Introduction
This Privacy Policy describes how TankoUp collects, uses, and protects the personal data of users of its mobile application and website. We are committed to data minimisation: TankoUp does not require registration, does not build individual user profiles, and does not sell your data to third parties.
This document complies with the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — and, where applicable, Spanish Organic Law 3/2018 on the Protection of Personal Data (LOPDGDD). By using TankoUp you acknowledge that you have read and understood this policy.
1. Data Controller
The data controller for personal data collected through the TankoUp mobile application and website is:
- Name: TankoUp
- Data controllers: Andrés Felipe Alzate Restrepo, Rocio Blanco Castro
- Contact email: [email protected]
For any questions about how we handle your personal data, please contact us at the email address above.
This policy is accessible from the app settings menu and the website footer.
2. Data We Collect
TankoUp does not require registration or account creation. We do not collect your name, email address, or any other identifying information voluntarily.
The following data is collected automatically:
2.1 GPS Location
When you grant location permission on your device, we collect your precise geographic position only during the active session in order to show you nearby gas stations. This data is not stored on our servers and is not linked to any user profile.
2.2 Usage Data (Analytics)
Through Firebase Analytics (Google LLC), we collect anonymous information about how the app is used: screens visited, searches made, and general interactions. This data is aggregated and cannot identify you individually.
Firebase Analytics may collect the device advertising identifier (IDFA on iOS, GAID on Android) for analytics purposes. On iOS, this access requires prior user consent through the App Tracking Transparency (ATT) prompt; if you do not grant consent, the IDFA is not accessed. This same identifier may also be used, subject to separate consent, to personalize the ads described in section 2.4.
2.3 Crash and Performance Data
Through Firebase Crashlytics (Google LLC), we automatically collect crash reports (stack traces) and basic device information when the app closes unexpectedly. This helps us detect and fix technical errors.
2.4 Advertising (Google AdMob and Google AdSense)
TankoUp shows banner ads through Google AdMob (Google LLC) on the gas station list and detail screens. This is how we fund a free app with no registration and no subscription.
By default, ads are non-personalized — selected using general context (such as app category or approximate region), not your individual behavior. Ads only become personalized, using your device's advertising identifier (IDFA on iOS, GAID on Android), if you grant consent through both of the following:
- Google's consent form (UMP), shown on first launch, compliant with the GDPR and the IAB Transparency & Consent Framework (TCF), where you can accept, reject, or customize the purposes and ad partners you allow.
- On iOS only: Apple's App Tracking Transparency (ATT) system permission, which independently controls access to the IDFA.
If you decline either of these, you will still see ads, but only non-personalized ones. You can review or change your choice at any time from Settings → Ad choices in the app.
On the website, banner ads are served through Google AdSense (Google LLC) in the same places: the station list and the station detail panel. In the browser, Google uses cookies and similar technologies instead of the device advertising identifier. In the European Economic Area, ads are only shown after you make a choice in Google's consent message (a GDPR / IAB TCF-compliant tool), where you can accept, reject, or customize purposes and partners; by default, ads remain non-personalized. While ads are active, you can change your choice at any time from the ad privacy options link in the website footer. The specific cookies involved are listed in our Cookie Policy.
3. Purposes and Legal Basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| GPS location | Show nearby gas stations | User consent (Art. 6.1.a) |
| Usage analytics | Improve the product and user experience | Legitimate interest (Art. 6.1.f) |
| Advertising identifier (IDFA/GAID) — analytics attribution | Usage analytics | User consent (Art. 6.1.a) |
| Crash data | Detect and fix technical errors | Legitimate interest (Art. 6.1.f) |
| Banner ad display | Fund the free app (no registration, no subscription) | Legitimate interest (Art. 6.1.f) |
| Advertising identifier (IDFA/GAID) — ad personalization | Show personalized ads via Google AdMob | User consent (Art. 6.1.a) |
| Analytical cookies (web) | Measure website usage | User consent (Art. 6.1.a) |
| Advertising cookies (web) | Serve and measure ads via Google AdSense | User consent (Art. 6.1.a) |
4. Cookies and Tracking Technologies (Website)
The TankoUp website uses the following types of cookies:
Technical cookies (always active)
These are strictly necessary for the site to function. They store preferences such as your selected language or visual theme. They do not require consent.
Analytical cookies (require consent)
We use Google Firebase Analytics to collect anonymous, aggregated information about website usage (pages visited, session duration, etc.). These cookies are only activated if you accept them through the consent banner shown on your first visit.
You can withdraw your consent at any time by clearing your browser cookies or rejecting analytical cookies in the consent banner.
Advertising cookies (require consent)
When ads are active on the web app, Google AdSense (Google LLC) uses cookies to serve ads, limit how often you see the same ad, measure ad performance, and prevent fraud. In the European Economic Area these cookies are only set after you make a choice in Google's consent message, and ads remain non-personalized unless you consent to personalization.
Third-party vendors, including Google, use cookies to serve ads based on prior visits to this or other websites. You can opt out of personalized advertising at Google Ads Settings or www.aboutads.info. The specific cookies are listed in our Cookie Policy.
5. International Data Transfers
Firebase Analytics, Firebase Crashlytics, Google AdMob, and Google AdSense are services provided by Google LLC, headquartered in the United States. Data processing by Google is covered by the Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Regulation (EU) 2016/679.
You can review Google's transfer safeguards at: https://firebase.google.com/support/privacy
For advertising specifically, you can review how Google uses ads data at: https://policies.google.com/technologies/ads
You can also review how Google uses information from sites that use its services at: https://policies.google.com/technologies/partner-sites
6. Data Retention
| Data type | Retention period |
|---|---|
| GPS location | Not retained. Used in memory during the session only. |
| Usage analytics (Firebase) | 14 months (Firebase default) |
| Crash data (Crashlytics) | 90 days (Firebase default) |
| Advertising identifier (IDFA/GAID) — analytics attribution | Tied to the Firebase Analytics retention period |
| Advertising identifier (ad personalization via AdMob) | Not stored by us — retention is managed directly by Google under its own ad platform policies |
7. Data Recipients
Your data is only accessible by the service providers listed below, who act as data processors:
| Provider | Service | Country |
|---|---|---|
| Google LLC | Firebase Analytics and Crashlytics | USA (with SCCs) |
| Google LLC | Google AdMob (ad serving and, with consent, ad personalization) | USA (with SCCs) |
| Google LLC | Google AdSense (website ad serving and, with consent, ad personalization) | USA (with SCCs) |
We do not sell your personal data. When you consent to personalized ads, Google AdMob shares your advertising identifier with Google's certified ad technology partners strictly to select and measure the ads shown to you — this only happens with your consent, which you can withdraw at any time from Settings → Ad choices. The full list of ad technology partners Google works with is disclosed directly inside that same consent form.
8. Your Rights
Under the General Data Protection Regulation (GDPR), you have the right to:
- Access: know what data we hold about you.
- Rectification: correct inaccurate data.
- Erasure: request deletion of your data ("right to be forgotten").
- Objection: object to processing based on legitimate interest.
- Restriction: request that we limit the processing of your data.
- Portability: receive your data in a structured, machine-readable format.
- Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
If you believe the processing of your data does not comply with applicable law, you have the right to lodge a complaint with your national supervisory authority. In Spain: Agencia Española de Protección de Datos (AEPD) at www.aepd.es.
9. Security and Breach Notification
We apply reasonable technical and organizational measures to protect your data against unauthorized access, loss, or improper disclosure.
In the event of a security breach that poses a high risk to your rights and freedoms, we will notify you as soon as possible in accordance with Art. 34 of the GDPR, and we will report the incident to the Agencia Española de Protección de Datos (AEPD) within a maximum of 72 hours of becoming aware of it.
10. Minors
TankoUp is intended for users aged 14 and over. We do not knowingly collect personal data from children under that age. If we become aware that data has been collected from a minor under 14 without verifiable parental consent, we will delete it immediately.
In line with the audience declared to Google, TankoUp is configured as a general-audience app; we do not knowingly serve personalized ads to users under 14.
If you are a parent or guardian and believe your child under 14 has provided us with data, please contact us at [email protected].
11. Changes to This Policy
We may occasionally update this privacy policy. The "Last updated" date at the top of this document always reflects the current version. We recommend reviewing it periodically.
If changes are material, we will notify you through the app or website before they take effect.
12. Contact
For any questions about this policy or the processing of your data:
TankoUp
[email protected]