Litro
Get Litro

Home / Privacy Policy

Last updated: 2026-10-14

Privacy Policy: Litro

Last updated: 2026-10-14 Products: Litro mobile application, web Explorer, and Litro website

Summary

1. Controller and contact

“Litro” is the displayed trade name. The person responsible for personal-information protection can be reached at support@litro.ca. Use this address for access, correction, withdrawal, deletion, or privacy complaints.

Production publication in the European Economic Area remains blocked until the operator’s full legal identity, address, applicable registration number, publication director, and decision about an EU representative have been supplied and validated. This policy describes the product’s current factual operation; it does not replace that required information or final legal review.

2. Scope and principles

This policy covers the mobile app, Explorer, website, forms, and public APIs. Litro limits collection to what a requested feature needs, separates local data from server services, and keeps optional consent-based processing off by default.

Station listings, brands, business addresses, displayed prices, and market data are generally business facts rather than information about a person. They may be temporarily associated with an installation when you voluntarily contribute; that link is treated as pseudonymous personal information.

3. Data kept only on the device

Without optional account summary sync, the following journal data is not synchronized or sent to Litro servers when you create, change, or delete it:

It remains until you delete it, clear app storage, or uninstall the app. Your operating system may offer backup or data retention during uninstall according to your settings; Litro does not control that system feature.

A JSON or CSV export can include notes, trips, and locations. You choose where to share and store it. An import is validated and previewed before confirmation.

3a. Optional accounts and summary sync

Account access is currently private and invitation-only. Public account creation is closed. Identity services process your email, password, verified user identifier and session credentials; Litro stores your account identifier, optional display name, language, consent records, connected installation identifiers and vehicle associations. Passwords are handled by the authentication provider and are not included in Litro exports or logs. Browser sessions use essential, HttpOnly session cookies.

With explicit summary-sync consent, Litro stores trip start/end times, durations, distance and provenance, classification, review state, optional title, purpose and notes, estimated fuel/cost/currency/odometer and provenance, recording source, vehicle association and revision timestamps. This release uploads no route geometry, start/end coordinates or parked location. Hosting, managed database, authentication and transactional email providers process the corresponding service data.

The connected journal belongs to Litro Plus, with explicit upload consent and twenty-four calendar months of working history. Approved invitation preview remains complimentary. Free local recording/history/CSV and online fuel tools remain available. Each verified loss of Plus establishes a fixed retained-record cohort: thirty days of read-only browsing/CSV, then sixty days of hold. Owner-authorized account-data export remains available during the hold. Verified reactivation closes that episode and a later expiry creates another. Outages do not establish expiry. Separately announced free-cloud retirement protects any legacy free records for ninety days; deployment alone sets no date. Local records, individual cloud/route deletion, consent revocation and device removal remain independent of payment. Seven-year archive visibility and destructive cleanup remain separately controlled.

Stopping sync, disconnecting a phone and signing out do not delete copies. Cloud deletion removes private payloads and preserves only identifiers, revisions and server-side deletion/cursor metadata needed to block stale uploads. Restoring deliberately deleted trips requires selecting available local originals and confirming; unselected trips stay deleted. Account deletion scrubs Litro identity/profile and cloud content through resumable bounded work and revokes sessions on completion. A minimal terminal identity mapping prevents reprovisioning; the authentication provider may retain its user record until separately removed.

The account JSON archive contains retained account metadata and complete retained summaries, without secrets or route data. It fails explicitly if concurrent changes, expiry or resource limits prevent completeness. Trip CSV is a separate filtered report. Visible coverage and expiry matter: a 31-day monthly report may outlast Free cloud retention. Local export remains available for originals still on the phone. Downloaded/shared files are under your control.

Encrypted migration-backup artifacts expire after three days in the release workflow; this is separate from active-data erasure. Provider backups and security logs follow their configured contract, and their live settings still require operator verification. Litro does not promise immediate physical erasure of every backup. Device-intent receipts and completed archive-request metadata use bounded operational cleanup; deletion fences remain while needed to protect against stale uploads.

4. Location, physical activity, and automatic trips

Litro asks for location permission only for a feature that needs it: nearby stations, maps, routing, trip recording, or the last parked location. You can refuse or withdraw permission in system settings.

Automatic trip recording is optional. On a compatible device, it may use background location, physical activity, nearby-device or vehicle-connection signals, notifications, and battery-optimization settings. These signals detect and record a trip on the device. Litro does not upload the trace, start and end points, stops, or last parked location.

A fill-up suggestion after a stop near a station is calculated on the device. It never creates a fill-up or price contribution automatically; you must open, review, and confirm the action.

5. Search, maps, and routes

When you search nearby or request a route, coordinates, a visible map area, a typed address, and necessary route geometry may be processed to provide the result by Litro and a selected mapping, geocoding, or routing service.

For geocoding, successful typed queries, reverse-geocoding coordinates rounded to five decimal places, and returned coordinates and labels may remain in a Litro API in-process cache limited to 500 entries for up to seven days. Empty results may remain for up to five minutes. Entries disappear earlier when evicted or when the process restarts, and they are not inserted into the Litro database.

For route calculations made through the Litro API:

An infrastructure provider may still process network metadata and the URL needed to route and secure the request. External services you request are governed by their own policies.

6. Price contributions and missing stations

Community sharing stays off until you enable it and confirm a contribution. For a price contribution, Litro processes:

The contribution excludes litres, total paid, odometer, vehicle, notes, personal address, route, and raw coordinates. The public may see a price, last-observed time, source category, and confidence level; it never sees the installation fingerprint.

A missing-station proposal contains the market, submitted business name and brand, business coordinates, and an optional attached price. Litro first checks very close stations to reduce duplicates. You can export the proposal and its status.

You can retract a price observation. Deleting server data retracts active observations, withdraws pending proposals, removes an attached price, and irreversibly dissociates the installation from business facts that must be retained for catalogue integrity or moderation audit. A station that has already been verified may therefore remain in the catalogue without any link to you.

7. Alerts and notifications

If you enable alerts, Litro processes:

Station tracking sends the public station identifier and market, never your position or route. The subscription watches price changes for every supported fuel at that station; the stored fuel value exists only for compatibility.

An alert linked to My Places is configured separately for each Place. Its name, precise address, anchor, and small matching radius remain on the device. Litro receives only an approximate area and the wider price-monitoring radius you selected. This information is not used to reconstruct trips or determine whether you are at Home or Work.

Litro intentionally limits delivery, prevents duplicates, retries bounded failures, and keeps ticket and receipt evidence needed to confirm or diagnose delivery. A notification-delivery intermediary and the device platform’s push provider process the token and notification for delivery. You can stop tracking or delete server data from Litro. Ownership is pseudonymous and tied to the installation secret, so a lost secret cannot be used to recover or transfer the subscription. A Price Outlook alert uses aggregated prices and market indicators, never your precise position, vehicle, fuel level, trip, fill-up intent, or planned quantity. An estimated effect on your fill-up is calculated only on the device. The raw installation secret is never stored on the server.

Legal agreement record

Before mobile setup begins, Litro asks you to agree to the current Terms of Service and acknowledge the Privacy Policy. The app stores the accepted document versions, time, and language on the device. If the device is offline, a pending record remains on the device and is sent when connectivity returns.

The server record contains only the cryptographic fingerprint of the random installation secret, the two document versions, language, acceptance time, and receipt time. The raw secret is never stored. This record is required to establish the agreement and is processed independently of optional telemetry, notifications, location, physical activity, and other feature permissions.

8. Operational telemetry and optional analytics

Litro automatically collects a narrowly limited operational record to measure active use, maintain version and distribution compatibility, understand retention, and verify that this collection path works. It uses a purpose-limited random operational installation identifier and records one row per active local calendar day with the app version, build number, distribution source (google_play, litro_direct, one_store, development, or unknown), platform, and operating-system major version. It is not an advertising identifier and is not shared across apps.

Operational telemetry does not contain precise or approximate location, addresses, searches, routes, stations viewed, directions actions, trips, trip purpose, vehicles, fill-ups, litres, amounts paid, odometers, savings, favourites, tracked stations, Bluetooth identifiers, push tokens, notification content, advertising identifiers, contact details, notes, or photos. It is separate from the installation authentication secret and optional-analytics pseudonym. Litro’s hosting and managed-database providers process it only as service providers for Litro. It is pseudonymous, not anonymous.

Optional first-party product analytics are off by default and start only after an explicit positive choice during mobile setup or in Privacy settings. They use a separate random pseudonym and contain only an approved coarse feature-use event name, a small allow-listed set of bounded properties, and a timestamp. They may report that a station detail was opened, directions were launched, a station was saved or unsaved, station tracking was started, or an automatic trip was completed or reviewed, together with coarse context such as source, result or status, distance band, GPS-quality band, or the app's Litro market or region. That market or region may come from an automatic suggestion based on the coarse network-derived country or region described below. The optional-event payload does not contain the IP address or precise location; request-level network metadata is handled as described in section 10.

Optional analytics never include the underlying station identifier, name, address, coordinates, or price; search text or destination; route geometry; trip identifier, times, classification, purpose, or exact distance; saved-station or tracked-station records; vehicle names; fill-up details; odometer readings; notes; photos; the operational identifier; or other exact private records. Litro applies the same event-specific filter before upload and before server storage; non-approved, structured, or aliased properties are discarded. Withdrawing consent stops optional collection and deletes the unsent optional queue without disabling operational telemetry. Enabling optional analytics later does not send past usage. Litro does not use this information to track you across other companies’ apps or websites.

Google analytics on Android

Help improve Litro offers separate Litro analytics and Google analytics choices. Both are optional. A previous Litro choice never enables Google. Google measurement is available only in configured Android builds and starts after your explicit choice. iOS Google measurement remains disabled.

Google Analytics for Firebase uses its own app-instance identifier, app/session events and a small set of usage milestones, such as opening directions or saving a new refuel. Google may process device/app information, network metadata and an approximate country or region. Litro does not send its account or telemetry identifiers, trip records, locations, station identifiers or notes to Google. Advertising-ID collection, personalized advertising and Google Signals are disabled.

Google event/user-data retention is configured to two months, without extending it on new activity. Aggregated reports follow Google's property policies. Google's processing may involve the United States. These data help evaluate app discovery and useful actions; Litro and Google consent populations remain separate.

Privacy settings let you withdraw either choice. Withdrawal stops Google collection and clears pending measurement; re-enabling does not replay earlier usage. Privacy Centre can request provider deletion using the Google app-instance identifier. A successful request means Google accepted it, not that deletion has finished. Failed requests remain on the device for retry. Resetting the local SDK alone does not delete data held by Google.

9. Website, forms, and cookies

Essential language, market, and consent choices stay in the browser. Analytics, advertising, and other non-essential trackers load only after a positive choice. “Accept” and “Decline” have equal prominence, and “Manage cookies” lets you withdraw that choice.

The waitlist processes email, market interest, consent, and unsubscribe status. Contact may also process name, subject, message, and optional technical context. Contact requests are stored for support and sent to the support inbox through a transactional email provider; submitting one does not subscribe the address to marketing. The Litro Fleet form processes professional contact details, company, role, fleet-size band, primary need, optional answers, limited campaign attribution, and consent. It is used only to assess pilot demand and respond to relevant businesses.

When automatic region suggestions are enabled, Litro may use a country or region code inferred from the request's IP address by an infrastructure or edge provider to suggest an available market. If that coarse network signal is unavailable, the app may fall back to its time zone and language or locale. You can change the region or lock your choice. These signals are not used for advertising.

Selecting the direct Android download action increments a Litro operational aggregate by day, page language, and app version. It does not store a cookie, pseudonym, user identifier, or campaign attribution and is not sent to website analytics without consent. The count records a download start, not a completed download or installation.

10. Service and security metadata

To route requests, enforce rate limits, prevent abuse, and diagnose failures, Litro and its infrastructure providers may process a network address, user agent, method, path, response status, request identifier, timestamp, and duration.

Litro application logs omit query parameters and redact installation secrets, tokens, telemetry identifiers, and authorization headers. An infrastructure or edge provider may derive the coarse country or region signal described above from the network address. Litro does not use this metadata to track a trip or deliver behavioural advertising.

11. Provider categories and transfers

Depending on the requested feature, recipient categories may include:

Litro does not sell personal information. Global catalogue suppliers send business data to Litro on the server; they do not receive your trips, stops, devices, advertising identifiers, or precise locations. Their mobility or places software kit is not embedded in the app.

Processing may occur in Canada, the United States, the EEA, or the applicable service region. Litro limits data to the feature’s need and applies required assessments, contracts, and safeguards before cross-border disclosure. Details about a recipient are supplied to the person or competent authority where law requires it; they are not published in product copy.

12. Retention

Where retention is required to comply with law, protect the service, resolve a dispute, or preserve audit integrity, Litro limits the information, access, and period to that need.

13. Purposes and legal bases

Depending on the feature and applicable law, Litro relies on:

Core local features remain available without optional analytics, consented advertising, or community contributions. Operational telemetry remains active when optional analytics are declined or withdrawn. If you do not provide data required by another optional feature, only that feature may be unavailable.

14. Export, deletion, and security

The Privacy Centre provides:

The server export includes legal agreement records, station, coarse-area and Price Outlook alert settings, the operational identifier and daily records, optional analytics, price contributions, and station proposals associated with the installation. Full server-data deletion removes both telemetry streams and rotates the operational identifier. It excludes exploitable tokens and secrets.

Litro applies transport encryption, data minimization, access controls, identifier separation, log redaction, and deletion procedures. No measure removes all risk; an incident presenting a serious risk is handled and reported under applicable law.

15. Rights in Québec and Canada

Subject to applicable law, you may request access, correction, withdrawal of consent, deletion, and information about collection, authorized access, and retention. You may complain to the privacy contact or the appropriate authority, including Québec’s Commission d’accès à l’information.

Withdrawing consent stops the covered optional collection or use, subject to a legal obligation or limited need that must be explained.

16. Rights in the EEA

Where the GDPR applies, you may have rights of access, correction, erasure, restriction, objection, portability, and consent withdrawal. You may complain to the supervisory authority in your residence, workplace, or place of the alleged infringement; in France, this is the CNIL.

Send a request to support@litro.ca. Litro may request only the information necessary to verify that the request concerns the appropriate installation or person.

17. Automated recommendations

Litro may rank or recommend a station using available price, distance, last-observed time, and local vehicle settings. It may also show a qualitative Price Outlook for a region or city.

These recommendations are informational, do not guarantee future prices, never instruct you to wait, have no legal effect, and are not decisions producing significant effects based solely on automated processing.

18. Children, changes, and contact

Litro is not directed to children. In Québec, a person under 14 must not submit personal information through an optional feature without a parent or guardian’s consent, unless the law clearly allows collection for that person’s benefit. Anyone unable to understand the consequences of privacy choices should use those features only with this authorization. Litro does not request banking data, passwords, identity documents, or biometric data to use Explorer.

This policy may change with features, provider categories, or applicable requirements. A material change will be communicated reasonably before a new optional purpose applies. The date above identifies the current version.