Privacy policy

No accounts

There is no sign-up and no sign-in, and the app never asks for an email address or a phone number. There is therefore no name, account or identifier for us to attach anything to in the first place.

Your trips stay on your phone

Trips, stops, dates, budgets, the vehicles in your garage, their odometer readings and document dates, your fuel log, your service history, your trip journal with its photos, and every note are stored on your device only. We keep no copy of any of it, and nothing syncs between devices through us. Two things do send some of it off the phone, and both are a tap you make: sharing a trip link, and working out a route — see those two sections for what each sends.

If you have iPhone backup switched on, this data is included in that backup under Apple's settings — inside your Apple account, not ours.

The home-screen and lock-screen widget — and the riding-day Lock Screen card (Live Activity) — read a small summary the app writes on the phone: the next stop, how many are left, sunset. It sits on the same device as everything else, never leaves it, updates only while you use the app, and nothing refreshes itself in the background.

Deleting the app deletes all of it.

Photos you attach

Photos of a vehicle, photos attached to a service record — the receipt, the odometer, the worn part — and the photos you put in a trip journal are chosen through the iOS photo picker, which runs outside the app. The app therefore sees only the photos you hand it: it never asks for access to your library and never sees anything else in it.

Once attached, a photo is downscaled and stored on the device like everything else. It is not uploaded anywhere, and it does not travel with a shared trip link.

The service-history file you export (CSV) is written on the device and handed to the iOS share sheet. Where it goes from there is your choice; we do not get a copy.

The trip summary card works the same way: it is drawn on the device from the first photo in your journal and handed to the share sheet. If you do not share it, it goes nowhere — and it carries no money on it at all, neither the budget nor the fuel estimate.

Notifications

Reminders for document expiry and time-based servicing are off until you turn them on. When you do, they are scheduled entirely on your device: no server, no push token, and nothing leaving the phone.

The app does not run in the background for this. It works out the dates while you have it open and leaves iOS to fire them. You can switch it off at any time in Settings.

Your location — only when you ask for it

The app asks for while-using location only, and only at the moment you tap something that genuinely needs it: finding the nearest petrol, pinning a stop where you are standing, seeing how far along the plan you have ridden, checking in at a stop, or setting your home base. Simply opening the app never reads it.

It is read one fix at a time, never as a stream. There is no background mode and no geofencing, and the app does not record the route you rode. Once the app is closed it has no idea where you are.

Most of what it reads never leaves the device: the nearest petrol, checking in, and how far along the plan you are all work out of data already on the phone, and none of it is attached to a station report. Your coordinates are never attached to a shared link either — but if you switch progress sharing on for a trip, the list of which stops you checked in at and when does appear on that trip's link. See “Shared trip links” below. The only thing kept is the home base you set yourself, which lives on the phone and can be cleared in Settings.

Two buttons do send your position off the phone, and they send it to our own routing server: “how far can this tank get me” sends the one coordinate you are standing on, and “route from where I am” sends that coordinate plus the stop you are heading for. Only on those taps, with nothing identifying you attached, and that server does not keep the coordinates — see the services section below.

If you pin a stop where you are standing, or set your home base, the app sends that one coordinate to Apple Maps to suggest a name for it, which you can then edit. That happens only on that tap, and nothing identifying you goes with it.

You can refuse, and everything about planning a trip still works exactly as it does now — the location features are shortcuts, never a condition of use.

This is a planner, not a navigator. When you start navigating a leg, the app hands off to Apple Maps or Google Maps as you choose; from that point on you are covered by that app's policy, not ours.

Shared trip links

When you share a trip, the app uploads a snapshot of that plan so a link can exist. What is uploaded is what the page shows: the trip name, the dates, stop names and types, the coordinates of the stops you pinned, distances, estimated riding time, and the no-fuel-ahead warnings.

One thing in a shared link is about you rather than about the plan, and it is off unless you turn it on: your check-ins. Switch progress sharing on for a trip and that trip's page also shows which stops you have checked in at, and at what time. That is the whole of it.

What does not go with it: none of your coordinates, no trace of the route you actually rode, no estimate of when you will reach the next stop, and nothing running in the background. The page moves only when you press check in. This is not live tracking.

It is a per-trip switch, not an app-wide one. Turn it off and no further check-ins are published, and revoking the link still removes everything, as it always did.

Links are unlisted. Anyone holding one can read the plan — that is the point — but the page asks search engines not to index it, so a link you sent to five friends should not surface in a search for your name.

The plan in a snapshot does not follow your trip as you edit it — check-in progress, above, is the one exception — and you can revoke the link at any time from inside the app. Once revoked, that link stops working immediately.

Sharing is always something you choose to do. If you never share, your plans never leave your phone.

Reporting a station

If you report a fuel station as wrong, this is the whole of what is sent:

• The station's own details — name, brand, the station's coordinates, and its id in our dataset.
• Which problem you picked, and any note you typed yourself.
• The app version and your app language, so the report can be read in context.

No name, no email, no device identifier, and no location of yours. The coordinates in a report are the station's, not yours — we cannot tell where you were when you sent it. That did not change when the app gained the ability to find the nearest pump to where you are.

Reports are always read by a person and are never applied automatically. Please don't type personal details into the note: because reports carry no identity, we have no way to find yours again and delete it individually.

No tracking, no ads

There are no analytics SDKs, no tracking tools, no advertising, and no sale or exchange of data with anyone. We do not record which screens you open, what you tap, or where you plan to go.

The servers behind shared links and station reports keep ordinary technical logs, as any hosting provider does (for example, when a request arrived). Those are used for security and debugging only, never to build a profile.

Outside services and data sources

• Weather — Apple Weather. The app sends only the coordinates of the stops you pinned and your trip's dates in order to get a forecast; it sends nothing that identifies you.
• Maps in the app — Apple Maps (MapKit). Place search happens only when you type a search yourself, and results are never stored.
• Suggesting a place name — Apple Maps again. The app sends one coordinate to ask what is there when you drop a pin, pin a stop where you are standing, or set your home base. The answer is only a suggestion you can edit.
• Working out routes — our own server (maps.nat-touring.dev), not a third party. The app sends the day's stop coordinates, your vehicle type and your avoid-tolls setting to get the real road and the elevation along it. The two things that also send the coordinate you are standing on are “how far can this tank get me” and “route from where I am”. If you import a GPX file, the app sends the track in it to be snapped onto roads.
• What the routing server keeps — only which endpoint was called and when. The coordinates travel in the body of a POST, so they appear in no URL and in no log (checked 2026-08-17). There are no accounts, no device identifiers, and nothing that ties a request to you.
• How those requests travel — they go through Cloudflare's network to reach our server, the same way this shared page does, so Cloudflare sees your IP address in the ordinary way any request through a provider does.
• PM2.5 readings — Air4Thai, the Pollution Control Department's own station network. During the burning season the app downloads the whole national table of readings and picks the nearest station on the phone, so neither your position nor your plan is ever sent to Air4Thai — their server sees only that the table was downloaded, like any ordinary web request.
• Your own position — leaves the phone in three places only, and every one of them is a tap you made: the name suggestion (Apple Maps), “how far can this tank get me”, and “route from where I am” (our routing server). Nothing else sends it anywhere.
• Fuel stations, hospitals-police-repair shops, cafes-viewpoints-stays, and park boundaries — from OpenStreetMap (parks joined with the Department of National Parks' open data), published under the ODbL, and all shipped inside the app — which is why they work with no signal, and why browsing them sends nothing anywhere.
• The map on this shared page — map images load directly from OpenStreetMap's own servers, so they see the IP address of whoever opens this page, in the ordinary way any image loaded from another site does.
• The route line on this shared page — worked out in the app from OpenStreetMap data and carried along in the trip's snapshot. The page routes nothing itself and calls no service beyond the map images.

Map, routing and station data © OpenStreetMap contributors (ODbL).

Changes to this policy

If this policy changes, the date above changes with it — and if a change actually affects your data, the app will say so too.

Contact

Questions about privacy, or want a share link of yours taken down? Get in touch at [email protected]