Fuel Savvii privacy policy

If you allow it, the app uses your phone's location to centre the map, sort stations by distance and work out whether a cheaper station is worth the drive. These calculations happen on your phone.

To load prices, the app asks our server for the stations in the map squares around you (about 20 × 20 km each). Your precise position isn't sent (except when you plan a route, below). The home-screen widget, if you add it, saves your last known location on your phone so it can refresh prices in the background. It doesn't track your location in the background. On Android Auto, the app uses your phone's location the same way: only the map squares around you are sent.

You can say no to location access, and the app still works: the map starts on Adelaide and you can move it yourself.

Your chosen fuel type, your cars (their names, fuel and fill-up settings), favourite stations, brand discounts, the fill-ups you log in the savings tracker (station, date, litres and price), recently loaded prices (so the app opens quickly) and a few housekeeping flags (such as whether you've seen "what's new"). This stays on your phone and is deleted when you uninstall the app or clear its data.

Price requests go to our server on Amazon Web Services in Sydney, Australia, over an encrypted connection. They contain the map squares and fuel type described above. To be allowed to read prices, the app gets a random, anonymous ID and short-lived access keys from Amazon Cognito (AWS's sign-in service) the first time it runs. The ID is stored on your phone and is used only to authorise these requests: it isn't linked to your name, email address or advertising ID. Your phone forgets it when you uninstall the app or clear its data (Cognito keeps the bare ID, with nothing attached to it). Like any web service, the server's infrastructure may briefly log technical details (such as the time and the IP address of a request) for security and troubleshooting.

Price alerts send you a notification when a station you chose drops under your price, when prices jump across Adelaide but some stations near you haven't gone up yet, or when a station near you is well below the others. They're off unless you turn them on, and the app doesn't contact Firebase until you do.

To send them, our server keeps, under the same anonymous ID described above:

• a push token from Google's Firebase Cloud Messaging, which lets our server address a notification to this copy of the app (Firebase also creates its own installation ID for this);
• your fuel type;
• your rough area: up to nine of the same ~20 × 20 km map squares, worked out on your phone from your location and the stations you set alerts on, and, for price gap alerts, the ~5 × 5 km square you're in, to judge what's "near you". Never your GPS position;
• the stations you set alerts on (their ID numbers) and your price for each, whether you want price-jump and price-gap alerts, the brands you've hidden in the app (so alerts don't suggest them), and your quiet hours;
• what we last sent you, so you aren't sent the same alert twice.

The notifications themselves are delivered by Google (Firebase Cloud Messaging). Turning alerts off deletes all of this from our server and deletes the push token. If you uninstall the app without turning them off, the push token stops working, and our server deletes everything above the next time it tries to send you an alert. Google's privacy policy for Firebase: https://firebase.google.com/support/privacy.

When you plan a route, the app sends our server your starting point (your current position, or a place you saved) and the destination you pick, and, while you type, what you've typed with your position rounded to about 1 km. Our server passes these to Google (the Places and Routes APIs) to suggest places and plan the route, and sends the route back. We use them for that request only and don't store them. Google's privacy policy covers what Google receives: https://policies.google.com/privacy. To keep the cost in check, our server counts how many searches and routes each installation makes in a day (only the counts, under the anonymous ID described above, deleted after two days).

Places and routes you save ("Work", "Commute") are kept only on your phone: the name you give them and Google's identifier for the place.

Premium is a subscription sold through Google Play. Google handles the payment: we never see your name, card or billing details. When you subscribe, and from time to time after that, the app sends our server the purchase token Google Play gave it. Our server asks Google whether the subscription is active and keeps, under the same anonymous ID described above: the purchase token, the subscription's status (for example active, cancelled or expired), when it ends, and whether it's a test purchase. Google also tells our server when a subscription renews, is cancelled or is refunded. We use this only to switch on the Premium features that run on our server (route planning and price alerts), for up to five installations per subscription. Cancel any time in Google Play (Payments & subscriptions → Subscriptions); Premium lasts until the end of the period you've paid for.

The app shows ads from Google AdMob. The Google Mobile Ads SDK collects information such as your IP address, your device's advertising ID, other device identifiers, and how you interact with ads and the app. It may use this to show ads, measure them, prevent fraud and for analytics, and Google may share it with advertising partners.

You can reset your advertising ID or opt out of personalised ads in your phone's settings (Settings → Google → Ads, or Settings → Security & privacy → Privacy → Ads, depending on your phone). Google explains how it uses this information at policies.google.com/technologies/partner-sites.

The map is provided by Google Maps. The Maps SDK sends Google technical information such as your IP address, device and app details, crash data and a unique SDK identifier, and may record map interactions. See Google's privacy policy: policies.google.com/privacy.

When something goes wrong, the app sends an error report to Sentry (sentry.io). Reports include technical details (the error, device model, operating system and app version) and an installation ID, not your IP address. To help us reproduce problems, a report can come with a session replay: the app keeps the last half minute or so of what was on screen in your phone's memory, and sends it only if an error happens. Replays show which screens you visited and what you tapped, with all text and images masked. Error reports are used only to fix bugs, and Sentry keeps them for a limited time (up to 90 days). See Sentry's privacy policy: sentry.io/privacy.

"Directions" opens Google Maps (or your browser) to search for the station by name, and "Report a wrong price" opens the SA Government's complaint form in your browser. What you do there is covered by those services' own privacy policies.

The app may ask whether you'd like to rate it, using Google Play's in-app review. Fuel Savvii doesn't see who rated it or how, unless you post a public review on Google Play.