Privacy Policy

1. Controller

The controller responsible for data processing in the Fuel app and on this website is:

Dennis Donner
Eduard-v-Winterstein-Straße 11
14480 Potsdam
Germany

I have not appointed a data protection officer, as I am not legally required to.

2. Scope and summary

This policy covers the Fuel app for iPhone (including CarPlay and the widgets), the Fuel app for Android (including the home-screen widgets) and the website fuel.donner.io.

In short: Fuel has no user accounts and no server that stores your logbook. Your cars, fill-ups, expenses and reminders stay on your device. When you search for nearby stations, your position goes to the station data provider for your region. The app uses analytics and crash reporting to understand usage and fix errors, without advertising IDs and without your logbook contents. Purchases run through Apple or Google.

3. Your logbook on the device

Everything you enter in Fuel is stored locally on your device: cars (name, make, model, fuel type, units, purchase data), fill-ups (date, odometer, quantity, cost, notes and, if you choose, the station and its location), expenses (category, amount, notes and, if you choose, the workshop location) and reminders. On iPhone the data lives in the app's container and is shared with the widgets and CarPlay on the same device. On Android the home-screen widgets read the data locally on the device.

I do not receive this data. There is no Fuel account and no copy on any server.

Device backups: if you have turned on iCloud Backup or a computer backup, iOS includes the app data in that backup. On Android, Google may include the app data in your device backup if backup is turned on in your system settings. These backups are run by Apple or Google under your account and their terms.
Deleting: you can delete individual entries and cars in the app. Deleting the app removes all data stored on the device; existing device backups remain until you delete them.

Legal basis: Art. 6(1)(b) GDPR (providing the app you use).

4. Location and nearby stations

Fuel only asks for your location when you use a feature that needs it, for example the search for nearby stations. On iPhone the app requests access only while you use it and with an accuracy of about 100 metres. Your position is not stored by me and is not part of your logbook unless you save a station or workshop with an entry.

Station search: the app sends your position and the search radius directly to the station data provider for your region: Tankerkönig (Germany), ANWB (Netherlands), the NSW Government FuelCheck service (New South Wales and Tasmania, Australia) or, elsewhere and as a fallback, public OpenStreetMap Overpass servers. Like any web server, they also receive your IP address.
Region lookup: to choose the right provider, the app determines the country of your position with the geocoding service of your operating system (Apple or Google).
Maps: maps are shown with Apple MapKit on iPhone and the Mapbox Maps SDK on Android. The map provider receives the technical data needed to load the map, such as your IP address and the visible map area. On Android, the map tiles come from Mapbox servers; Mapbox usage telemetry is switched off.
Station suggestions on Android: when you add a fill-up and location access is granted, the Android app sends your position and the app language to the Mapbox search service to suggest nearby stations. Mapbox also receives your IP address.
Directions: if you tap for directions, the app hands the destination over to Apple Maps, Google Maps or Waze. Their own privacy terms apply from then on.

Legal basis: Art. 6(1)(b) GDPR. You can turn off location access at any time (see section “Permissions”); the rest of the app keeps working.

5. Analytics and crash reports

To understand which features are used and to fix errors, the app uses the following services. They never receive the contents of your logbook (no fill-up or expense amounts, odometer readings, notes or locations).

Amplitude (data stored in the EU): usage events from a fixed list, for example that a car, fill-up or expense was added, a screen or tab was opened, a setting was changed, an export was made or a purchase was started or completed, plus app sessions and app starts. Events carry predefined properties such as fuel type, units, the region and provider of a station search, the app language, the number of cars, a rough count of fill-ups, whether location and notification access is granted, and for purchases the product, amount and currency, plus device model, operating system and app version. IP address, city, location and advertising IDs are not collected. Events are linked to a random purchase ID (iPhone) or the Android device ID (ANDROID_ID), so they can be connected over time but not to your name.
Google Firebase Analytics: only the automatic events of the SDK, such as first launch, app sessions, app updates and in-app purchases, with device and app information. The app sends no own events or properties to Firebase. On iPhone, Firebase Analytics is switched off if you decline tracking in the iOS tracking prompt or if tracking is restricted; until you answer the prompt it is active. On Android it is always active.
Google Firebase Crashlytics and Performance Monitoring: crash reports and performance data (stack trace, device model, operating system, app version, app state at the time of the crash, load times and network timings) with an installation ID.
Install source: on iPhone, the app requests an attribution token from Apple (AdServices) and asks Apple whether the installation came from an Apple Search Ads campaign. On Android, the app reads the Google Play Install Referrer and keeps only the source, medium, campaign and whether it was a paid campaign. The result is stored on the device and added to the analytics events above.

Your answer to the iOS tracking prompt only controls Firebase Analytics. Amplitude, crash reports and performance data are not affected by it, as they do not track you across apps or websites of other companies.

Legal basis: my legitimate interest in a stable app and in improving it (Art. 6(1)(f) GDPR). There is currently no switch for this in the app. You can object at any time by email to app-support@donner.io; I will then exclude your data.

6. In-app purchases

Some features of Fuel are unlocked with an in-app purchase. Purchases are processed by Apple (App Store) or Google (Google Play); I do not receive your payment details. To check which features you have unlocked on which device, the app uses RevenueCat. RevenueCat receives a random purchase ID (on Android the device ID ANDROID_ID), the purchase receipt from Apple or Google, the products bought and their status, plus device and app information.

If you cancel a subscription in the app on iPhone, the app may ask for a reason. If you choose one, the reason and any text you enter (up to 500 characters) are stored with RevenueCat. Answering is voluntary.

Legal basis: Art. 6(1)(b) GDPR for the purchase; Art. 6(1)(a) GDPR for the voluntary cancellation feedback.

7. Reminders and notifications

Reminders for maintenance and inspections are scheduled locally on your device as system notifications. No notification content is sent to me or to a push service. You decide in the system settings whether Fuel may show notifications.

8. Export, import and sharing

On iPhone and Android you can export your data as a CSV file or as a complete backup file (Fuel-Backup-YYYY-MM-DD.fuel, JSON format), import CSV and backup files, and share the monthly report. The file is created on your device and goes only where you send it, for example to Files, a cloud drive or an email. The target you choose processes it under its own terms.

9. Contact and support

If you write to me, for example via “Contact support” in the app, I process your email address, your message and the information the app adds to the draft: your purchase ID, so that I can help with purchase questions, and depending on the form also device model, operating system, app version, language and region and, on iPhone, the device name. If you send a crash report from the app, a technical log file may be attached. You can see and change the draft before sending it.

Legal basis: Art. 6(1)(b) GDPR for questions about the app or a purchase, otherwise Art. 6(1)(f) GDPR (answering your enquiry).

10. This website

Hosting: when you visit the website, the web host of this website processes technical access data (IP address, time, page, browser) in server logs to deliver the site and keep it secure (Art. 6(1)(f) GDPR).
No cookies, no analytics, no tracking. The website loads no fonts, scripts or images from other providers.
Language choice: if you switch between English and German, your choice is saved in your browser's local storage under the key fuel-lang, so that the start page opens in your language next time. It is not sent to me. You can delete it at any time via your browser settings.

11. Recipients

I use these service providers as processors on my behalf (Art. 28 GDPR):

Provider	Purpose
Google Ireland Ltd., Dublin, Ireland (with Google LLC, USA)	Firebase Analytics, Crashlytics and Performance Monitoring (privacy policy)
Mapbox, Inc., Washington, D.C., USA	Map display and station suggestions on Android (map tiles and search requests with IP address, approximate map area or position; privacy policy)
Amplitude, Inc., San Francisco, USA (EU data centre)	Usage analytics (privacy policy)
RevenueCat, Inc., San Francisco, USA	Managing in-app purchases; cancellation feedback (privacy policy)
Web host of this website	Hosting this website, server logs
Email provider for app-support@donner.io	Receiving and storing support emails

These recipients process data as independent controllers under their own privacy policies: Apple (App Store, purchases, rating prompt, MapKit, geocoding, AdServices attribution, Apple Maps, device backups), Google (Google Play, purchases, in-app rating prompt, Install Referrer, geocoding, Google Maps app, device backups), Waze, and the station data providers Tankerkönig, ANWB, NSW Government (FuelCheck) and the operators of the OpenStreetMap Overpass servers.

I do not sell personal data.

12. Transfers outside the EU

Where data is transferred to a country without an EU adequacy decision, the transfer is based on the provider's certification under the EU-U.S. Data Privacy Framework where available, or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

If you search for stations in New South Wales or Tasmania, your position goes to the NSW Government in Australia; this is necessary to provide the search you requested (Art. 49(1)(b) GDPR). The same applies if a request falls back to an OpenStreetMap Overpass mirror outside the EU; the app only uses the mirrors in that order if the primary server in Germany does not respond.

13. Retention

Logbook: on your device until you delete it or the app.
Analytics and crash data: as long as needed for the purposes above and within the retention settings of the providers; Google keeps Crashlytics crash reports for 90 days.
Purchase data: as long as the purchase is active and as required by commercial and tax law.
Support emails: as long as needed to answer your request and as required by law.
Server logs: for a short period only, as set by the web host.

If you want me to delete analytics or purchase data linked to your purchase ID or device ID, write to app-support@donner.io.

14. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Just write to app-support@donner.io.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the EU country where you live. The authority responsible for me is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (Brandenburg data protection authority)
Stahnsdorfer Damm 77
14532 Kleinmachnow, Germany

15. Children

Fuel is not directed at children under 16. I do not knowingly collect data from children.

16. Permissions

The app asks for these permissions only when a feature needs them. You can grant or withdraw them at any time:

Location: for nearby stations and for setting a station or workshop location.
Notifications: for maintenance and inspection reminders.
Tracking (iPhone only): your answer controls Firebase Analytics, see section “Analytics and crash reports”.

Fuel does not request access to your camera, photos, contacts, microphone or health data.

To change a permission: on iPhone go to Settings → Privacy & Security → Location Services → Fuel, or Settings → Fuel; on Android go to Settings → Apps → Fuel → Permissions.

17. Security

Your logbook is protected by the security of your operating system, which isolates app data from other apps. All connections of the app to the services named here use encrypted HTTPS. Please protect your device with a passcode and keep backups.

18. Changes

I update this policy when the app or the law changes. The current version is always available on this page; the date at the top shows when it was last changed.