Privacy Policy

Version: 15 October 2026.

1. Who we are

WhereFUEL is a free map of fuel and charging stations: where stations are, when they are open, what they offer and, where fuel prices are published officially, how much fuel costs. WhereFUEL is an independent project. The controller of your personal data is the operator of WhereFUEL ("we", "us"). You can contact us about privacy at support@wherefuel.com.

2. What data we process and why

2.1 Using the map without an account

• Map area and location. To show stations near you, the app sends to our servers the part of the map you are looking at or, if you let it use your location, your position — in both cases rounded to about 5 km. To show the name of your city, it sends your position rounded to about 1 km. Your device's precise location is used only if you allow it in your browser or device settings. We do not store your location on our servers; your last position is kept only on your device, so that the map opens where you left it.
• Device identifier. The app creates a random identifier and stores it in your browser. It is sent only with your reports, and we use it only to protect the service from abuse (for example, a flood of fake reports). We do not store it in our database, and it does not contain your name or contact details.
• Settings on your device. Theme, map type, units, language, fuel type, favourite stations, recent searches and destinations, the list of your own reports and similar settings are stored in your browser's local storage. They stay on your device until you clear them.
• Technical data. When you use the service, our servers receive your IP address, the type of browser and device, the page or data requested (without search terms or coordinates) and the time. We keep these server logs for 14 days for security and troubleshooting.

2.2 Reports

When you report a station (fuel available, queue, low or no fuel, which grades and, for charging stations, an optional short note), we store the report together with the station, the time and a keyed hash of your IP address, and your account if you are logged in. We use the hash only to detect abuse and delete it after 30 days. Reports are public: other users see the status, the grades, the note and the time and, if you were logged in, your display name and profile appearance. The status is shown on the map for 24 hours, and reports are listed at the station for 7 days. After 30 days we remove the note and any link to your account; after 12 months we delete the report.

2.3 Account (optional)

Logging in is optional: every map feature works without an account. Where login is offered, you can log in with Telegram, Google or Apple. From Telegram we receive your account identifier, your name and your username; from Google or Apple, a unique account identifier and your display name. We do not request your email address, and we never receive your password or your contacts. We keep your account data until you delete your account in the app.

2.4 Prices

Fuel prices come from official open data or from data that fuel retailers are required to publish (for example, prix-carburants in France, the Geoportal de Gasolineras in Spain, E-Control in Austria, MIMIT in Italy, the fuel price scheme of the UK Competition and Markets Authority, CRE in Mexico, DGEG in Portugal, the Ministry of Economy in Croatia, goriva.si in Slovenia and FuelWatch in Western Australia). These data describe stations and their prices.

2.5 Complaints

If you use "Report abuse" on a driver's report, we store the complaint together with the station, the report concerned, the time and a keyed hash of your IP address, which we delete after 30 days. We use complaints to review content and delete them after 12 months. If you write to us, we use your message and your email address only to handle your request.

If you use "Report a problem" on a station card and choose what is wrong (wrong price, station not working, no station here), we store your choice as a complaint in the same way.

2.6 Cookies and similar technologies

Without your consent, cookies are set only if you log in, and only strictly necessary ones:

• wf_sess — keeps you logged in (180 days from login, or until you log out);
• wf_oauth — protects the login with Google or Apple from forgery (deleted after the login, at most 10 minutes).

We also use your browser's local storage for the settings described above and a service worker cache, so that the map opens faster and works without a connection. We do not use advertising cookies. Usage statistics (Yandex Metrica and Google Analytics, see 2.7) are collected only if you allow them; until then no statistics cookies are set and no data is sent to Yandex or Google.

2.7 Usage statistics (only with your consent)

If you choose "Allow" in the "Usage statistics" message, your browser loads Yandex Metrica, a web analytics service of YANDEX LLC (Russia). It records the pages you open, clicks, time on the site, your browser, device and screen, the page you came from and your approximate region based on your IP address. We have set it not to store full IP addresses, and we do not use session recording (Webvisor). Yandex Metrica sets its own cookies (_ym_uid, _ym_d and similar) for up to 1 year. We use only aggregated reports to improve the site. If you choose "Decline" or make no choice, Yandex Metrica is not loaded and nothing is sent to it. You can change your choice at any time in Profile → Settings → "Usage statistics".

With the same consent, your browser also loads Google Analytics 4, a web analytics service provided by Google Ireland Limited (Ireland) to users in the EEA and the UK and by Google LLC (USA) to everyone else. It records the pages you open, clicks, scrolling and links to other sites that you follow, time on the site, your browser, device and screen, the page you came from and your approximate region. Google Analytics 4 does not log or store IP addresses. We have turned off Google signals, ad personalisation and advertising features, so the data are not used for advertising. Google Analytics sets its own cookies (_ga and _ga_*) for up to 2 years, and we keep Google Analytics data for up to 14 months. If you choose "Decline" or make no choice, Google Analytics is not loaded and nothing is sent to Google. You can change your choice at any time in Profile → Settings → "Usage statistics"; if you decline or withdraw your consent, these cookies are deleted too.

3. Legal bases (GDPR and UK GDPR)

• Providing the map, reports and accounts: performance of our agreement with you (Article 6(1)(b)) and our legitimate interest in running a useful service (Article 6(1)(f)).
• Security, abuse prevention, complaints and server logs: our legitimate interest in keeping the service safe (Article 6(1)(f)).
• Location from your device: you decide in your browser or device settings and can withdraw permission at any time.
• Compliance with legal obligations (Article 6(1)(c)).
• Usage statistics (Yandex Metrica, Google Analytics): your consent (Article 6(1)(a)), which you can withdraw at any time in the settings.

4. Who receives data

• Hosting: Timeweb Cloud, servers in Amsterdam, the Netherlands.
• Map services loaded by your browser: map tiles from OpenFreeMap (delivered through Cloudflare) and, in 2D mode, from the OpenStreetMap Foundation's tile server, with Esri as a fallback; the map library from jsDelivr. These services receive your IP address and the part of the map you view.
• Place search on the map: our server sends your search text to Photon by komoot; Photon does not receive your IP address.
• Navigator — only when you use it: your browser sends what you type in the navigator's search, your current position and the points of your route directly to open routing and search services: Photon by komoot, OpenStreetMap Nominatim, OSRM and, for walking routes and routes that avoid tolls, FOSSGIS Valhalla. These services receive your IP address.
• City name: if our server cannot name your city, your browser asks OpenStreetMap Nominatim, sending your position rounded to about 1 km.
• Brand logos are served from our servers (copies of files from Wikimedia Commons).
• Login providers — only if you choose them: Telegram, Google, Apple. Their own privacy policies apply.
• Navigation and sharing apps — only when you tap: the map app you choose (Google Maps, Apple Maps, Waze and, depending on the country, Naver Map, KakaoMap, Amap, Baidu Maps or Mapy.com) receives the coordinates and the name of the station; WhatsApp, Telegram, Facebook, Viber or Instagram receive the link you share.
• Usage statistics — only with your consent: Yandex Metrica (YANDEX LLC, Russia) and Google Analytics (Google Ireland Limited, Ireland, and Google LLC, USA) receive the data described in 2.7.
• Authorities — only when we are legally required to disclose data.

We do not sell personal data and do not use it for advertising.

5. Where data are processed

Our servers are located in the Netherlands (EU). The independent services listed in section 4 may process data in other countries, including outside the EEA and the UK, under their own terms. Yandex Metrica processes data in Russia, which does not provide a level of data protection equivalent to that of the EU; we transfer data there only on the basis of your explicit consent (Article 49(1)(a) GDPR). Google may process data in the USA; these transfers rely on the EU–US Data Privacy Framework, under which Google LLC is certified, and on Standard Contractual Clauses.

6. How long we keep data

• Server logs: 14 days.
• Hashes of IP addresses (in reports and complaints): 30 days.
• Reports: the status is shown on the map for 24 hours and reports are listed at the station for 7 days; after 30 days they are kept without note and account link; after 12 months they are deleted.
• Complaints: 12 months.
• Emails to support@wherefuel.com: as long as needed to handle your request.
• Account: until you delete it. Your profile and sessions are erased immediately, and backup copies are overwritten within 14 days. Your earlier reports remain without your name.
• Login sessions: up to 180 days.
• Settings on your device: until you clear them.
• Yandex Metrica cookies: up to 1 year; Yandex keeps the statistics under its own terms.
• Google Analytics cookies (_ga, _ga_*): up to 2 years; Google Analytics data: up to 14 months.

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability and to withdraw consent. You can also lodge a complaint with a supervisory authority — in the EU and the EEA the authority of your country, in the UK the Information Commissioner's Office. Write to support@wherefuel.com; we reply within one month.

• California (CCPA/CPRA): we do not sell or share personal information. You may request to know, correct or delete your personal information; we will not discriminate against you for using these rights.
• Brazil (LGPD): you have the rights listed in Article 18 of the LGPD. You can reach us about data protection at support@wherefuel.com.
• Turkey (KVKK): the data controller is the operator of WhereFUEL; you have the rights listed in Article 11 of the KVKK.

8. Children

WhereFUEL is not intended for children under 16. Accounts may be created only by people aged 16 or older, or older if the law of their country requires it.

9. Security

Connections are encrypted (HTTPS). Access to data is limited to the people who need it. We do not store passwords: you log in through Telegram, Google or Apple.

10. Changes to this policy

We will update this page and its date when our processing changes. We will announce significant changes in the app.

11. Contact

WhereFUEL, support@wherefuel.com.