marit.esAbout marit.es
Why it exists, how it works, and what's open source.
How secure and private is marit.es?
- Direct authentication with Tesla — sign-in happens on Tesla's own page; marit.es never sees or stores your Tesla password.
- Registered Fleet API partner, verifiable — domain-verified with Tesla at app.marit.es, publicly checkable (details), not just a claim.
- Narrow, disclosed data collection — account email plus the vehicle telemetry the app's features need, nothing more; full list at what we store.
- Tesla credentials & location history encrypted at rest — access/refresh tokens and every stored GPS coordinate are AES-256-GCM encrypted at the database column level.
- Your data is never sold — no data brokers, no ad-tracking sale of vehicle data.
What it is
marit.es watches your Tesla in real time and tells you the moment something happens — a Sentry event, a finished charge, a drop in battery health — instead of you having to open the Tesla app and go looking. It's an Android app (Core Lite) and a web dashboard (Web), all reading the same live data.
Why it was built
The Tesla app itself doesn't push Sentry events reliably or instantly, and it wasn't built for that. The obvious open-source alternative, TeslaMate, is an excellent self-hosted data logger — but it's exactly that: a dashboard you self-host, not a mobile companion with push notifications, and running your own server just to get an alert when your car's alarm goes off is a lot of infrastructure for one notification.
marit.es started as a personal project to close that specific gap for one car: real-time Sentry alerts, drive and charge history, and battery tracking, without self-hosting anything. It grew from there into a small hosted service other Tesla owners could use too — the scope stayed the same, just more cars on it.
How it works
marit.es is built on Tesla's official Fleet API and Fleet Telemetry. Your car streams live data (battery, location, Sentry state, charging, speed) directly to the marit.es backend over an encrypted connection, and the apps read it from there. There's no scraping, no reverse-engineered endpoints, and no third-party data broker in between.
Sign-in happens on Tesla's own login page — marit.es never sees or stores your Tesla password. See the privacy section on the homepage for the full breakdown.
What data we store, and why
Here's exactly what marit.es keeps, grouped by what it's for — not a legal-speak list:
| Data | Why we store it |
|---|---|
| Account email | Identifies your account and lets you sign back in. That's it — no name, address or phone number is required to use marit.es. |
| Tesla access & refresh token | Lets marit.es keep reading your car's data and sending the handful of commands you've enabled, without you re-logging in constantly. Encrypted at rest — see below. |
| Vehicle telemetry (battery %, range, GPS location, speed, charging status, climate/cabin temps, tire pressure, odometer, Sentry state) | This is the product: live status, drive and charge history, battery health tracking, and Sentry alerts all come directly from these fields. |
| Drive & charge history, reverse-geocoded start/end addresses | Powers the Drives and Charges screens, route maps, and efficiency scoring. |
| Push notification token (FCM) / Telegram chat ID | Only stored if you enable notifications — it's how an alert actually reaches your phone or Telegram. |
| Billing reference (Stripe customer ID / Google Play purchase token) | Subscription management only. Your card number is never seen or stored by marit.es — Stripe and Google Play handle payment directly. |
What's actually encrypted at rest?
Two things, both with AES-256-GCM at the database column level, separately from Postgres's own storage, before they're ever written to disk: your Tesla access and refresh tokens — the credentials that let marit.es talk to your car — and every stored GPS coordinate (the latitude/longitude on each position record behind your Drives, Charges and route maps). Tokens are the highest-value target if this database were ever exposed — they're the one thing that could be used to send a command to your car. Location is the most revealing to a human reading the data directly — where you live, work, and go — so it gets the same treatment.
What about everything else — is the whole database encrypted?
Not blanket, and we'd rather say that plainly than round up. Battery %, speed, charging status, climate/cabin temps, tire pressure, odometer, Sentry state, drive/charge history metadata, and your account email live in the production database protected by network isolation and access controls, not per-field encryption. Tokens and GPS coordinates are the two exceptions (above) — the rest is far lower-value on its own, and we'd rather be accurate about the boundary than claim more than is true.
Where's it hosted?
On our own infrastructure — not shared with, or sold to, any third party or data broker. Deleting your account removes your stored vehicle data; see Privacy Policy for the full retention details, or how to delete your account for the exact steps and what's removed.
Permissions & virtual key
When you connect your Tesla, you're asked to grant a specific set of Tesla OAuth scopes — not blanket "full access." Here's exactly what marit.es requests and what each one is actually used for:
| Scope requested | What it's actually used for |
|---|---|
| vehicle_device_data | Battery, range, Sentry state, charging status, speed — the live data every screen shows. |
| vehicle_location | Live map position and drive route history. |
| vehicle_cmds | Required by Tesla to send any command at all. marit.es only ever sends: Sentry ON/OFF, honk, flash, and Boombox — see the full list below. |
| vehicle_charging_cmds | Requested, but not currently used — marit.es has no charge start/stop/limit control feature yet. Reads charge status only. |
| offline_access / openid / email | Standard OAuth plumbing — keeps you signed in and identifies your Tesla account. No password ever touches marit.es. |
The complete list of vehicle commands — nothing else exists in the app.
Sentry ON / Sentry OFF, Honk horn, Flash lights, Boombox. That's the entire allowlist enforced on the backend. No door lock/unlock, no trunk, no climate control, no charge control, and no drive-away command exist anywhere in marit.es — not hidden behind a toggle, not unimplemented-but-requested. If it's not in that list, marit.es cannot do it to your car.
Do you need a Virtual Key?
For a Model Y/3-generation vehicle on current firmware, yes — Tesla requires commands to be cryptographically signed. marit.es uses the same public/private keypair mechanism Tesla documents for third-party apps: the public key is installed on your car, the private key stays on the marit.es server, and the car only accepts a command if it's signed by the matching private key. You can remove the Virtual Key from your vehicle at any time from the Tesla app, which immediately revokes command access (read-only data access continues via the OAuth token separately, and you can revoke that too — see below).
Camera access / Sentry video clips?
No. Tesla's Fleet API does not expose Sentry camera footage to third-party apps at all — there's no scope that would grant it, and marit.es never requests or stores video.
How do I revoke access?
Tesla app → Security and Privacy → Security → Third-Party Apps, or via tesla.com/teslaaccount. Revoking there immediately kills both the OAuth token and any Virtual Key in one place.
Are you a registered Tesla Fleet API developer?
Yes — and this isn't a self-declared claim, it's independently checkable. Tesla's Fleet API won't accept a single signed vehicle command from an app until its domain has completed Tesla's partner registration and domain-verification process. marit.es is registered under app.marit.es; you can verify the domain-verification key Tesla requires is live right now at app.marit.es/.well-known/appspecific/com.tesla.3p.public-key.pem — if that file didn't exist, the honk/flash/Sentry commands above simply wouldn't work.
Open source
The backend — the Elixir/Phoenix engine that talks to Tesla's API and processes every drive, charge and Sentry event — is licensed AGPL-3.0 and published on GitHub at RaNd250/marites-backend. It's kept in sync automatically with what's actually deployed, so what you read there is what's running, not a stale snapshot.
The Android apps and the hosting infrastructure are closed source — that's the part that pays for the servers and the Fleet API costs. The backend being open is what matters for trust: anyone can verify exactly what happens to the data your car streams in.
Who's behind it
marit.es is built and run as a small independent project — one focused product, no outside investors, no roadmap pressure to add things that don't belong here.
Legal entity & data controller
marit.es is operated by VitalData, Panagi Tsaldari 67, 20400 Xylokastro, Greece. For privacy requests or to exercise your GDPR rights, contact [email protected].
What it isn't
marit.es is not affiliated with, endorsed by, or connected to Tesla, Inc. in any way — it's an independent third-party app built entirely on Tesla's public Fleet API. Your data is never sold. Core and Web carry no ads; Lite is ad-supported so a free tier can exist without a subscription.