Privacy Policy

Version: 25 September 2026.

1. Who we are

WhereFUEL is a map of fuel and charging stations where drivers tell each other where fuel is available right now. WhereFUEL is an independent project. The controller of your personal data is the operator of WhereFUEL ("we", "us"). You can contact us about privacy at support@wherefuel.com.

2. What data we process and why

2.1 Using the map without an account

• Map area and location. To show stations near you, the app sends to our servers the part of the map you are looking at or, if you let it use your location, your position — in both cases rounded to about 5 km. To show the name of your city, it sends your position rounded to about 1 km. Your device's precise location is used only if you allow it in your browser or device settings. We do not store your location on our servers; your last position is kept only on your device, so that the map opens where you left it.
• Device identifier. The app creates a random identifier and stores it in your browser. It is sent only with your reports, and we use it only to protect the service from abuse (for example, a flood of fake reports). We do not store it in our database, and it does not contain your name or contact details.
• Settings on your device. Theme, map type, units, language, fuel type, favourite stations, recent searches and destinations, the list of your own reports and similar settings are stored in your browser's local storage. They stay on your device until you clear them.
• Technical data. When you use the service, our servers receive your IP address, the type of browser and device, the page or data requested (without search terms or coordinates) and the time. We keep these server logs for 14 days for security and troubleshooting.

2.2 Reports

When you report a station (fuel available, queue, low or no fuel, which grades and, for charging and LPG stations, an optional short note), we store the report together with the station, the time and a keyed hash of your IP address, and your account if you are logged in. We use the hash only to detect abuse and delete it after 30 days. Reports are public: other users see the status, the grades, the note and the time and, if you were logged in, your display name and profile appearance. The status is shown on the map for 24 hours, and reports are listed at the station for 7 days. After 30 days we remove the note and any link to your account; after 12 months we delete the report.

2.3 Account (optional)

Logging in is optional: every map feature works without an account. Where login is offered, you can log in with Telegram, Google or Apple. From Telegram we receive your account identifier, your name and your username; from Google or Apple, a unique account identifier and your display name. We do not request your email address, and we never receive your password or your contacts. We keep your account data until you delete your account in the app.

2.4 Prices

Fuel prices come from official open data or from data that fuel retailers are required to publish (for example, prix-carburants in France, the Geoportal de Gasolineras in Spain, E-Control in Austria, MIMIT in Italy, the fuel price scheme of the UK Competition and Markets Authority, CRE in Mexico, DGEG in Portugal, the Ministry of Economy in Croatia, goriva.si in Slovenia and FuelWatch in Western Australia). These data describe stations and their prices.

2.5 Complaints

If you use "Report abuse" on a driver's report, we store the complaint together with the station, the report concerned, the time and a keyed hash of your IP address, which we delete after 30 days. We use complaints to review content and delete them after 12 months. If you write to us, we use your message and your email address only to handle your request.

2.6 Cookies and similar technologies

We use cookies only if you log in, and only strictly necessary ones:

• wf_sess — keeps you logged in (180 days from login, or until you log out);
• wf_oauth — protects the login with Google or Apple from forgery (deleted after the login, at most 10 minutes).

We also use your browser's local storage for the settings described above and a service worker cache, so that the map opens faster and works without a connection. We do not use advertising, analytics or tracking cookies, and we do not use an analytics service.

3. Legal bases (GDPR and UK GDPR)

• Providing the map, reports and accounts: performance of our agreement with you (Article 6(1)(b)) and our legitimate interest in running a useful service (Article 6(1)(f)).
• Security, abuse prevention, complaints and server logs: our legitimate interest in keeping the service safe (Article 6(1)(f)).
• Location from your device: you decide in your browser or device settings and can withdraw permission at any time.
• Compliance with legal obligations (Article 6(1)(c)).

4. Who receives data

• Hosting: Timeweb Cloud, servers in Amsterdam, the Netherlands.
• Map services loaded by your browser: map tiles from OpenFreeMap (delivered through Cloudflare) and, in 2D mode, from the OpenStreetMap Foundation's tile server, with Esri as a fallback; the map library from jsDelivr. These services receive your IP address and the part of the map you view.
• Place search on the map: our server sends your search text to Photon by komoot; Photon does not receive your IP address.
• Navigator — only when you use it: your browser sends what you type in the navigator's search, your current position and the points of your route directly to open routing and search services: Photon by komoot, OpenStreetMap Nominatim, OSRM and, for walking routes and routes that avoid tolls, FOSSGIS Valhalla. These services receive your IP address.
• City name: if our server cannot name your city, your browser asks OpenStreetMap Nominatim, sending your position rounded to about 1 km.
• Brand logos are served from our servers (copies of files from Wikimedia Commons).
• Login providers — only if you choose them: Telegram, Google, Apple. Their own privacy policies apply.
• Navigation and sharing apps — only when you tap: the map app you choose (Google Maps, Apple Maps, Waze and, depending on the country, Naver Map, KakaoMap, Amap, Baidu Maps or Mapy.com) receives the coordinates and the name of the station; WhatsApp, Telegram, Facebook, Viber or Instagram receive the link you share.
• Authorities — only when we are legally required to disclose data.

We do not sell personal data and do not use it for advertising.

5. Where data are processed

Our servers are located in the Netherlands (EU). The independent services listed in section 4 may process data in other countries, including outside the EEA and the UK, under their own terms.

6. How long we keep data

• Server logs: 14 days.
• Hashes of IP addresses (in reports and complaints): 30 days.
• Reports: the status is shown on the map for 24 hours and reports are listed at the station for 7 days; after 30 days they are kept without note and account link; after 12 months they are deleted.
• Complaints: 12 months.
• Emails to support@wherefuel.com: as long as needed to handle your request.
• Account: until you delete it. Your profile and sessions are erased immediately, and backup copies are overwritten within 14 days. Your earlier reports remain without your name.
• Login sessions: up to 180 days.
• Settings on your device: until you clear them.

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability and to withdraw consent. You can also lodge a complaint with a supervisory authority — in the EU and the EEA the authority of your country, in the UK the Information Commissioner's Office. Write to support@wherefuel.com; we reply within one month.

• California (CCPA/CPRA): we do not sell or share personal information. You may request to know, correct or delete your personal information; we will not discriminate against you for using these rights.
• Brazil (LGPD): you have the rights listed in Article 18 of the LGPD. You can reach us about data protection at support@wherefuel.com.
• Turkey (KVKK): the data controller is the operator of WhereFUEL; you have the rights listed in Article 11 of the KVKK.

8. Children

WhereFUEL is not intended for children under 16. Accounts may be created only by people aged 16 or older, or older if the law of their country requires it.

9. Security

Connections are encrypted (HTTPS). Access to data is limited to the people who need it. We do not store passwords: you log in through Telegram, Google or Apple.

10. Changes to this policy

We will update this page and its date when our processing changes. We will announce significant changes in the app.

11. Contact

WhereFUEL, support@wherefuel.com.