Privacy Policy

Fuel Relay is a fuel logging service for oilfield fueling crews and the companies they work for. It consists of a mobile app used by fuelers and a web dashboard used by company admins.

The service is operated by Fuel Relay. For anything in this policy, contact us at privacy@fuelrelay.net.

We collect different data depending on how you use Fuel Relay.

If you are an admin (a company account holder; a company can have several):

• Your email address.
• When an admin invites someone, we keep the invited email address, who sent the invitation and when, and a one-way code of the invitation link — not the link itself, which exists only in the invitation email (kept for a limited time by our email provider, like every email it sends) or with the admin who copied it. An invitation works for 7 days; we delete our record of it 30 days after it is used, withdrawn or expires.
• Every admin of a company can see the other admins’ email addresses, when they joined, when they last signed in and who invited them; the addresses of past admins and of people invited who haven’t joined yet; and which admin did what in the audit log.
• Your password, stored only as a salted hash. We never see or store the plaintext.
• Your company name.
• If you choose a language for the dashboard (English or Español), we save that choice with your login so the dashboard opens in it on any browser, and keep it in a cookie (fr_lang) on your browser for the sign-in pages.
• Billing details (cardholder or account holder name, card or bank account details, billing address and billing email, and a purchase order number if you give one). These are collected and stored by Stripe, our payment processor. Card and bank account numbers never touch our servers.
• If your company turns on prices and invoices (optional, and off unless you turn it on): the prices per gallon, tax rate and invoice numbering you set; your company’s address and the note printed on invoices; each contractor’s bill-to address, which may name a contact person, and whether they are tax exempt; the invoices you issue (the contractor, the dates, and for each line the day, location, fuel type, AFE if shown, gallons, price and amount, plus which admin issued or voided it, when, and the reason given for a void); and a history of every change to prices, contractors and these settings (what changed, which admin changed it and when). Invoices don’t name your fuelers.
• If your company turns on the optional weekly email report, we email each of your company’s admins a weekly summary of your company’s fuel logs, with a billing spreadsheet attached, through our email provider, Resend; any admin can stop receiving it at any time with the unsubscribe link in the email or in Settings › Email reports.
• When your company uses customer signatures, we store the printed name and handwritten signature of the person who signs for a delivery, with the time signed, as part of that company’s fuel log; it is kept with the log and deleted with it or on the company’s request.
• If a company turns on delivery receipts, it can enter a billing email address for each of its contractors. We use that address only to email that contractor receipts for fuel the company delivered to them, sent through our email provider (Resend). Each receipt has an unsubscribe link. When someone unsubscribes, we keep a one-way fingerprint (hash) of the address so the company can’t send them receipts again, and we keep no copy of the address for that. A company can remove a contractor’s email at any time; it is deleted along with the company’s account.
• If your company uses the optional dispatch sheet, the job list your office enters or uploads (locations, contractors, equipment, AFE numbers, notes, and any attached PDF or photo) is stored privately for your company, shown only to the Fuelers it is assigned to, and kept on their phone until it is no longer current. Photos are stripped of location and other metadata when uploaded.

If you are a fueler (a mobile app user with an access code):

• The access code your company issued you, which signs the app in. It is stored as issued, so your company admin can show it to you again.
• Your operator name and truck number, as entered by your company admin or by you.
• Your profile settings: default fuel type and shift, and the fuel load on your truck if you enter one.
• A device identifier the app generates to bind your access code to your phone.
• The version and update of the app on your phone, and when it last checked in with our servers (recorded at most about once an hour). Your company admin can see these for each of their fuelers, so they can tell when a phone needs an app update.
• The fuel logs you create and submit: the date, shift, truck number, fuel type and your name, when the log was created and submitted, and each entry in it: unit or equipment number, location, description, contractor, and gallons. Your company can also attach an AFE (cost code) to an entry.
• If you ask for your data to be deleted from the app, the date you asked.
• Voice entry uses your phone's speech recognizer: on most Android phones, Google's, and on an iPhone, Apple's. On Android, when your phone has the speech model for your voice language, recognition happens on the phone. Otherwise, or if on-device recognition is turned off in the app's settings, or while the app is still checking for that model, your audio goes to that recognizer's online service. On an iPhone, iOS recognises your speech on the phone when it can for your voice language and on-device recognition is turned on in the app's settings; otherwise your audio may go to Apple's speech recognition service. The locations, contractors and unit numbers you've saved are given to the recognizer as hints only when it runs on an Android phone's own speech model, never to an online service. Fuel Relay does not record, store or receive your audio; only the text you confirm is saved, as part of the entry above.

On your phone (fuelers):

• The app keeps an encrypted working copy on your phone: your profile, your open and unsent logs, submitted logs from the last year, spoken entries waiting in your Check these list until you save or discard them, and the suggestions it offers from what you've typed before. Your employer's records are kept on our servers. Exported PDF and CSV files are deleted the next time you open or return to the app after 24 hours.
• Voice entry from the lock screen, which comes with the app's first store release, lets you say an entry without unlocking your phone. On an iPhone, Siri (Apple) hears the words; on Android, your phone's speech recognizer does (on most Android phones, Google's, which can send your audio to Google's online service). The app keeps only the words heard and when they were said, in a sealed list on your phone that can be added to while the phone is locked but read only after you unlock it and open the app. No location is recorded and nothing is sent to us. When you open the app, the words move into your Check these list, and nothing becomes an entry until you save it; words said more than 7 days earlier are deleted instead. Signing out clears both lists.
• If your code is deactivated, erased, moved to another phone or deleted, the app finds out when it checks your code with us, and acts once it has been told twice: on two separate openings, or an hour apart. If nothing is waiting to be sent, it then erases its data from your phone. If something is, it removes the code at once and keeps the rest (your profile, logs, history and suggestions) for at least 30 days, in case your code is switched back on; an erased code never is. That data is erased the next time the app is opened after the 30 days, once a second opening a day later confirms it. A phone left signed out with app data on it is erased the same way. You can erase the phone's data at any time from Settings, then Delete account & data, or from the sign-in screen.

Crash reports from the app, sent to Sentry when the app crashes or hits an error. These, the update check and the genuine-app check below are all the app sends about itself: no usage or session tracking.

• App version, operating system version, device model, language and region setting, screen size, free memory, battery level, and a random installation identifier created by Sentry's library. Reports from the app's own code are scrubbed on the phone before they are sent: access codes, email and IP addresses and web-address query strings are removed wherever they appear, and names, locations, trucks, voice transcripts and record IDs from the report's labelled fields. A crash inside the phone's own system software is reported by Sentry's library with the device details and a technical stack trace; we add no fuel data to it, but it doesn't pass through that scrubbing. The app sends no performance data.

App update checks, sent to Expo, which builds the app and delivers its updates:

• Each time the app starts, it asks Expo's update server whether there is a newer update for it, and downloads one if there is. The request carries the platform (Android or iPhone), the app's runtime version and release channel, which update the phone is running and which one it was installed with, any recent update that failed to start, and a random installation identifier that Expo's update library creates on the phone and sends with every check. If the update system failed to start the app the time before, the request also carries that error message. Expo sees your phone's IP address too. The check carries no access code, name or fuel data.

Genuine-app checks, which keep altered copies of the app out:

• On Android, the app is built to verify itself with Google Play Integrity. This switches on with the Play Store release. From then on, each request the app sends to our servers first asks Google Play on the phone for a signed verdict, and our servers send that verdict to Google to read. Google receives the app's name, version and signing certificate, a one-way code made from the request (never its contents), the signals Google Play gathers on the phone about whether the device and the app are genuine, and your phone's IP address. We receive Google's verdict, not the signals behind it.
• On an iPhone, the app verifies itself with Apple's App Attest. The first time it connects (and again if that key stops working, for example on a new phone), the phone creates a key in its secure hardware and asks Apple to vouch for it; Apple receives the app's identifier, the new key's public half and a one-way code of a challenge from our servers, and checks that the device is a genuine Apple device. After that, each request is signed on the phone without contacting Apple, and our servers check the signature. We keep the key's public half, Apple's receipt for it and when it was last used, without your name or access code; the IP address that asked for the challenge is deleted within about 10 minutes.

Error reports from the website and dashboard, sent to Sentry:

• When a page or the server hits an error: the page address without its query string, your browser and operating system, and technical details of the error. For about one in ten requests, timing data (how long each step took) is sent the same way. Email addresses, IP addresses, record IDs, access codes and query strings are removed first. Reports from your browser go to Sentry directly, so Sentry sees your IP address in transit; we don't include it in the report. That is all the website sends to Sentry: no session or usage tracking.

Website visits, on the website and the dashboard:

• The page you viewed, the site that sent you, your country, and your browser, operating system and device type, plus how quickly the page loaded. Vercel, our website host, collects this for us with Web Analytics and Speed Insights. They set no cookies and don't follow you to other sites; a visitor is counted with a one-way hash of the request that Vercel discards after 24 hours, so we can't tell who you are from it. Before anything is sent we remove the page's query string and any record IDs from its address. If your browser sends a Global Privacy Control or Do Not Track signal, none of this is sent.

Security and support records, whoever you are:

• The IP address and browser or app identifier (user agent) of every audited action, kept in the audit log next to who did what and when, for 90 days. Only we can see them, for security investigations: company admins see the audit log without IP addresses or user agents, including their fuelers' and their own.
• Supabase, our authentication provider, keeps its own log of dashboard sign-ins and account changes (the email address and IP address) for 90 days.
• Short-lived technical records: saved responses that let a repeated request be answered without doing it twice (24 hours), rate-limit counters with the IP address and, for the app, the access code (about 2 hours), and receipts for the app's synced changes (30 days).
• Our hosting providers, Supabase and Vercel, keep request logs (IP address, time, and the address requested) briefly, for operating their services (days, not months).
• Sign-in attempt counters. To stop password guessing, each sign-in, signup, password-reset or verification-email request is counted against a one-way keyed hash of the email address and of the IP address it came from. A password re-check inside the dashboard is counted against a keyed hash of your account's user ID instead, and a sign-in or password-reset request from a browser that has signed in to that address before against a keyed hash of the email address and that browser's random device identifier, and of the email address alone (see the __Host-fr_known_device cookie in section 11). How many browsers were newly marked as having signed in to an address is counted against a keyed hash of the email address too. The counters hold no address, IP or user ID in readable form and are deleted after about an hour (the count of newly marked browsers after a day).
• If we switch on bot protection (a CAPTCHA) for the website's sign-in, signup, password-reset and verification-email forms and the dashboard's password re-check, Cloudflare Turnstile checks your browser when you use them. Cloudflare receives your IP address and technical signals from your browser for that check only; our authentication provider, Supabase, receives a pass or fail.
• If you use the contact form on our website: your name, company, email address, your message, and the IP address and user agent of the request. The IP address and user agent are removed after 30 days; contact messages are kept for 12 months and then purged automatically. The message is also emailed to our support inbox, through our email provider, Resend.
• Emails we send you (receipts, security notices, and to an admin, a notice when one of their fuelers asks for deletion, with that fueler's name and truck number) pass through Resend, which keeps a log of each message.

• Location. The feature is off by default. If you turn on "Suggest location by GPS", Fuel Relay remembers roughly where (to about a metre) you saved entries for each location, on your phone only. These points are never sent to us. A point unused for 90 days is deleted, and turning the setting off deletes all of them.
• Voice audio. The microphone is used only after you tap the mic on a field, or start a voice entry from the lock screen. Recognition happens on your phone when it can; otherwise the audio goes to your phone's speech recognizer's online service (on most Android phones, Google's; on an iPhone, Apple's; section 2). It never comes to us: we receive the text you confirm, never the recording.
• Photos or camera data. The app does not use the camera.
• Biometrics. Fingerprint or face unlock, where enabled, is handled entirely by the phone's operating system. Biometric data is never transmitted to us and we could not read it if we wanted to.
• Contact information beyond what the admin provides. We do not read address books, call logs, or messages.

We use the data above strictly to provide the service:

• Syncing fueling entries between fueler devices and the admin dashboard.
• Producing the reports and exports admins run.
• Billing, through Stripe.
• Service emails such as receipts, payment alerts, and security notices.
• Support, when you contact us.
• Security: detecting abuse, keeping an audit trail, and investigating incidents.

We do not sell personal data, we do not use it for advertising, and we do not use it to train machine learning models.

A short list of vendors processes data on our behalf (hosting and website analytics, payments, email, error monitoring, backup storage, app builds, updates and distribution, genuine-app checks and speech recognition, and bot protection while the CAPTCHA is switched on). The full list, with each vendor's purpose, location, and data processing agreement, is published at fuelrelay.net/sub-processors. We notify admins by email before adding or replacing a sub-processor, as described in our Data Processing Agreement.

• Company accounts (the admin's account, the company's fuelers, logs and settings): kept until the account's owner deletes it. We never delete an account because it is unused or has no subscription. When an admin deletes the account from the dashboard or asks us to, the organization's data is scheduled for permanent deletion 30 days later. Any admin of the company can cancel the deletion from the dashboard before that date; signing in alone does not cancel it. If a subscription is cancelled, the data stays exportable for 90 days and deletion is then scheduled; starting a new subscription before that date clears the schedule.
• Prices and invoices (if your company uses them): Kept until the company’s account is deleted, with the rest of its data; turning prices and invoices off keeps them. An issued invoice can’t be changed or deleted, only voided, and is deleted with the account, so download any invoices you need to keep before deleting it. The history of changes to prices, contractors and invoice settings is kept for the life of the account too.
• A fueler's data: kept while their company's account exists, until the company's admin erases it (section 7). Every log a fueler submitted, including any sent back for correction, stays with the company, with the fueler's name and truck number on it, until the company deletes its account. Logs they started but never submitted are deleted when their data is erased.
• A past admin: When an admin leaves the company or is removed, they lose access to it at once and their login is deleted (a Fuel Relay staff login, or a login that is also an admin of another company, is kept), but the email address they joined with is kept with the company’s audit log, so the log can still show which admin did what. It is deleted when the company’s account is deleted.
• Invitations: When an admin invites someone, we keep the invited email address, who sent the invitation and when, and a one-way code of the invitation link — not the link itself, which exists only in the invitation email (kept for a limited time by our email provider, like every email it sends) or with the admin who copied it. An invitation works for 7 days; we delete our record of it 30 days after it is used, withdrawn or expires.
• Audit log: kept for the life of the account as a security record that no one in your company can edit. Its entries are never deleted, but personal details are removed from them: the IP address and user agent in each entry after 90 days, and the ones recorded for a fueler's activity when their data is erased (section 7). When the account is deleted, its audit log entries are anonymized (the acting user, IP address, and user agent are cleared, and so is the one-way code that links sign-in and password-reset attempts to the account's email address) and retained as security evidence.
• Sign-in log at our authentication provider: 90 days, and deleted with the account.
• Short-lived technical records: saved responses 24 hours, rate-limit counters about 2 hours (sign-in counters about an hour, and a day for the count of newly marked browsers), sync receipts 30 days.
• Crash and error reports: deleted by Sentry after up to 90 days.
• Website visit statistics: kept by Vercel without anything that identifies you; the one-way hash that tells visitors apart is discarded after 24 hours.
• Hosting request logs: kept briefly by Supabase and Vercel for operating their services (days, not months).
• Contact-form messages: purged 12 months after they are sent, and the copy in our support inbox is deleted on the same schedule. The sender's IP address and user agent are removed after 30 days.
• Emails we send: Resend keeps its log of each message on its standard schedule.
• Backups: the database is copied every night, encrypted, and each copy is kept for 30 days in private storage on GitHub. So data deleted from the service is gone from the backups too within 30 days. If we ever restore a backup, we first repeat every account deletion and every fueler erasure made after it was taken.
• Billing records: Stripe keeps the company's customer record (name, email, billing address and payment method details) with its invoices and payment history. We don't delete these when an account is deleted: they are kept as our accounting and tax records.

You can access, export, and delete your data:

• Access and export. Admins can export their organization's data (CSV, XLSX, PDF) from the dashboard at any time. For a copy of the personal data we hold about you specifically, email privacy@fuelrelay.net.
• Deletion. Admins can delete their account from the dashboard settings. This also cancels the subscription at the end of the current billing period. The organization's data is deleted 30 days later, as described in section 6. Any admin of the company can cancel the deletion from the dashboard before that date; signing in alone does not cancel it. An admin who leaves the company, or is removed, loses access to it at once and has their login deleted, unless they are also an admin of another company (then they keep it for that one). You can also request deletion by email at privacy@fuelrelay.net.
• If you are a fueler, your company is the controller of your data. Send requests to your company admin first (in the app: Settings, then Delete account & data, then Request deletion); we assist them in fulfilling every request, and you can always reach us at privacy@fuelrelay.net. Your company's admin can erase your data from the dashboard. That erases your access code (it stops working at once), the name, truck and fuel load on your profile, your phone's device identifier and app details, any logs you started but never submitted, our technical records about your phone, and the IP addresses and user agents recorded for your activity. Every log you submitted, including any sent back to you for correction, is not erased: it stays with your company, with your name and truck number on it, as its business record of fuel delivered. The app on your phone then erases its own copy as described in section 2, and you can erase it yourself at any time.

We respond to requests within 30 days.

Fuel Relay data is stored in the United States (AWS us-west-1, Northern California). Each sub-processor's location is listed at fuelrelay.net/sub-processors. Where we process personal data from the EEA, the UK, or Switzerland, transfers are covered by Standard Contractual Clauses or an equivalent lawful transfer mechanism with each sub-processor.

Fuel Relay is a workplace tool for businesses and is not directed at children. Admin accounts are for people aged 18 or over acting for a business, and companies may issue fueler codes only to people of legal working age (see our Terms of Service). We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, email privacy@fuelrelay.net and we will delete it.

Privacy questions: privacy@fuelrelay.net. Our data protection officer can be reached at dpo@fuelrelay.net.

If we change this policy, we will update the date at the top and notify admins by email before material changes take effect.

This section is our cookie policy. Fuel Relay uses only first-party cookies and browser storage, set by fuelrelay.net itself, and only to sign you in and keep you signed in, to keep your account and forms secure, or to remember a choice you made. None of it is used for advertising or analytics or to follow you to other sites, and we set no third-party cookies. So there is no cookie banner: there is nothing to accept or refuse.

Browsing the public pages (everything except signing in and the dashboard) sets no cookies at all. The visit statistics described in section 2 use no cookies and store nothing in your browser, and if your browser sends a Global Privacy Control or Do Not Track signal they are not collected. Sentry’s error reporting stores nothing in your browser either.

Cookies

• sb-…-auth-token: Keeps you signed in to the dashboard. Set by Supabase, our authentication provider, when you sign in; the dashboard’s own scripts read it, because its live updates need your session. Sent only over HTTPS. A long session can be split over several cookies with the same name and .0, .1 and so on at the end. How long: Up to 400 days, or until you sign out, which removes it.
• sb-…-auth-token-code-verifier: While you sign up or reset your password, ties the emailed link to the browser that asked for it. Set by Supabase. How long: Replaced at the next sign-up or password reset; never longer than the session cookie.
• fr_tz: Your browser’s time zone, so dashboard dates and “today” follow your calendar day, not the server’s. Set on the sign-in pages and in the dashboard. Sent only over HTTPS. How long: One year.
• fr_lang: The language you chose for the sign-in pages and the dashboard (English or Español), so they open in it. Set when you pick a language on the sign-in pages or in the dashboard. When you sign in, a login with no saved language takes this one; after that, the language saved with your login wins. Only our servers read it. Sent only over HTTPS. How long: One year.
• fr_reauth_until: Records that you re-entered your password for a sensitive action. How long: Five minutes.
• fr_csrf: Protects forms and dashboard requests from cross-site request forgery. Set in the dashboard. How long: One day.
• __Host-fr_known_device: Set when you sign in, and when you finish resetting your password from the emailed link. It marks this browser as one that has signed in to your account before, so sign-in and password-reset limits triggered by someone else on your network don’t lock you out. It holds a random device identifier and a signature, not your email address. At most five new browsers a day are marked this way for one account. How long: 180 days after your last sign-in, including after you sign out.
• fr_pending_email: Carries the email address you just signed up or signed in with to the “check your email” page, so it never appears in a web address. How long: Ten minutes.
• __Host-fr_email_link: Holds the link from a sign-up, password-reset or email-change email you opened, so the page that asks you to continue can use it only when you press Continue. Only our servers can read it, and it is never put in a web address. How long: One hour, or until you press Continue.
• __Host-fr_invite: Holds the code from the invitation link you opened, encrypted so that only our servers can read it, while you sign in or set a password to accept it. How long: One day, or until you accept or sign out.
• fr_company: Remembers which company you are working in, which matters when your login belongs to more than one. It holds that company’s ID and nothing else, and our servers check that you still belong to the company on every request. Set when you switch companies, open an emailed link to one of your companies, or accept an invitation. How long: Up to 400 days.
• fr_demo: Set when you open the read-only demo. It holds the number 1 and nothing else. If your demo session ends while you are looking around, it lets the site start a fresh demo session and keep you on the same page instead of showing the sign-in form. It gives no access by itself. Removed when you sign out or sign in to your own account. Only our servers read it. Sent only over HTTPS. How long: One week.

Two older names, fr_known_device and fr_invite, are only ever deleted: if your browser still holds one from an earlier version of the site, our servers remove it.

Local storage

The dashboard also keeps a few of your choices in your browser’s local storage. They stay on your device and are never sent to us:

• theme: Light, dark or same as your device, if you choose one in the dashboard. Every page reads it, so the site opens in your choice. How long: Until you clear this site’s data in your browser.
• fr-sidebar-collapsed: Whether you collapsed the dashboard’s side menu. How long: Until you clear this site’s data in your browser.
• fr-company: The company you last switched to and when, so the dashboard’s other open tabs switch with you. How long: Until you clear this site’s data in your browser.
• fr.printLogs.v1: The options you last chose for printing fuel logs. How long: Until you clear this site’s data in your browser.
• fr.invoicePdf.v1: The options you last chose for invoice PDFs, if your company uses prices and invoices. How long: Until you clear this site’s data in your browser.

If we switch on the bot protection (CAPTCHA) described in section 2, Cloudflare’s check runs in a frame served by Cloudflare on the sign-in forms. You can delete cookies and local storage at any time in your browser’s settings; if you delete the sign-in cookies you are signed out.