Privacy policy

Pump Prices is made by Happy Path Apps. It is not affiliated with, endorsed by, or operated by Fuel Finder, the Department for Energy Security and Net Zero, or any government body.

Fuel prices

Every price comes from Fuel Finder, the UK government scheme. Our own server collects the prices from Fuel Finder and hands them to the app, because the scheme's credentials cannot safely be built into an app.

The app asks that server for prices by map square. The country is divided into a fixed grid of squares about 6 miles across. The app works out on the phone which square to ask about and sends the square's number, and whether it wants the squares next to it or the next two rows of them (the wider area is asked for when your distance filter is set wide). Everyone in the same square with the same setting sends the same request. The server never receives a position, an account, a device identifier or an advertising identifier. It has no database of users at all: it holds forecourts and prices and nothing else.

The server is run for us by Cloudflare. Like any web service, it sees the internet address (IP address) each request comes from. It uses that address in two ways:

• To limit how often one address can ask - 120 requests a minute - so that nobody can copy the whole dataset. The count is kept for that minute and not stored.
• In its request log. Cloudflare records each request to our server - when it was made, which map square was asked for, and technical details of the request, including the internet address it came from and the rough area Cloudflare takes that address to be in - so that we can see the service is working and notice a fault. Those records are deleted automatically after seven days. We do not use them to work out who anyone is or to build a history of anyone's movements.

Lawful basis: legitimate interests - providing the prices you asked for, and keeping the service working and protected from misuse.

Fuel Finder's data is used under the Open Government Licence v3.0:

Contains public sector information licensed under the Open Government Licence v3.0.

Your location

Location is optional. You can search for a postcode or a town instead and refuse the permission outright; every screen that offers "Use my location" also offers Search.

If you allow it:

• The app asks Android for your approximate location only. It never asks for your precise location, and Android blurs the position before the app receives it.
• It asks only while the app is open, never in the background.
• You are asked for permission only when you press something for it: "Use my location", "Allow location", or the Map's centre button.
• If "Use my location" was the last thing you chose, the app asks the phone again where it is each time you open the app, and when you come back to it after five minutes or more, so the prices are for where you are now. Choosing a place in Search stops this.
• If the phone cannot say where it is within a few seconds, the app uses the position Android itself last had, as long as that is less than 30 minutes old. It is approximate in the same way, and the app still stores nothing of where you are.

Your position is used on the phone: to choose which map square to ask our server about, to measure how far away each forecourt is, and to centre the map. It is not sent to us and not stored - not on the phone, and not on our server. The one thing the app remembers is the single word "phone" or "place": whether to follow the phone's location when it next opens, never where the phone was.

The name shown for where you are ("Cricklewood, NW2") is worked out on the phone from the nearest forecourt. Your position is not looked up anywhere to get it.

You can withdraw the permission at any time in Android's settings for the app.

Lawful basis: consent - you grant the permission, and the app works without it.

Searching for a place

As you type in Search, what you have typed is sent to postcodes.io, a free public postcode lookup run by Ideal Postcodes, so that it can suggest matching postcodes and places. It receives the text you typed and, as any web service does, your internet address. The app sends it nothing else: no location, no identifier, nothing about your phone. postcodes.io publishes no privacy policy of its own, so we cannot tell you how long it keeps a record of requests.

When you press the search button, the text is also given to your phone's own place lookup (Android's built-in geocoder), which is provided by the phone's maker - on most Android phones, Google.

Postcodes in Northern Ireland (beginning BT) are never sent to postcodes.io; the phone's own lookup is used for those.

Lawful basis: legitimate interests - finding the place you asked for.

Your recent places

The last five places you chose in Search are kept so you can pick them again. Each is its name and its position on the map. They are places you chose to look at, not places your phone has been. They are held only on your phone, are never sent to us, and are not backed up.

Clear recent places, under Privacy on the More screen, removes them. Uninstalling the app removes them too.

Forecourts you save

You can save up to 20 forecourts. For each, the app keeps the forecourt's reference number, its name and the map square it is in - only on your phone. They are never sent to us and not backed up.

To show their current prices, the app asks our server about the map squares those forecourts are in, in the same way as for prices near you. The server therefore sees which squares were asked about, but never which forecourts you saved.

Your fuel, tank size and filters

The fuel you last chose, the tank size you set (if any) and your filters are kept only on your phone, so the app opens as you left it. They are not backed up, and they are not sent anywhere - with one exception: a wide distance filter makes the app ask our server for a wider area, as described under Fuel prices.

The map

The Map screen uses Google Maps. To draw a map, Google has to be asked for the map of the area on the screen: the place you are looking around and, if you centre the map on your location, the area around you - exactly as when you move the map there by hand. The app does not send Google your position itself.

Google's map software also collects some information of its own. Google's published description lists: details of the device (operating system version, model, brand), your internet address, an identifier the map software creates for itself, records of crashes inside the map software, and how the map is moved (https://developers.google.com/maps/documentation/android-sdk/play-data-disclosure).

The app includes Google Maps features and content. Use of them is subject to the Google Maps End User Additional Terms of Service (https://maps.google.com/help/terms_maps/) and the Google Privacy Policy (https://policies.google.com/privacy).

Lawful basis: legitimate interests - showing you the map you opened.

Directions, calling a forecourt and other links

Some buttons hand you on to another app on your phone. The app passes on only what is needed, and what happens next is governed by that app's or site's own privacy notice.

• Directions opens Google Maps - the app if you have it, the website if not - with the forecourt's position as the destination. Your own position is not passed on by us; the maps app works out your route from wherever it finds you.
• Call opens your phone's dialler with the forecourt's number filled in. You place the call.
• Report a wrong price to Fuel Finder opens Fuel Finder's own page in your browser. We do not take reports ourselves, and nobody can submit or change a price in this app.
• Roadworthy opens our other app's page on Google Play.
• Contact us opens your email app.

Advertising

The app shows banner advertising supplied by Google AdMob. There are no full-screen advertisements.

Advertising is a separate purpose from showing prices, and you are asked about it separately. In the United Kingdom and Europe, the first time you open the app you are shown Google's consent form, before the advertising software is started. Whatever you answer, the app works in full: nobody is kept out for saying no. Ad choices, on the More screen, reopens the form so you can change your answer at any time.

• If you consent, Google may use your device's advertising identifier and similar identifiers to choose and measure ads, including ads based on your interests.
• If you do not consent, you still see ads, but they are not personalised. Google calls these "limited ads": it says they use no identifier kept on your device to choose them (https://support.google.com/admob/answer/10105530).
• If the form cannot be shown at all - no connection, say - and you have never answered it, the advertising software is not started and no ads are shown.
• If Google's software finds that no question is needed where your phone is - outside the United Kingdom and Europe, for example - no form is shown, and ads are shown as Google ordinarily shows them there.

Either way, once you have answered, Google's advertising software runs inside the app and receives what any advertising service must to deliver an ad. Google's published description lists: your internet address, which Google says may be used to estimate the general location of a device; identifiers, as above; how you interact with the app and its ads, such as launches and taps; and diagnostic information such as launch time (https://developers.google.com/admob/android/next-gen/privacy/play-data-disclosure). See Google's privacy policy for what it does with this.

We tell the advertising nothing about where you are or what you are looking at. No location, map square, searched place, price, forecourt or saved forecourt is passed to it or used to choose ads. This is enforced in the code, not merely as a policy: the advertising component cannot reach that part of the app, and an automated test fails the build if that separation is broken.

Lawful basis: consent for anything stored on or read from your device for advertising and for personalised ads; legitimate interests for showing non-personalised ads to pay for a free app.

Crash reports

We have added no crash-reporting or analytics software to the app. If you have chosen in your phone's settings to share usage and diagnostics with Google, Google Play may show us anonymous totals of crashes and their technical details; that sharing is between you and Google and is switched off in your phone's settings, not in this app.

The only crash records sent from inside the app are those Google's map software sends to Google about itself, described under The map. The advertising software's own crash reports are switched off.

Who receives what

• Cloudflare, which runs our server - Map square numbers; your internet address. To serve prices and keep the service working.
• postcodes.io (Ideal Postcodes) - What you type in Search; your internet address. Place suggestions.
• Your phone's place lookup (usually Google) - What you search for. Finding the place.
• Google (Maps) - The area of map on screen; device details; your internet address; a map identifier; map crashes. Drawing the map.
• Google (AdMob) - Your internet address; interaction and diagnostic data; and, only with your consent, the advertising identifier. Advertising.

We do not sell personal data, and we share none beyond what is listed here.

Cloudflare and Google operate worldwide, so information they handle may be processed outside the United Kingdom and the European Economic Area, under the safeguards described in their own privacy notices.

How long things are kept

• On your phone: until you remove them in the app, clear the app's data, or uninstall.
• Our server's request log: seven days, then deleted automatically.
• Our server's database: holds no information about you at all.
• Data held by Google or postcodes.io: for as long as their own policies say.

Your rights

Pump Prices is available in the United Kingdom and Ireland. In the UK, UK GDPR gives you rights of access, correction, erasure, restriction and objection. In Ireland, the EU General Data Protection Regulation gives you the same rights.

If you are unhappy with how your data is handled, you can complain to the data protection regulator: the Information Commissioner's Office in the UK (https://ico.org.uk/make-a-complaint/) or the Data Protection Commission in Ireland (https://www.dataprotection.ie/en/individuals/exercising-your-rights/raising-concern-commission). We would welcome the chance to put it right first, so please contact us too.

We hold no account and no profile of you, so most of these are exercised directly on your phone: remove saved forecourts, clear your recent places, withdraw the location permission in Android's settings, withdraw advertising consent through Ad choices, or uninstall.

The only record we hold anywhere else is the seven-day request log described under Fuel prices. It holds no name and no account; the internet address is the only thing in it that could relate to you, so we generally cannot connect an entry to a person in order to answer a request about it - but if you believe an entry relates to you, contact us and we will help where we can.

For data held by Google or by postcodes.io, contact them directly - they are responsible for their own records.

Children

Pump Prices is not directed at children and should not be used by anyone under 13.

Changes to this policy

If the data flows change, this page changes with them and the date above is updated.

Contact

Happy Path Apps
happypathapps@gmail.com