BackSecurity at TeslaSend
TeslaSend requires no account or personal profile. You can send links without providing your name or contact details.
Here is exactly what data the service touches, and what happens to it.
There is no account
You never sign up. When you open TeslaSend, your browser creates a random session for your links. Sending links does not require your name, email, or car details. If you choose to send feedback, we store the email address and message you provide.
A session ID that cannot be guessed
Your session is identified by a UUID: a random ID with about 5.3 undecillion possible values. Brute-forcing your way to one specific session is not a realistic attack.
On top of that, the database security rules forbid listing sessions entirely: the only way to open a session is to already know its exact ID from your QR code. Nobody can browse or list other people's sessions, not even us through the public API.
Deleting a link removes it
Deleting a link removes it from the active database. One-time links are deleted before the app opens them. Expired links disappear from the app, and Firestore TTL normally deletes them from the database within 24 hours. Links with no expiry remain until you delete them or, for one-time links, open them.
We only read the page title
To show a link nicely in your list, our server briefly fetches the target page just to read its title tag, then stops downloading as soon as the title is found. Only that short text (300 characters max) is stored next to your link. The content of the pages you send is never stored, indexed or analyzed.
What the analytics see
We use Google Analytics 4 for aggregated usage statistics: how many people visited, which pages they opened, and which features they used. GA4 uses cookies and browser identifiers. We do not record your screen or keystrokes, and the usage events we send do not include your links or feedback messages.
Where the links are stored
All traffic is encrypted with HTTPS (TLS). Links live in Google Firebase (Firestore) behind strict validation rules: the database accepts only a URL and a few small flags with hard size limits. Nothing else can be written to it.
Security FAQ
Can someone else see my links?
Only if they have your exact QR code or session ID. IDs are random UUIDs that cannot be guessed, and the database refuses to list sessions, so they cannot be found that way either.
Do you sell or share my data?
We do not sell or rent your data. We use Firebase to store your links. When you open a link in fullscreen, your browser sends its full URL to Google/YouTube. See the Privacy Policy for details about the services TeslaSend uses.
What happens when I delete a link?
It is removed from the active database. The app has no recycle bin. Deletion cannot revoke a URL that someone has already copied or opened.
Do you record my screen or what I type?
No. There is no session-replay or screen-recording software on the site. The only analytics is aggregated Google Analytics 4 page and feature usage statistics.
Do you open the pages I send?
The server fetches the page only to read its title, so the link looks nice in your list. It stops downloading at the title tag, and only the title text is saved.