Privacy policy

TopOff helps drivers find the cheapest real price for fuel. It has two kinds of accounts: Personal, for anyone with a car, and Fleet, a workplace program run by an employer. This policy covers the TopOff apps for iPhone and Android, topoffintel.com, and the services behind them: what we collect, why, who else handles it, and the choices you have.

The short version. We collect what the app needs to work. No ads, no selling data, no tracking you across other companies' apps or websites, no background location. Payments go through Apple or Google, and we never see your card.

What we collect

Account

• Your email address. You sign in with a one-time code we email to you; there is no password.
• The name you enter. Fleet accounts also have the fleet workspace, the role (driver or admin) and the truck or unit number.
• Optional vehicle details: fuel economy (mpg) and tank size, used to estimate miles to empty and your usual fill.
• If a fleet admin invites you: the email the invite was issued to, who issued it, and when it was used.

Location and searches

• Precise location, only while the app is open. It is sent with each search so we can find and rank stations near you. The app does not collect background location, and we do not keep a history of where you have been. To compare a fill-up with the station you would otherwise have used, we keep the list of stations your latest search showed (stations, not your location) for a few hours.
• On the way searches: your starting point and destination are sent to our servers to work out the route and the stations along it. For the free-trip allowance on Personal accounts we keep only the start time of your last free trip and a rounded area around its destination (and the same for any other free trip you started in the day before it), and when your first week started and how many of its trips you used.
• Address search: text you type into the destination box is sent, through our servers, to Google to suggest matching places.
• Address lookup: to show the name of the place you are in, the app asks your phone's built-in geocoder (Apple on iPhone, Google on Android) to turn your coordinates into a place name. Our servers also look up the ZIP code for a location with the U.S. Census Bureau geocoder, to compare prices with the local market.
• Map: the map is Google Maps. Your phone loads it directly from Google, so Google sees your IP address and the area of the map you are viewing, and Google's map software sends Google diagnostic and usage data with a device identifier. Google handles that data under the Google Privacy Policy.

Fill-ups

• When you log a fill-up: the station, fuel grade and time, the gallons and receipt total if you enter them, and a snapshot of local prices at that moment, including the station closest to where you searched (or the first one on your route), kept to measure what you saved.
• Receipt photos, if you add one to a fill-up: the photo, and what we read from it (station name and address, date and time, fuel, gallons, price per gallon and total), used to check that it matches the fill-up and to count your saving. A receipt can show the last digits of your payment card; we don't use them. You choose each photo; the app uses the camera or your photos only when you tap to add a receipt.
• Fleet accounts: fuel-card transaction data supplied by the fleet (station, date, gallons, price), used only to verify fill-ups and compute savings and bonuses.

Price reports

• When you confirm or correct a pump price ("Price right?"), or log what you paid: the station, fuel grade, price and time. A logged fill-up with a price you typed, or a receipt that matched it, counts as a report for that station.
• A price check also sends your location, only to confirm you are at or near the station. It is checked and not kept with the report.
• Reports are stored with a one-way code in place of your account, so a report does not show who sent it.

Purchases (TopOff Personal)

• The TopOff Personal subscription is sold and charged by Apple (App Store) or Google (Google Play). We never see or store your card or bank details.
• We receive the subscription status from the store through our billing provider, RevenueCat: the plan, purchase, renewal and expiry dates, the store's transaction identifiers, and the price, currency and country. It is linked to your account so the app knows you have unlimited On the way.

Diagnostics and product analytics

• App version, platform (iOS or Android) and when the app last reached our servers.
• Crash reports and error details, sent to Sentry: what went wrong in the code, the app and operating system version, and the device model. They do not include your name, email or location.
• Product analytics, sent to PostHog: which features are used, for example that a route search ran, the subscription screen opened or a purchase completed, with the app version, the platform and a pseudonymous ID made by a one-way hash of your account ID. Analytics events do not contain your name, email, coordinates or addresses.
• We do not use advertising SDKs and do not track you across other companies' apps or websites, which is why the app never asks for Apple's tracking permission.
• Fleet dashboard on the web (topoffintel.com/dashboard, for fleet admins): your browser keeps a random device ID and, while you are signed in, your sign-in pass in its own storage. No cookies and no analytics on that page.

How we use it

• Finding and ranking stations, routes and prices, and estimating miles to empty.
• Recording fill-ups and showing your savings; for fleets, verifying them against fuel-card data and computing driver bonuses.
• Running the free-trip allowance, the free plan's daily price refreshes, and the TopOff Personal subscription.
• Showing current prices to everyone from drivers' price reports, and building aggregated price information.
• Sign-in, security and abuse prevention, for example limits on how many sign-in codes can be requested.
• Fixing crashes and improving the app, using the diagnostics and analytics above.
• Answering you when you contact support.

Who sees it

• Personal accounts: nobody else. Your data is not visible to any fleet or any other user. The one exception is a price report you send: other drivers see the price as "reported by a driver", never your name.
• Fleet accounts: your fleet's admins see your fill-ups, savings, bonuses, app version and invite status. That is the product. A fleet never sees another fleet's data.
• Service providers that run parts of TopOff for us, under contract and only for that purpose:
  • Amazon Web Services: hosting, database and sign-in, and reading receipt photos (Amazon Textract).
  • Google Workspace: sends the sign-in code emails.
  • Google Maps Platform: station data, place suggestions, routes and drive times. It receives coordinates, route endpoints and search text from our servers, not your name or email.
  • Google Maps (the map in the app): as described above.
  • U.S. Census Bureau geocoder: ZIP codes for coordinates, sent from our servers without any account details.
  • Apple and Google: app distribution, payments and on-device place names.
  • RevenueCat: subscription status.
  • Sentry: crash reports.
  • PostHog: product analytics.
  Fuel price data providers receive no personal data.
• We disclose information when the law requires it or to protect someone from harm. If TopOff is ever merged or sold, this policy keeps applying to the data that moves with it.

What we don't do

• No selling or renting of personal data. No advertising. No data brokers.
• No background location tracking and no cross-app tracking.
• No handling of payment cards: Apple and Google process every purchase.
• No pooling of one fleet's data into another fleet's view. Workspaces are isolated.

Retention and deletion

• Delete your account any time in the app: open the menu and tap Delete account. That removes your profile, vehicle details, receipt photos, sign-in identity and approval record right away. The steps are also on our support page.
• What stays after deletion: fill-up records are kept as pseudonymous financial records, which no longer link to a name or email once your profile is gone. For Personal accounts, a one-way hash of your email and the date of your last free trip (with your first week's trip count) are kept until that trip would have renewed, at most two weeks, so deleting and signing up again does not reset the allowance.
• Deleting your account does not cancel a subscription. Cancel it in your App Store or Google Play subscriptions. Subscription records are kept as long as needed for accounting and tax.
• Receipt photos are deleted 13 months after you add them, or right away when you delete your account. What was read from a receipt stays with the fill-up record.
• Sign-in codes expire after 10 minutes and are deleted once used.
• Crash reports are kept for up to 90 days and analytics events for up to 12 months.
• Price reports are kept, without your name, after you delete your account; they are price data about a station, not about you.
• Fleet records stay while the fleet's account is active, because they are the audit trail behind paid bonuses. Fleet drivers can also ask for deletion through their fleet or by emailing us.

Your choices and rights

• Location is your call: you control the permission in your phone's settings. Without it the app cannot find stations near you.
• You can ask us for a copy of your data, a correction or a deletion by emailing support@topoffintel.com. We answer within 30 days.
• Depending on where you live, for example California, you may have rights to know, correct and delete personal information and to opt out of its sale or sharing. We do not sell personal information or share it for cross-context advertising. We will not treat you differently for using these rights.

Security

Data is encrypted in transit. On your phone, sign-in credentials sit in the Keychain (iPhone) or Keystore (Android) and the app's local data is encrypted. Access is scoped per account and per fleet workspace, and production access is limited to the founders. A security summary for IT review is available on request.

Where data is processed

TopOff is run from the United States, and our servers are in the United States.

Children

TopOff is meant for licensed drivers and is not directed to children under 16. We do not knowingly collect information from children.

Changes

If this policy changes materially, we will update the date at the top, note the change in the app's release notes, and email active fleets.

Contact

Privacy questions or requests: support@topoffintel.com
TopOff Fleet Intel Inc. · Delaware, USA