WhereToFuel

This Privacy Policy applies to the WhereToFuel mobile apps and web app, together with any related pages, features, and services (the "Application"). The Application is operated by Hafiz Nordin ("WhereToFuel", "we", "us", or "our").

This document is intended to explain how personal data is collected, used, stored, and shared when you use the Application. It has been written to reflect the Application's current functionality, including the web version as well as Android and iOS versions.

Data controller

Hafiz Nordin is the controller of personal data processed through the Application.

Contact: hafiz.nordin@icloud.com

What personal data we process

We currently process the following categories of personal data:

• Location data when you grant location permission on a supported device. This may include precise latitude and longitude returned by your device.

• Postcode search data that you type into the Application in order to search for nearby stations.

• Local preferences and saved items stored on your device or in your browser, such as analytics consent, favourite stations, cached station results, cached postcode geocodes, and cached map tiles.

• Usage analytics data only if you choose to enable analytics. This may include events such as station views, searches, feature usage, and content selections, together with app or browser identifiers used by Firebase Analytics.

• Crash reports and diagnostics on the iOS and Android apps. When the app crashes or hits an error, Firebase Crashlytics may receive the error details, stack trace, device model, operating system version, app version, and an installation identifier. Crash reports do not include your location or postcode searches.

• Technical and security data processed by infrastructure providers to deliver and protect the Application, such as app integrity checks, browser or device metadata, IP address, and service request metadata.

• Contact data if you email us directly, such as your name, email address, and the contents of your message.

The Application does not currently require account registration, and it does not currently provide in-app user authentication.

How we collect personal data

We collect personal data in the following ways:

• directly from you when you enter a postcode, save favourites, choose analytics consent, or contact us;

• from your device when you grant location permission;

• automatically through service providers that support app hosting, database access, security, configuration, and analytics;

• from third-party services you ask us to use, such as postcode lookup and navigation or map tile providers.

Why we process personal data and our lawful bases

We process personal data for the following purposes and lawful bases under the UK GDPR and, where applicable, the EU GDPR:

• To provide the core service such as looking up nearby fuel stations, searching by postcode, showing maps, saving favourites, and remembering settings. Lawful basis: performance of a contract, or taking steps at your request before entering into a contract.

• To use your device location to find nearby stations when you choose that feature. Lawful basis: consent, provided through your device permission controls.

• To remember your choices and cache data locally so the Application works efficiently across sessions on mobile and web. Lawful basis: our legitimate interests in operating an efficient, reliable service.

• To protect the Application and prevent abuse through integrity and security checks. Lawful basis: our legitimate interests in securing the Application, preventing misuse, and protecting our infrastructure.

• To operate app configuration and release controls such as remote configuration and required update checks. Lawful basis: our legitimate interests in maintaining service quality, compatibility, and safety.

• To measure product usage and improve the Application where optional analytics are enabled. Lawful basis: consent.

• To detect, diagnose, and fix crashes and errors so the Application stays reliable.

Lawful basis: our legitimate interests in keeping the Application stable and secure. Crash reports are limited to technical data and are not used for advertising or profiling. You can object by contacting us.

• To comply with legal obligations and respond to lawful requests. Lawful basis: legal obligation.

• To answer support or legal enquiries you send to us. Lawful basis: our legitimate interests in administering the service and responding to users, and legal obligation where applicable.

Where we rely on consent, you can withdraw it at any time. For analytics, you can change your choice in the Application settings. For location, you can change permission settings in your device or browser.

Third-party services and disclosures

We share or make data available to third-party providers only where needed to operate the Application or where you choose to use a feature that depends on them.

Current providers may include:

• Google Firebase for Firestore, Firebase Analytics, Firebase Crashlytics, Remote Config, and App Check.

• Postcodes.io to convert a postcode or outcode into coordinates when you search by postcode.

• CARTO and OpenStreetMap tile providers to display map tiles.

• Google Maps, Apple Maps, or other installed navigation apps if you choose to open navigation externally.

• Apple App Store / Google Play / browser and hosting platform providers where relevant to installation, delivery, or platform operation.

We do not sell your personal data.

We may also disclose personal data:

• if required by law or legal process;

• to establish, exercise, or defend legal claims;

• to protect the rights, safety, or security of users, the public, or the Application.

What leaves your device or browser

Depending on the feature you use, the following data may be transmitted to third parties:

• postcode search text sent to Postcodes.io;

• search area coordinates and related request data sent to Firebase services when fetching nearby stations from Firestore;

• map tile requests sent to the configured map tile provider;

• optional analytics events sent to Firebase Analytics after you opt in;

• crash reports sent to Firebase Crashlytics when the app crashes or hits an error;

• app integrity or anti-abuse checks sent to Firebase App Check and, on supported web deployments, reCAPTCHA-related services where enabled;

• navigation destination coordinates sent to the external map application you choose to open.

Cookies, browser storage, and similar technologies

The web version of the Application may use browser storage, IndexedDB, cache storage, and similar technologies to store settings and cached content locally.

This may include:

• analytics consent preference;

• onboarding completion status;

• favourite stations;

• cached postcode geocodes;

• cached station and price data;

• cached map tiles.

If you enable analytics on the web version, Firebase Analytics and related Google services may use cookies or similar identifiers as part of that service.

You can usually clear locally stored data through your browser settings, by clearing site data, or by uninstalling the mobile app.

Data retention

We aim to keep personal data only for as long as needed for the purposes described above.

Current retention periods or behaviours include:

• postcode geocode cache stored locally for up to 30 days;

• station cache stored locally for up to 60 minutes, with price freshness treated as 15 minutes;

• favourite station IDs stored locally until you remove them or clear app/browser data;

• analytics consent and onboarding state stored locally until changed, reset, or cleared;

• cached map tiles retained locally in accordance with the application's caching behaviour unless you clear local data;

• optional analytics retained according to the retention settings configured in Firebase Analytics / Google services;

• crash reports retained for up to 90 days by Firebase Crashlytics.

Because the Application does not currently create user accounts, most user-specific data is either stored locally on your device or browser, or processed transiently by our service providers in order to respond to your request.

International data transfers

Some of our service providers may process personal data outside the UK or European Economic Area. Where this happens, we rely on appropriate safeguards required by applicable data protection law, such as contractual safeguards or another lawful transfer mechanism made available by the provider.

Your data protection rights

Depending on where you are located and subject to legal limitations, you may have the right to:

• request access to your personal data;

• request correction of inaccurate personal data;

• request deletion of your personal data;

• request restriction of processing;

• object to certain processing based on legitimate interests;

• request portability of data you provided where the law applies;

• withdraw consent at any time where processing is based on consent;

• lodge a complaint with your local supervisory authority.

If you are in the UK, you can also complain to the Information Commissioner's Office (ICO).

To exercise your rights, contact hafiz.nordin@icloud.com. We may need to verify your identity before completing a request.

Children's privacy

The Application is not directed to children under 13 and we do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, please contact us and we will take appropriate steps.

Security

We use reasonable technical and organisational measures designed to protect personal data. However, no method of transmission over the internet and no method of electronic storage is completely secure, so we cannot guarantee absolute security.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date below and publish the revised version.

Effective date: 2026-04-19

Contact us

If you have questions about this Privacy Policy or about how WhereToFuel handles personal data, contact:

hafiz.nordin@icloud.com