Litro
Get Android app

Home / Privacy Policy

Last updated: 2026-08-13

Privacy Policy — Litro

Last updated: 2026-08-13 Products: Litro mobile application, web Explorer, and Litro website

Summary

1. Controller and contact

“Litro” is the displayed trade name. The person responsible for personal-information protection can be reached at support@litro.ca. Use this address for access, correction, withdrawal, deletion, or privacy complaints.

Production publication in the European Economic Area remains blocked until the operator’s full legal identity, address, applicable registration number, publication director, and decision about an EU representative have been supplied and validated. This policy describes the product’s current factual operation; it does not replace that required information or final legal review.

2. Scope and principles

This policy covers the mobile app, Explorer, website, forms, and public APIs. Litro limits collection to what a requested feature needs, separates local data from server services, and keeps optional consent-based processing off by default.

Station listings, brands, business addresses, displayed prices, and market data are generally business facts rather than information about a person. They may be temporarily associated with an installation when you voluntarily contribute; that link is treated as pseudonymous personal information.

3. Data kept only on the device

The following data is not synchronized or sent to Litro servers when you create, change, or delete it:

It remains until you delete it, clear app storage, or uninstall the app. Your operating system may offer backup or data retention during uninstall according to your settings; Litro does not control that system feature.

A JSON or CSV export can include notes, trips, and locations. You choose where to share and store it. An import is validated and previewed before confirmation.

4. Location, physical activity, and automatic trips

Litro asks for location permission only for a feature that needs it: nearby stations, maps, routing, trip recording, or the last parked location. You can refuse or withdraw permission in system settings.

Automatic trip recording is optional. On a compatible device, it may use background location, physical activity, nearby-device or vehicle-connection signals, notifications, and battery-optimization settings. These signals detect and record a trip on the device. Litro does not upload the trace, start and end points, stops, or last parked location.

A fill-up suggestion after a stop near a station is calculated on the device. It never creates a fill-up or price contribution automatically; you must open, review, and confirm the action.

5. Search, maps, and routes

When you search nearby or request a route, coordinates, a visible map area, a typed address, and necessary route geometry may be processed during the request by Litro and a selected mapping, geocoding, or routing service.

For route calculations made through the Litro API:

An infrastructure provider may still process network metadata and the URL needed to route and secure the request. External services you request are governed by their own policies.

6. Price contributions and missing stations

Community sharing stays off until you enable it and confirm a contribution. For a price contribution, Litro processes:

The contribution excludes litres, total paid, odometer, vehicle, notes, personal address, route, and raw coordinates. The public may see a price, last-observed time, source category, and confidence level; it never sees the installation fingerprint.

A missing-station proposal contains the market, submitted business name and brand, business coordinates, and an optional attached price. Litro first checks very close stations to reduce duplicates. You can export the proposal and its status.

You can retract a price observation. Deleting server data retracts active observations, withdraws pending proposals, removes an attached price, and irreversibly dissociates the installation from business facts that must be retained for catalogue integrity or moderation audit. A station that has already been verified may therefore remain in the catalogue without any link to you.

7. Alerts and notifications

If you enable alerts, Litro processes:

For a nearby alert, the app converts the selected position into a shared coarse grid cell before sending the preference. The server does not retain the precise position. It links the coarse cell to the installation fingerprint only so it can evaluate and deliver the requested alert; this is App Functionality, not tracking. A Price Outlook alert uses aggregated prices and market indicators, never your precise position, vehicle, fuel level, trip, fill-up intent, or planned quantity. An estimated effect on your fill-up is calculated only on the device. The raw installation secret is never stored on the server.

Legal agreement record

Before mobile setup begins, Litro asks you to agree to the current Terms of Service and acknowledge the Privacy Policy. The app stores the accepted document versions, time, and language on the device. If the device is offline, a pending record remains on the device and is sent when connectivity returns.

The server record contains only the cryptographic fingerprint of the random installation secret, the two document versions, language, acceptance time, and receipt time. The raw secret is never stored. This record is required to establish the agreement and is processed independently of optional telemetry, notifications, location, physical activity, and other feature permissions.

8. Optional telemetry

Improvement telemetry is optional, off by default, and requested separately during mobile setup. Until you make a positive choice, Litro does not create, store, queue, or upload optional telemetry events. Consent applies only to events that occur after your choice; enabling telemetry later does not send past usage.

When enabled, telemetry uses a random pseudonym separate from the authentication secret and fingerprint. It contains an event name, strictly limited technical properties, and a timestamp. Withdrawing consent stops collection and removes any unsent telemetry queue; previously received events remain subject to the retention and deletion controls below.

It must not contain exact location, address, geometry, a station or fill-up identifier, litres, total paid, odometer, vehicle, or notes. Creating, changing, or deleting a fill-up or fill-up intent produces no network event, including analytics.

9. Website, forms, and cookies

Essential language, market, and consent choices stay in the browser. Analytics, advertising, and other non-essential trackers load only after a positive choice. “Accept” and “Decline” have equal prominence, and “Manage cookies” lets you withdraw that choice.

The waitlist processes email, market interest, consent, and unsubscribe status. Contact may also process name, subject, message, and optional technical context. Contact requests are stored for support and sent to the support inbox through a transactional email provider; submitting one does not subscribe the address to marketing. The Litro Fleet form processes professional contact details, company, role, fleet-size band, primary need, optional answers, limited campaign attribution, and consent. It is used only to assess pilot demand and respond to relevant businesses.

Litro does not use IP-address geolocation to choose a market automatically.

Selecting the direct Android download action increments a Litro operational aggregate by day, page language, and app version. It does not store a cookie, pseudonym, user identifier, or campaign attribution and is not sent to website analytics without consent. The count records a download start, not a completed download or installation.

10. Service and security metadata

To route requests, enforce rate limits, prevent abuse, and diagnose failures, Litro and its infrastructure providers may process a network address, user agent, method, path, response status, request identifier, timestamp, and duration.

Litro application logs omit query parameters and redact installation secrets, tokens, telemetry identifiers, and authorization headers. This metadata is not used to select a market, track a trip, or deliver behavioural advertising.

11. Provider categories and transfers

Depending on the requested feature, recipient categories may include:

Litro does not sell personal information. Global catalogue suppliers send business data to Litro on the server; they do not receive your trips, stops, devices, advertising identifiers, or precise locations. Their mobility or places software kit is not embedded in the app.

Processing may occur in Canada, the United States, the EEA, or the applicable service region. Litro limits data to the feature’s need and applies required assessments, contracts, and safeguards before cross-border disclosure. Details about a recipient are supplied to the person or competent authority where law requires it; they are not published in product copy.

12. Retention

Where retention is required to comply with law, protect the service, resolve a dispute, or preserve audit integrity, Litro limits the information, access, and period to that need.

13. Purposes and legal bases

Depending on the feature and applicable law, Litro relies on:

Core local features remain available without telemetry, consented advertising, or community contributions. If you do not provide data required by an optional feature, only that feature may be unavailable.

14. Export, deletion, and security

The Privacy Centre provides:

The server export includes legal agreement records, alert preferences and deliveries, optional telemetry, price contributions, and station proposals associated with the installation. It excludes exploitable tokens and secrets.

Litro applies transport encryption, data minimization, access controls, identifier separation, log redaction, and deletion procedures. No measure removes all risk; an incident presenting a serious risk is handled and reported under applicable law.

15. Rights in Québec and Canada

Subject to applicable law, you may request access, correction, withdrawal of consent, deletion, and information about collection, authorized access, and retention. You may complain to the privacy contact or the appropriate authority, including Québec’s Commission d’accès à l’information.

Withdrawing consent stops the covered optional collection or use, subject to a legal obligation or limited need that must be explained.

16. Rights in the EEA

Where the GDPR applies, you may have rights of access, correction, erasure, restriction, objection, portability, and consent withdrawal. You may complain to the supervisory authority in your residence, workplace, or place of the alleged infringement; in France, this is the CNIL.

Send a request to support@litro.ca. Litro may request only the information necessary to verify that the request concerns the appropriate installation or person.

17. Automated recommendations

Litro may rank or recommend a station using available price, distance, last-observed time, and local vehicle settings. It may also show a qualitative Price Outlook for a region or city.

These recommendations are informational, do not guarantee future prices, never instruct you to wait, have no legal effect, and are not decisions producing significant effects based solely on automated processing.

18. Children, changes, and contact

Litro is not directed to children. In Québec, a person under 14 must not submit personal information through an optional feature without a parent or guardian’s consent, unless the law clearly allows collection for that person’s benefit. Anyone unable to understand the consequences of privacy choices should use those features only with this authorization. Litro does not request banking data, passwords, identity documents, or biometric data to use Explorer.

This policy may change with features, provider categories, or applicable requirements. A material change will be communicated reasonably before a new optional purpose applies. The date above identifies the current version.