, or clearing the app's data. Local storage limits also apply. Copies exported to your gallery or another app remain there until you delete them separately.

Service alert history

The service returns up to 200 alerts per car from the last 30 days after receipt. Older records are eligible for periodic cleanup, which can be delayed by service interruptions. Pending delivery jobs may remain until delivered, replaced by a newer alert of the same kind, disabled or removed with the relevant registration.

Pairing records

Kept while the registration is in use. Car registrations and their paired phones become eligible for cleanup after at least 12 months without authenticated contact from the car. Cleanup can happen later if service activity tracking has been interrupted.

Access removal

Removing a phone revokes its pairing and push registration. Shared car history may remain for other paired phones. Removing the car's service registration removes associated service records once connection and relay access have been revoked. Completed revocation receipts remain for approximately one further day; pending revocations can take longer.

Hosting and network providers may retain operational logs under their own retention settings and policies. Removing a pairing does not erase footage on the car or copies you have exported elsewhere.

Website visits

The website does not connect to your car. Website and service requests can produce technical records such as IP addresses, requested URLs, times and browser information for operation, security and troubleshooting.

The website uses session storage to cache release information during your visit. It does not use advertising or analytics cookies. Links to GitHub, Discord, app stores or other external sites take you to services covered by their own policies.

Security

Strike Services uses HTTPS and secure WebSocket connections, and the car-to-phone connection uses encrypted WebRTC transport. Pairing credentials are kept in the phone's secure storage; the service stores credential hashes and encrypts push delivery tokens before database storage.

These protections do not apply to every access method. Local browser access to the car can use HTTP, and browser tunnels have their own transport arrangements. Keep pairing codes, browser access codes and device access private. No system can guarantee absolute security.

Your choices

You can leave remote access off, revoke paired phones, choose which alerts to receive and delete clips. Exporting a clip or log shares it with the destination you choose. Diagnostic exports are not automatically sent to the developer.

Depending on the laws that apply to you, you may request access to, correction of or deletion of personal information, or raise an objection to its use. Contact us using the address below. We may need enough information to verify which registration your request concerns; do not send passwords or pairing secrets.

Strike is designed for vehicle owners and people they authorize. It is not directed at children. If you believe a child has shared personal information with us, please contact us.