CZ EN
Privacy Policy

Privacy Policy

This policy explains how the current version of FuelLog handles user data.

Data stored by the app

FuelLog is a vehicle logbook app. It may store locally on the user's device:

  • vehicle data such as vehicle name, fuel type, odometer value, inspection dates, motorway vignette dates and service intervals;
  • fill-up records, including date, fuel amount, price, currency and odometer value;
  • costs, service records, notes, statistics and maintenance history;
  • photos of receipts, odometers, fuel prices or service documents;
  • app settings, active vehicle, entitlement cache, Cloud Backup state and user-created local backups.

Most app content is stored locally on the user's device by default.

Photos and OCR

The app may use the camera to take photos of receipts, odometers or fuel price boards. Photos are stored in the app's internal storage.

Text recognition from photos is processed locally on the device using Google ML Kit. In the current version, receipt, odometer and fuel price photos are not uploaded to the FuelLog backend for OCR.

Voice input

The app may use the microphone for optional voice entry of fuel or expense data. Speech recognition is provided by the phone's system service. Depending on the device and settings, the system speech provider may use online processing.

FuelLog does not store audio and does not send audio to its own backend. Only text or values confirmed by the user are stored in the form.

Google sign-in and backend

Google sign-in is optional. If the user signs in with Google, the app sends a Google ID token to the FuelLog backend to verify the account and manage account features.

The backend may process:

  • email address and name from the Google account, if returned during sign-in;
  • random device identifier, backend access token and user access token;
  • information about your plan, subscription, entitlements and account deletion status;
  • a list of your cars — car name and an internal identifier — and which cars are active on the Free plan. It is used to apply the car limit; fill-ups, expenses and service records are not stored in this list;
  • shared car data, if you use sharing (see Shared cars);
  • your encrypted Cloud Backup and its metadata, if you turn it on;
  • feedback you send from the app.

The backend is used for device registration, Google sign-in, entitlement and subscription checks, the car list for the Free limit, shared cars, Cloud Backup, feedback, account status and account deletion requests.

Backups, Cloud Backup and exports

The app allows the user to create a portable ZIP backup. This manual backup may contain local app database data and photos stored by the app. The user chooses where to save or share the backup.

Cloud Backup is an optional PRO feature available after Google sign-in. It stores database history on the FuelLog backend, such as vehicles, fill-ups, expenses, service records, inspections and motorway vignette records. In the current version, Cloud Backup does not upload physical receipt, odometer, fuel price or attachment photos.

The backup is encrypted on the device before it is sent (AES-256-GCM) using a key stored exclusively via Google Blockstore. The FuelLog backend only stores the encrypted data and has no access to the encryption key. Restoring a backup reliably works today on the same device that created it; restoring on a brand-new device after signing in with the same Google account is not yet guaranteed in every case.

If your PRO subscription ends, no new backups are created. You can still download and restore your existing Cloud Backup for 30 days. From day 31 the backup is locked, and 90 days after PRO ended we permanently delete it. The app shows the exact restore and deletion dates in the Backup section. If you renew PRO before the backup is deleted, it becomes fully available again. You can also delete the backup yourself in the app at any time.

If Android backup is turned on, Google's system backup may include the app's database and settings. Photos from the app, sign-in credentials and the Cloud Backup key are not included. A direct transfer from your old phone to a new one may also transfer photos.

PDF, CSV and other exports may contain sensitive information, costs, service history or photos. The user is responsible for how exported files are handled.

Shared cars

If you share a car or accept an invitation to a shared car, the FuelLog backend stores the car's details and records (fill-ups, expenses, service, inspection, motorway vignette), the names and e-mail addresses of members and invited people, and the change history (who changed a record and when). Photos are not sent with shared cars. Members see this data according to their role.

We keep an invitation until it is accepted, declined or expires; we delete a closed invitation, including the invited person's e-mail address, after 90 days.

When a record in a shared car is deleted, we immediately reduce it to a technical entry without content (identifier, time and version) so that the deletion reaches other members' devices. We delete this technical entry 90 days after the record was deleted.

If the owner stops sharing or deletes the shared car, we permanently delete the car's content on the server — records, members, invitations and change history — after 30 days. When sharing is stopped, the owner keeps a private copy of the car on their phone. For 90 days we keep only a technical marker without content, so that devices that were offline for a long time can remove their copy.

If the owner's PRO subscription ends, sharing is paused: the car becomes read-only and no data is deleted. After 30 days the car is hidden from members. If the owner renews PRO within 90 days, sharing continues.

If the owner does not renew PRO within 90 days, sharing ends permanently and members lose access. We keep an archive of the car on the server for the owner: a complete copy of its details and records, including records added by members and the names of their authors. The owner can download the archive in the app as a private car. We delete the original shared car on the server 30 days after the archive is created; members keep only a technical marker without content for 90 days. We keep the archive until the owner downloads it, at the latest until their account is deleted. After download we keep the archive for another 30 days, then delete it permanently and keep only a technical record without the car's name or content for 90 days. Renewing PRO later does not restore sharing that has ended.

Analytics, diagnostics and crash reporting

FuelLog uses Firebase/Google services for basic analytics, diagnostics, installations, session information and crash reporting. These services may process technical data such as the app instance identifier, device model, operating system version, app version, usage time, basic app events, crash information, stack traces and diagnostics needed to fix bugs.

We use this data for app operation, stability measurement, bug fixing, security and quality improvement. We do not use advertising SDKs and we do not sell personal data.

Firebase Analytics only runs with your consent. On first launch (or when updating to a version with this feature, if you have not given consent yet) a dialog asks whether you agree to anonymous usage-analytics collection. Consent is optional, the app works identically either way, and you can change your choice anytime in Settings → Legal and account. Firebase Crashlytics is not affected by this consent and provides crash diagnostics and stability data for all users.

Firebase Analytics keeps event data for 2 months and user data for 14 months; the period is extended if you keep using the app. Firebase Crashlytics keeps crash reports for 90 days, after which Google starts deleting them.

In-app feedback

You can send feedback from the app after signing in with Google. We store its type and text together with a link to your account. If you keep the “Attach technical data” option on, the app also attaches the app version, device model and Android version, language, time zone, plan and app state — never photos, records, backups, e-mail addresses or tokens. We keep feedback for 90 days after we receive it, then it is deleted automatically. If you delete your account, we delete it sooner.

Who data may be made available to

  • the user in the app;
  • other members of a shared car and invited people (name, e-mail address, the car's records and change history), if you share a car or are a member of one;
  • the FuelLog backend for Google sign-in, device registration, car sharing, Cloud Backup, entitlement checks, feedback or account deletion;
  • Google Sign-In and the system speech recognition service if the user uses the relevant feature;
  • Google Play for purchasing and verifying the subscription;
  • Google Blockstore for storing the Cloud Backup encryption key;
  • Google/Firebase services for analytics, diagnostics, crash reporting and technical operation;
  • infrastructure providers required to operate the backend;
  • public authorities where required by law.

Legal basis

  • provision of the app and its features;
  • legitimate interest in security, abuse prevention, entitlement management, diagnostics and technical support;
  • consent, where an optional feature relies on consent;
  • compliance with legal obligations, where applicable.

Subscriptions and payments

FuelLog PRO is sold as a subscription through Google Play. Payments are processed solely by Google Play as the payment provider. Card numbers and other payment details never reach us and we do not store them.

When you purchase, Google Play gives us a purchase confirmation. From it we store the purchase identifier, the product identifier and the subscription state (active, in grace period, cancelled, refunded). The purchase identifier is stored encrypted. We need this data to verify that the subscription really exists, to protect against abuse and to manage access to PRO features.

The purchase is linked to your account through a one-way fingerprint (HMAC) derived from the account identifier using a server-side secret. Your identity cannot be recovered from that fingerprint.

Price, billing period and renewal terms are shown in Google Play before you confirm the purchase. The subscription renews automatically until you cancel it. You can cancel at any time in Google Play under Payments and subscriptions. After cancelling, PRO stays active until the end of the period you already paid for.

When you request account deletion, we stop the automatic renewal of your subscription and verify the result with Google Play. The paid period runs out and no money is refunded; refunds are decided solely by Google under its own rules. When the account deletion is completed, we also delete our records of your purchases. Order and payment records are kept by Google Play under its own rules.

Retention and deletion

Local data stays on your device until you delete it, clear the app's data or uninstall the app. Files exported outside the app must be deleted separately.

On the backend we keep data as follows:

  • account, car list and entitlement settings: while the account exists;
  • Cloud Backup: while you have PRO; after PRO ends, 30 days for restore, then locked and permanently deleted 90 days after PRO ended;
  • shared cars: while shared; after deletion or when sharing stops, 30 days, and a technical marker without content for 90 days;
  • deleted records in a shared car: technical entry without content for 90 days;
  • archive of a shared car after sharing ended without PRO: until the owner downloads it, at the latest until the account is deleted; after download 30 days, and a technical record without content for 90 days;
  • closed invitations: 90 days;
  • feedback: 90 days;
  • Firebase Analytics: 2 months (events), 14 months (user data); Firebase Crashlytics: 90 days;
  • operational logs: 30 days; administrator action records: 90 days;
  • database backups for disaster recovery: at most 30 days, not accessible in normal operation.

Account deletion is first scheduled with a 48-hour grace period during which it can be cancelled. We then delete the data listed on the Account and data deletion page, which also describes the whole process.

App permissions

  • Camera: taking photos of receipts, odometers or fuel price boards.
  • Microphone: optional voice entry of form data.
  • Internet: Google sign-in, device registration, entitlement and subscription checks, shared cars, Cloud Backup, feedback, Firebase diagnostics and account deletion requests.
  • Notifications: service, inspection and other reminders.
  • Google Play Billing: purchasing and restoring the PRO subscription.

User rights

Users may request access, correction, deletion, restriction of processing, data portability or object to processing under applicable law. Send requests to privacy@fuellog.eu.

Controller and contact

The data controller is the operator and publisher of the FuelLog app:

Tomáš Navrátil
Holandská 13
571 01 Moravská Třebová
Czech Republic

For privacy, support and GDPR requests, use:

Changes

This policy may be updated when new features, payments, Cloud Backup changes, diagnostics changes or legal requirements change.

This page was last updated on 18 October 2026.