CostPilot is a car cost log: fill-ups and charging, expenses, service reminders, and what the car costs per kilometre. This page says what data the app handles, where it goes, and how you remove it.
Cars, fill-ups, expenses, notes, reminders, and optional details such as a licence plate, VIN or purchase price are stored in a database on your device. Without an account, none of it leaves the phone.
Receipt photos you attach to an expense are kept on your device and are not uploaded.
You can use CostPilot without an account. If you sign in with Apple or Google, we receive an account identifier and the email address the provider shares (with Sign in with Apple this can be a private relay address). Sign-in is handled by Firebase Authentication, a Google service. We use it to recognise your account on another device and to keep your backup under it.
If you are signed in and use cloud backup, a copy of your log is stored in Google Cloud Firestore under your account: cars (including licence plate, VIN and purchase price if you entered them), fill-ups, expenses and reminders. Only your account can read or write it. It is there so you can restore your log or use it on another device.
CostPilot Pro is sold by Apple (App Store) or Google (Google Play); they take the payment, and we never see your card details. We use RevenueCat to check whether a subscription is active. RevenueCat receives a random app identifier (or your account identifier when you are signed in) and the store's purchase records for this app.
The app sends Google Analytics for Firebase events about how it is used (for example that the paywall was shown, or that a locked feature was tapped), and Firebase Crashlytics reports when it crashes. These contain a random app installation identifier, device and app information such as model, OS version and language, and an approximate location (country or region) worked out from the IP address. They are not tied to your account, and no advertising identifier is collected. They never contain what you logged: no amounts, odometer readings, stations or notes.
When you scan a receipt or an odometer, the text is recognised on your device with Google ML Kit. The photo is not sent to us. The camera and the photo library are only used when you choose to scan or attach a picture.
| Provider | What for | What it receives |
|---|---|---|
| Google (Firebase Authentication, Cloud Firestore) | Sign-in, cloud backup | Account identifier, email, the backup of your log |
| Google (Analytics for Firebase, Crashlytics) | Usage statistics, crash reports | App events, device and app information |
| RevenueCat | Subscription status | App or account identifier, purchase records |
| Apple, Google | Payment, sign-in | Handled under their own privacy policies |
These providers may process data on servers outside your country, including in the United States, under their own safeguards for international transfers.
In the app: Settings → Delete account. This permanently deletes your account, your cloud backup, and the log on that device. If you no longer have the app, see Delete your account.
Deleting your account does not cancel a subscription. Cancel it in your App Store or Google Play subscription settings.
You can ask for a copy of your data, have it corrected or deleted, object to its processing, or ask us to restrict it. Your whole log can also be exported from the app as a file at any time (Settings → Export all data). If you live in the EU or the UK you may also complain to your data protection authority.
CostPilot is meant for people who run a car and is not directed at children under 16.
If this policy changes in a way that matters, the date above changes and the app will point to the new version.
CostPilot is published by Nagy Dávid, who is the controller of the data described here. Privacy questions and requests: info@pixelnomadstudio.com