Privacy Policy
At a glance
- No ads, no tracking, no analytics. We never sell your data.
- Without an account, everything you log stays on your phone. Only a few look-ups go online (the vehicle catalogue, station logos, nearby stations if you ask for them).
- With Aricota Plus, your account and your log are stored on our backend in Ireland (EU). Our providers are US companies, so the usual EU safeguards apply.
- Payments are handled by Apple or Google. We never see your card.
- You can delete your account at any time, in the app or on aricota.app/delete-account. Everything goes at once.
1. Who is responsible
Aricota is made by [full name], [postal address], Germany ("we", "us"). We are the controller for the personal data described here.
Questions about privacy, or a request about your data: aricota.app@gmail.com. Legal notice: Impressum.
We have not appointed a data protection officer; the law does not require one for a service of this size.
2. Using Aricota without an account
Aricota works fully without an account. Your vehicles, fill-ups, expenses, reminders and photos are stored only on your phone. We have no copy and cannot see them. Reminder notifications are scheduled on the phone itself.
Your phone's own backup (iCloud Backup on iPhone, Google's Android backup) may include Aricota's data. Those backups belong to your Apple or Google account and are covered by their terms, not by us.
A few features need the internet even without an account:
- Vehicle catalogue and station logos. When you pick your car (make, model, or German HSN/TSN codes) and when the app refreshes fuel-station logos, it asks our backend. The request contains what you searched for and, like any internet request, your IP address. It is not linked to you or to an account, and we do not keep the search.
- Nearby stations (only if you use it and allow location access). To suggest the station you are at, your phone sends your current location to Apple Maps (iPhone) or the Google Places service (Android), which return stations nearby. Apple or Google process that request under their own privacy policies; we do not receive your location. The station you pick (its name, town and position) is saved with the fill-up, on your phone.
- Station map (Android). The map of your stations is drawn by Google Maps, which receives your IP address, device information and what you do on the map.
- Aricota Plus prices. The Aricota Plus page reads the current prices from the App Store or Google Play.
3. Aricota Plus: your account and subscription
Aricota Plus is a paid subscription. It needs an account so your log can be kept safe and appear on all your devices.
Your account
You sign up with Apple, with Google, or with an email address and password. Accounts are run by Firebase Authentication, a Google service, on our behalf. It stores:
- a user ID, your email address, how you sign in, and the times you signed up and last signed in;
- for email sign-up: your password, only in a protected (hashed) form;
- for Google sign-in: your Google name and profile picture address, as Google shares them;
- for Sign in with Apple: your name if you share it, and your email or the private relay address Apple creates if you choose "Hide My Email";
- for security, the IP address and device type used to sign in. Google keeps these for a few weeks.
If you sign up with an email address, we send one email to confirm it, and password-reset emails when you ask for them.
Your subscription
You buy Aricota Plus through the App Store (Apple) or Google Play (Google). They handle the payment and your billing details; we never see your card or bank details. We use RevenueCat to check, on our behalf, which subscription your account has. RevenueCat receives the store's purchase records (product, dates, status, country and currency, a store transaction ID) together with your user ID, plus the device type and system version. Our backend then stores your subscription status, the store and when the current period ends.
Your log in your account
With Aricota Plus, your vehicles, fill-ups, expenses, reminders and photos are kept in your account on our backend, so they are safe and appear on every device you sign in to. If you start Aricota Plus on a phone that already has your log, the app moves that log into your account.
Our backend is run by Convex on Amazon Web Services servers in Ireland (EU).
Reminders on all your devices
For members, reminders are sent from our backend to every device where you turned them on, using Firebase Cloud Messaging (Google) and, on iPhone, Apple's push service. For this we store, per device: a push token, the device's name and type, its language and time zone, the app version, and whether reminders are on. The notification text never contains payment details.
4. Permissions
- Location (only "while using the app"): to find stations near you when you log a fill-up. Optional. Without it you type the station or pick a recent one.
- Camera and photos: for a picture of your car or a receipt. Optional. Photos stay on your phone, or in your account with Aricota Plus. Please keep in mind that photos can show other people or number plates.
- Notifications: for reminders (service, inspection, insurance and so on). Optional.
You can change each permission at any time in your phone's settings. Turning one off stops the feature; everything else keeps working.
5. Overview: what, why, legal basis, how long
The legal bases are those of the EU General Data Protection Regulation (GDPR), Art. 6(1): (a) consent, (b) to provide the service you asked for, (c) a legal obligation, (f) our legitimate interests.
| What | Data | Legal basis | Who receives it | How long |
|---|---|---|---|---|
| Your log without an account | Everything you enter | No processing by us (stays on your phone) | Nobody | Until you delete it or the app |
| Vehicle catalogue, station logos | Search, IP address, time, app version | (b); operating logs (f): running the service securely | Convex (processor), AWS Ireland | Your searches are not kept. Our backend provider keeps short technical logs (time, which function was called) for a few days |
| Nearby stations | Precise location, search | (a) your permission, which you can withdraw in the phone's settings | Apple (iPhone) or Google (Android), each under its own privacy policy | Not stored by us |
| Station map (Android) | IP address, device information, map use | (f): showing your stations on a map | Google, under its own privacy policy | Not stored by us |
| Account | User ID, email, name, sign-in method, password hash, sign-in times; IP address and device for security | (b); security (f): preventing abuse of accounts | Google Firebase (processor); Apple or Google as sign-in providers | Until you delete the account; security logs a few weeks |
| Subscription | Store purchase records, user ID, status, period end, device type | (b); subscription statistics (f): understanding renewals and cancellations | Apple or Google (payment, independent); RevenueCat and Convex (processors) | Until you delete the account; Apple and Google keep their own purchase records |
| Your log in your account | Vehicles, fill-ups, expenses, reminders, photos | (b) while you subscribe; afterwards (f): keeping your log for 12 months so you can come back without losing it | Convex (processor), AWS Ireland | While you subscribe, then 12 months (see section 7) |
| Reminders across devices | Push token, device name and type, language, time zone, app version | (b) once you turn reminders on | Google Firebase Cloud Messaging (processor); Apple's push service on iPhone; Convex (processor) | Until you turn reminders off, sign out the device or delete the account |
| Account deletion on the web | Sign-in, IP address, browser | (c) and Art. 17: carrying out your request | Google Firebase, Convex | Only while the request runs |
| Your emails to us | Your address, your message | (b) or (f): answering you | Our email provider, Google (Gmail) | Up to 12 months after the conversation ends |
6. Service providers and transfers outside the EU
We use these providers. Those marked "processor" work only on our instructions, under a data processing agreement (Art. 28 GDPR).
- Convex, Inc. (USA), processor: our backend. Data is stored in the Amazon Web Services region in Ireland. Because Convex is a US company, staff there can access it for support and operations; this is covered by the EU Standard Contractual Clauses. Privacy
- Amazon Web Services, on behalf of Convex: hosting in Ireland. Certified under the EU-US Data Privacy Framework.
- Google (Google Ireland Ltd and Google LLC, USA), processor for Firebase Authentication and Firebase Cloud Messaging. Firebase Authentication data is processed in the USA. Google LLC is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses apply in addition. Firebase privacy
- RevenueCat, Inc. (USA), processor: subscription status. Data is processed in the USA under the EU Standard Contractual Clauses. Privacy
- Apple (Apple Distribution International Ltd, Ireland), on its own responsibility: App Store purchases, Sign in with Apple, Apple Maps (nearby stations on iPhone), push notifications. Apple Privacy Policy
- Google (Google Ireland Ltd), on its own responsibility: Google Play purchases, Sign in with Google, and on Android the Google Places service (nearby stations) and Google Maps. Google Privacy Policy. Aricota's map and nearby search on Android use Google Maps features and content; their use is subject to the Google Maps Additional Terms of Service and the Google Privacy Policy.
You can ask us for a copy of the Standard Contractual Clauses, or find them in the EU's official text (Commission Decision 2021/914). The Data Privacy Framework is the EU's adequacy decision 2023/1795.
7. How long we keep your data, and deleting it
- Delete your account in the app (Settings → Delete account) or on aricota.app/delete-account. We delete your account, your log, your photos, your devices, your RevenueCat record and your sign-in immediately. If you used Sign in with Apple, we also revoke Aricota's access to your Apple Account. Our providers remove remaining copies from their backups on their own schedule (Google: within 180 days).
- Deleting your account does not cancel your subscription. Apple or Google keep charging until you cancel it in your App Store or Google Play settings. Please cancel first.
- When your subscription ends, we keep your account and log for 12 months, so that you can subscribe again and find everything as you left it, or take one car back to the free version. After 12 months we delete everything, as described above. You can delete earlier at any time, and export your log first (Settings → Export as CSV).
- Apple and Google keep their own records of your purchases under their own policies, for example for tax reasons.
8. Your rights
You have the right to access your data (Art. 15 GDPR), to correct it (Art. 16), to have it deleted (Art. 17), to restrict its processing (Art. 18), and to receive it in a portable format (Art. 20; Settings → Export as CSV gives you your log at any time). Where we rely on your consent, you can withdraw it at any time, for example by turning off location access; this does not affect what happened before.
Write to aricota.app@gmail.com. It's free, and we answer within one month.
Your right to object (Art. 21 GDPR)
Where we process your data based on our legitimate interests (Art. 6(1)(f)), you can object at any time, for reasons arising from your particular situation. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims.
You can also complain to a data protection supervisory authority, in particular in the EU country where you live or work. The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, datenschutzzentrum.de.
9. No automated decisions
We do not make decisions about you based solely on automated processing, and we do not build profiles.
10. What you have to provide
Nothing, to use Aricota without an account. For Aricota Plus you need an account (Apple, Google, or an email address) and a store purchase; without them we cannot provide the subscription. Location, camera, photos and notifications are always optional.
11. Security
All connections between the app, our backend and our providers are encrypted (TLS). Our providers encrypt stored data. Only we can access the backend and our providers' consoles. If a breach ever puts your data at risk, we will inform you and the supervisory authority as the law requires.
12. Children
Aricota is not directed at children. To create an account, or to allow location access, you must be at least 16 years old, or the age of digital consent in your country. If we learn that we hold a child's data without the required consent, we delete it.
13. Changes
When we change this policy, we publish the new version here with its date. If a change affects you materially, we tell you in the app before it takes effect.