PumpSpyPrivacy Policy
Effective date: [DATE — set at launch]
PumpSpy ("we", "our") is a gas-price finder app. The core app is free; an optional Premium upgrade (a yearly subscription) is available. This policy explains what data PumpSpy collects, why, and what choices you have. It applies to the PumpSpy iPhone app (and the Android app, when released).
Contact: pumpspy.support@gmail.com
The short version
- No ads. No analytics SDKs. No data sold. We do not sell your personal data or share it with advertisers or data brokers.
- Search and price reporting work without an account.
- An account (username, email, password) is only needed for comments, price-drop alerts, and the leaderboard.
- Your precise location is sent to our servers when you search with location on and when you confirm a price — it is used only to compute distances and verify you are at the station, and it is never stored.
- Camera photos of price signs and pumps are sent for automated price reading and are not stored.
- Passwords are stored only as salted cryptographic hashes — we never see your password.
- Premium is optional ($9.99/year, requires a PumpSpy account). Payment is handled entirely by Apple through the App Store — we never see or store your payment or card details; we only record your premium status and expiry date to unlock premium features.
Data we collect and why
1. Account data (only if you create an account)
- Username (3–28 characters) — shown publicly next to your price reports, comments, and leaderboard rank.
- Email address — used as your sign-in identity and for account-related contact. The app owner can view account emails for support purposes.
- Password — stored only as a salted hash (PBKDF2-SHA-256, 210,000 iterations). We cannot see or recover your password.
- Avatar (optional) — if you upload a profile photo, it is stored on our servers and shown next to your public activity. If you don't upload one, we show your initials.
- Premium subscription — if you upgrade, we record your premium status and its expiry date on our servers to unlock premium features. Billing is handled entirely by Apple; we do not collect or store your payment or card information.
You stay signed in until you sign out. Sign-in tokens are stored as one-way hashes on our servers and in your phone's local storage.
2. Your contributions (public by design)
Anything you deliberately publish in PumpSpy is visible to other users:
- Price reports — station, fuel grade, price, and when it was reported. Shown with your username and avatar (or anonymously, if you report signed out).
- "Still current?" confirmations — your confirmation refreshes a price's freshness timestamp.
- Comments and replies — shown with your username and avatar.
- Leaderboard — your username, points, and badges are visible to signed-in users on your cities' leaderboards.
- Price-drop alerts — your target price per fuel type per city. These are private to your account; other users never see them.
Do not post personal information (phone numbers, addresses, etc.) in comments or reports — other users can see it.
2a. Premium features (only if you subscribe)
Premium adds features that store extra data, visible only to you:
- Fuel log — fill-ups you record (station, fuel grade, volume, price, date). Used for your yearly fuel-spend tracking and your annual savings report.
- Trip estimator inputs — the figures you enter to estimate a trip's fuel cost. Kept with your account while Premium is active.
- Push notification token — your device's push token is stored so we can deliver price-drop push alerts (a Premium feature) to your phone. In-app alerts work without this.
This data is deleted when you delete the corresponding entry, disable the feature, or delete your account.
3. Location
PumpSpy uses your phone's location for station distances, at-the-pump prompts (checked entirely on your phone, around 150 m), and "Still current?" confirmations (verifying you are within about 200 m of the station).
How location is handled, precisely:
- Your coordinates are sent to PumpSpy's servers when you search with location enabled (to compute driving distances) and when you confirm a price (to verify you are at the station).
- They are used only for that request and are never stored — no table in our database holds your location history.
- When computing driving distances, your coordinates are also sent to the public OSRM routing service as the route origin, together with station coordinates.
- Location permission is optional. Without it, you can still search, report, and browse — you just won't see distances from your position, at-the-pump prompts, or GPS confirmations (a photo of the pump or price sign works as an alternative).
4. Camera and photos
- Price-sign / pump scanning: when you scan a price sign, pump, or screenshot, the image is sent to our servers and passed to Google's Gemini API for automated price reading. Scan images are not stored by us — they are processed and discarded. The project runs on Google's paid billing tier, under which Google's terms state your prompts and responses are not used to improve its products.
- Confirmation photos: if GPS is unavailable, you can confirm a price with a fresh photo of the pump or price sign. It is verified automatically the same way and not stored.
- Avatars: profile photos you upload are stored and shown next to your public activity.
PumpSpy does not access your photo library except for images you explicitly choose to upload or scan.
5. Device and technical data
- Random device identifier: the app generates a random ID stored on your phone (not your hardware serial or advertising ID). We store only a one-way hash of it. It is used to enforce fair-use limits and attribute anonymous reports and confirmations.
- Daily activity records: a per-day record that a device was active (hashed device ID + date), used for streak bonuses and rate limits.
- Sign-in attempt records: hashed identifiers with timestamps, used only to throttle abusive login attempts.
- Approximate region: when the app opens, your phone contacts an IP geolocation service (your IP address only) to determine your approximate region and city. We store only the resulting region/city/country — your IP address itself is never stored.
- On your phone only: app preferences (language, theme), your last search, cached station lists, and at-the-pump visit timestamps are kept in your phone's local storage and never sent to us except as needed for the features above.
6. Support requests ("Report an issue")
If you report an issue in the app, we store your message, its category, and whether you were signed in (your account) or anonymous (your hashed device ID only — no email is collected from anonymous reporters). The app owner can read and reply; replies to signed-in users appear as an in-app notice. Support messages are visible only to you and the app owner.
Third-party services
| Service | What is sent | Why |
|---|---|---|
| OpenStreetMap (Nominatim / Overpass) | City names you search | Finding stations and street addresses |
| Government fuel-price feeds (France, Slovenia, Portugal, Mexico, Western Australia, Quebec) | City/area of your search | Official live prices where available |
| Germany's Tankerkönig feed | Our own server-side API key | Live German prices |
| OSRM public routing | Your coordinates (only when location is on) + station coordinates | Driving distances from your position |
| Frankfurter exchange-rate API | Currency codes only | Comparing prices across currencies |
| Google Gemini API (paid tier) | Scan/confirmation photos | Reading fuel prices from photos; images not stored |
| ipwho.is (IP geolocation) | Your IP address, sent directly from your phone | Approximate region/city; your IP is not stored by us |
We do not use advertising networks, analytics SDKs, or social-media trackers.
Data retention
| Data | How long we keep it |
|---|---|
| Price reports, confirmations, comments | Indefinitely — they are the app's shared price history |
| Account data (username, email, avatar) | Until you delete your account |
| Price-drop alerts | Until you delete them in the app or delete your account |
| Fuel log entries | Until you delete them in the app or delete your account |
| Trip estimator inputs | While Premium is active, or until you delete your account |
| Premium status and expiry | Kept with your account |
| Push notification tokens | Until you disable push alerts, sign out, or delete your account |
| Support messages | Until resolved and removed by the owner, or on your deletion request |
| Scan/confirmation photos | Not stored |
| Your location coordinates | Never stored |
| Sign-in sessions | Until you sign out |
Your rights
- See your data — your reports, comments, alerts, and account details are visible in the app; email us for a full copy.
- Correct it — update your username, email, avatar, and preferences in the app.
- Delete your account and data — use Preferences → Delete account in the app (two confirmations; cancellation available at either step). This permanently removes your profile, sessions, alerts, comments, confirmations, avatar, fuel log entries, push tokens, and support data; your price reports are kept only with account and device attribution cleared. Deleted credentials stop working immediately.
- Opt out of marketing — toggle it in Preferences or email us; we send no marketing emails today.
- Withdraw location permission — turn it off in your phone's system settings at any time; the app keeps working with reduced features.
We respond to privacy requests within 30 days.
Children
PumpSpy is not directed at children under 13, and we do not knowingly collect data from children under 13. If you believe a child has provided us data, email pumpspy.support@gmail.com and we will delete it.
Security
- Passwords: salted PBKDF2-SHA-256 hashes (210,000 iterations); plaintext passwords are never stored or logged.
- Sign-in tokens and device identifiers: stored only as one-way SHA-256 hashes.
- Account sessions are validated on every request; mismatched sessions are rejected.
- No system is perfectly secure — if we discover a breach affecting your data, we will notify you at your account email.
International users
PumpSpy works worldwide. [Hosting region to be confirmed — currently being finalized.] By using PumpSpy you understand your data may be stored and processed in the country where our servers operate.
Changes to this policy
If we change this policy materially, we will note it in the app and update the effective date above. Continued use after changes take effect means you accept the updated policy.
Contact
Questions about this policy or your data: pumpspy.support@gmail.com
For the developer (App Store Connect): no tracking, no data sold to third parties, no data used for advertising. Data collected is limited to app functionality: precise location, email, subscription status, photos, user ID, device ID, and support messages — none used for tracking.