HostKey hands a Turo guest your Tesla without you meeting them, and gets it back without you chasing them. The booking, the money and the insurance stay on Turo. We own one job: the handoff.
Model 3 · one of 36 renders the app ships for vehicle identification
A Turo host renting a Tesla has three bad options. Meet every guest in person and lose the evenings. Leave a key card in a lockbox and hope it comes back. Or add the guest as a driver in the Tesla app and hope you remember to remove them.
The last one is how most hosts do it, and it is the one that fails quietly — access outlives the rental until somebody notices.
A rental has an end time. The key should know it.
Three things in that message are decisions, not accidents.
It names the host and the car before the link. A bare link from an unknown number is indistinguishable from a phishing text, and rental guests are exactly who those target.
It says ignoring it is fine. Controls are opt-in. A guest who never taps loses nothing they were promised.
It carries STOP. Required on first contact under A2P 10DLC. It pushes the message to two segments and that is worth paying for.
The link is claimed by the first device that opens it; later devices are refused. That stops a link forwarded after the guest opens it. It cannot stop someone who opens it first — which is why the claim is reported to the host.
| Stage | What the guest sees | Why it is that way |
|---|---|---|
| Their trip | Start, end, the charge to return at, miles included. Before any setup, before any permission. | They came for the car, not for our onboarding. |
| Consent | A plain list of what the car reports to the host, with a driving-score switch and a terms switch that gates the button. Declining ends the flow there. | Location tracking disclosed in a policy nobody opened is not disclosed. |
| Finding it | We ask if they are at the car. Only someone who says no gets a map, and it is satellite. | A guest hunting a parking garage needs to see the garage. |
| Unlock | One tap, a short wait, the car opens. Lock, frunk, trunk, climate and seat heaters run from the page for the rest of the trip. | The page is the fallback key. It needs signal at both ends. |
| Tesla app | Recommended, argued, and skippable — with the key-card instructions behind the skip. | See below. This is the part competitors fudge. |
| Return | The car is read, not the guest asked. Then Tesla access is revoked, then the lock command goes, then the trip closes — only on confirmation. | Locking first and failing to revoke leaves a finished trip with a live key. |
Tesla blocks third-party BLE key access at firmware level. No partnership tier changes it. Every competitor that fudges this gets found out in a parking garage with no signal, and the guest is the one standing there.
What does work: with Guest Mode on (firmware 2024.14+), unlocking with the key card puts a single-use QR code on the touchscreen. The guest scans it and the car joins their own Tesla app for the trip — a real phone key that works with no signal at all. Turning Guest Mode off at the end revokes it. Same mechanism Hertz uses.
So the flow recommends the Tesla app, argues for it concretely, and lets them skip. Skip and it asks about a key card. No card either, and it says plainly that a dead zone means no entry.
| Claim we could make | Why we don't |
|---|---|
| Crash detection | No airbag or collision signal is exposed to third parties. What is possible is an accelerometer heuristic, and the product renders it as "sudden stop — could be hard braking or a minor impact." Calling a heuristic a finding is how a host ends up phoning a guest about a crash that never happened. |
| Battery health | Tesla publishes no state-of-health figure. Ours is derived from energy added versus charge gained across sessions, and is only meaningful as a 90-day trend. A single reading is noise. Any UI showing it has to say it is derived. |
| Fault codes | We have not confirmed Tesla exposes diagnostic trouble codes to third parties. It is not going on a pricing page before someone verifies it. |
| Tesla partnership | Fleet API approval is a developer-app review, not a partnership. HostKey is independent and unaffiliated with Tesla and with Turo. |
Not a video and not a mockup — the actual page a guest gets, at true phone width. Commands are simulated; no car exists.
Every screen fits a 375×667 phone with no scrolling. Measured, not assumed.
Tesla exposes vehicle data two ways: polling, billed per call, and streaming telemetry, far cheaper per data point. HostKey is designed telemetry-first with coalesced polling as a fallback.
This is the design target. Today the ingest handles three of these — speed, charge and location — and discards the rest.
| Signal | Used for | Ingest today |
|---|---|---|
| Location | Walk-up unlock, drive maps, geofence, loss prevention | handled |
| Speed | Speeding events, the red stretches on the drive map | handled |
| State of charge | Battery floor alerts, return checks, charge sessions | handled |
| Odometer | Mileage allowance, service intervals | discarded |
| Charging state & power | Charge sessions, Supercharging cost attribution | discarded |
| Door / trunk / frunk / window | The return check | discarded |
| Climate & cabin temp | Idle-climate alerts, preconditioning | discarded |
| Firmware version | Guest Mode gating, update lifecycle | discarded |
| Sentry / alarm | Alarm alerts | discarded |
| TPMS pressures | Fleet health, slow-leak warnings | discarded |
On location. Telemetry location is the largest data volume we carry, and the one that matters most to a guest. It is listed first on the consent screen, it says it continues for the whole trip, and a guest who declines ends the flow rather than being tracked quietly. Retention is stated in the privacy policy at two years. The job that enforces that deletion is not built yet — which is a gap, and it is listed as one below rather than papered over.
Each of these is bounded by something Tesla enforces, not by us. Where there is a floor or a limitation, the app says so rather than silently clamping a host who wanted something else.
| Control | Range | The real constraint |
|---|---|---|
| Speed limit | 50–90 mph | Tesla enforces the 50 mph floor. A host who wants 45 is told why they can't have it. |
| Valet mode | 70 mph | Caps speed and locks frunk and glovebox. Supersedes any higher limit you set. |
| PIN to drive | 4 digits | Car won't shift into gear without it. You choose whether the guest is shown the PIN. |
| Guest Mode | 2024.14+ | The firmware gate for QR pairing. Handles one guest at a time. |
| Charge floor | percent | Returning below it is recorded, not blocked. A guest stranded at the curb abandons an unlocked car, which is worse. |
| Allowed area | geofence | One home area plus no-go zones. Crossing logs an event; it does not stop the car. |
| Frunk | one-way | No Tesla but the Cybertruck closes its own frunk. The return flow says shut it by hand and blocks completion until it is. |
Because the car is on the owner's account, a guest's Supercharging lands on the owner's bill. Today hosts chase it manually or eat it.
Telemetry sees the session start and end, so we can write down kWh added, DC or AC, start and end charge, and the site. DC sessions during an active rental are the guest's. AC at the host's home is not.
Two rules for it. Never charge automatically — a silent card charge for a variable amount is how chargebacks happen. And show the arithmetic: "43.8 kWh × $0.42 = $18.40" is a bill; "$18.40" is a demand.
If they don't pay, the balance shows on the return summary and in the host's trip report, with the session as evidence for Turo's resolution process.
Status. The charge_sessions table is written and the simulation already produces sessions with kWh and cost. Nothing is wired to Stripe, there is no payment page, and taking money needs a registered legal entity that does not exist yet. This is the largest single item on the roadmap, and it changes the company rather than just the app.
Billing sits behind a seam so StoreKit or Stripe can drop in later. Today that seam holds a mock that grants instantly and charges nothing. Nobody can subscribe. These are the prices the app computes, not prices anyone has paid.
| Plan | Price | Vehicle cap | What it is |
|---|---|---|---|
| HostKey Mobile | $10 → $7 | unlimited | HostKey's own phone key. Mobile app only, no fleet dashboard. $10/vehicle up to 5, $7 above. |
| Tesla Text Invite | $8 → $5 | 10 | The text link; the guest connects their own Tesla account. $8/vehicle up to 5, $5 above. |
| Fleet | $15.99 → $11.99 | 500 | Both delivery methods, plus the fleet dashboard. Breaks at 10, 25, 50 and 100 vehicles. |
| Branded | $44.99 flat | unlimited | White-labeled, plus a $600 one-time build fee. Corporate quoted separately. |
A bug we found while writing this page. The volume breaks apply to the whole fleet rather than to the vehicles above the break — so six cars on HostKey Mobile bill $42 a month while five bill $50. Adding a car lowers the bill. The same inversion hits Tesla Text Invite at six vehicles, and Fleet at 26, 51 and 101. It is on the fix list, and it is why there is no pricing calculator here yet.
Everything Tesla-touching sits behind one interface with a simulated implementation and a real one that throws notConfigured. That is why the product can be demonstrated today, and why the swap stays contained when access lands.
| Component | Status | Detail |
|---|---|---|
| iOS app | shipped | Verified on a physical iPhone. |
| Android app | built | Never confirmed on the Pixel. |
| Backend | live | Supabase, row-level security on every table, anon-denial tested. |
| Guest web flows | prototype | Pickup and return, working end to end against simulated state. |
| Simulation engine | built | Energy, cabin temperature, charging, sleep. Physics verified against spec. |
| Tesla integration | not built | No developer account. All four edge functions return 501. |
| Payments | not built | No Stripe, no legal entity. |
| SMS | not built | No Twilio, no A2P 10DLC registration. The templates are written and measured. |
| Push notifications | not built | No APNs or FCM. Monitoring is close to pointless while the app is closed. |
| Account deletion | not built | Required before either app store will accept a submission. |
| Retention sweep | not built | The two-year policy has no job enforcing it yet. |
| Code rate limiting | not built | The six-digit redemption code is enumerable. Known, and on the list. |
Tesla has billed per use since January 2025 — per command, per poll, and most expensively per wake. A naive implementation that polls every car every minute models out around $86 per car per month. The same product with coalesced reads, a per-host budget and backoff models out around $1.63.
Both are projections against Tesla's published price list, not measured bills — we have never made a billable call, and the $1.63 assumes six rentals a month at three days each. But the gap is the reason the ledger and the budget cap get built before the first real request rather than after the first surprising invoice.