Privacy policy

Last updated: 14 August 2026

This policy describes how we process data on the website wattrate.eu, the API at api.wattrate.eu and in the WattRate mobile apps for iOS and Android (together: the “Service”). By using the Service you accept the rules below. Use of the Service is also governed by the Terms of use.

1. What data we process

1.1. Mobile app

• GPS location — processed only after you grant permission in the operating system, to find nearby stations. Coordinates are sent to the API to calculate distance; we do not build a trip history or a movement profile.
• Technical data — IP address, device type, OS version, session identifiers — for security, diagnostics and protection against API abuse.
• Data stored on the device — favourite stations, vehicle profile, filter preferences — kept on your device unless account sync is enabled (see section 3.2).
• Premium purchase data — transaction identifier and subscription status processed by the Apple App Store or Google Play; we do not receive payment card numbers.
• App analytics (Firebase Analytics) — usage events (e.g. screen view, filter choice, Premium purchase), device model, OS and app version. We do not collect your name, email or precise GPS location in analytics — location is used only to find stations and is not sent to Firebase. Firebase may assign a pseudonymous app-install identifier.
• Crash reporting (Firebase Crashlytics) — if the app crashes, a diagnostic report is sent (stack trace, device model, OS and app version). It is used only to fix bugs. It does not include user-entered content or precise GPS location.
• Push notifications (Firebase Cloud Messaging) — an FCM token linked to a local device identifier (`X-Device-ID`), to deliver Premium alerts (e.g. when an occupied stall becomes free). The token is sent to our API and to Google FCM.

In the current version the app does not require an account — we do not collect your first name, last name, email address or phone number unless you contact us yourself or voluntarily provide an email in a price-report form.

1.2. Website wattrate.eu

• Google Analytics — visit statistics (e.g. page views, traffic source, approximate location at country/region level). The IP address is truncated (anonymize_ip). The script loads only after consent in the cookie banner (“Accept analytics”). Measurement ID: G-4WT1DLYV9C.
• Cookies — essential cookies from the hosting provider (security, CDN) and — after consent — Google Analytics cookies. We store your choice locally in the browser (wattrate_cookie_consent).
• Technical data — IP address, browser type, date and time of the request — in server and CDN logs for security purposes.

1.3. Charging-station data

Data on station locations, operators and charge points come from AFIR National Access Points, in particular: EIPA / Office of Technical Inspection (Poland), NDW (Netherlands), MobiData BW (Germany), IRVE (France), E-Control (Austria), NDIC (Czechia), NAP AFIR SR (Slovakia), as well as publicly available operator tariffs. Foreign-exchange rates come from NBP and the European Central Bank. Some datasets are published under CC BY. These are not drivers’ personal data.

2. Legal basis (GDPR)

• GPS location: Art. 6(1)(a) GDPR (consent in the operating system).
• Technical data and API security: Art. 6(1)(f) GDPR (legitimate interest — operating and protecting the Service).
• Google Analytics (website): Art. 6(1)(a) GDPR (consent in the cookie banner).
• Firebase Analytics (mobile app): Art. 6(1)(f) GDPR (legitimate interest — improving the product based on anonymised usage statistics, without ad profiling and without IDFA).
• Firebase Crashlytics (mobile app): Art. 6(1)(f) GDPR (legitimate interest — diagnosing and fixing app crashes).
• Premium subscription: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligations, e.g. accounting).
• Email contact: Art. 6(1)(f) GDPR (responding to an enquiry).

3. Infrastructure and processors

We use external providers who may process data on our behalf as processors (Art. 28 GDPR) or as independent controllers:

3.1. Currently used

• Google LLC (USA / EU) — Google Analytics (wattrate.eu statistics, after consent), Firebase Analytics (iOS/Android app statistics) and Firebase Crashlytics (crash reports). Policy: policies.google.com/privacy
• Cloudflare, Inc. (USA / EU) — hosting of wattrate.eu (Cloudflare Pages), CDN, DDoS protection, tunnel to the API (Cloudflare Tunnel). Policy: cloudflare.com/privacypolicy
• Hetzner Online GmbH (Germany / Finland) — API server, PostgreSQL/PostGIS database, Redis, import processes from AFIR access points.
• AFIR National Access Points — public charging-infrastructure registries (including EIPA/UDT, NDW, MobiData BW, IRVE, E-Control, NDIC, NAP AFIR SR).
• Apple Inc. / Google LLC — app distribution and Premium purchases in the App Store / Google Play.

3.2. Conditional or planned

The following services may be introduced depending on infrastructure needs. We will announce material changes on this page:

• Vercel Inc. (USA / EU) — if part of the Service (e.g. the marketing site or internal tools) is hosted on Vercel. Policy: vercel.com/legal/privacy-policy
• Supabase Inc. (USA / EU) — if user authentication or sync of favourite stations and vehicle profile across devices is enabled. Policy: supabase.com/privacy
• Google Firebase Cloud Messaging (FCM) — push notifications (including the Premium free-stall alert). We process an FCM device token linked to a local device identifier. Policy: firebase.google.com/support/privacy
• Google AdMob — ads in the mobile app (monetisation). Before showing ads we will use a consent mechanism (CMP) that meets Apple ATT and Google UMP requirements.

4. Transfers outside the EEA

Some providers (including Google, Cloudflare, Vercel, Supabase) may process data in the United States or other third countries. This is based on EU Standard Contractual Clauses (SCCs) or other mechanisms provided by the GDPR. Details are in each provider’s privacy policy.

5. Retention periods

• API server logs: up to 30 days.
• Google Analytics data (website): according to the GA account settings (14 months by default).
• Firebase Analytics data (app): according to the Firebase project settings (14 months by default).
• Firebase Crashlytics reports: according to the Firebase project settings (up to 90 days by default).
• FCM token and free-stall alerts: until the alert is turned off / the app is uninstalled, or at most 12 months from the token’s last activity.
• Email correspondence: up to 3 years after the matter is closed.
• Local app data: until the app is deleted from the device.
• User-account data (if introduced): until the account is deleted or consent is withdrawn, subject to legal retention duties.

6. Advertising and monetisation

WattRate is free in its basic version. We plan an optional Premium subscription and — in the future — discreet ads (Google AdMob). Ads will be shown only after the required consent. We do not sell personal data to third parties.

7. Your rights

You have the right to:

• access your data and receive a copy,
• rectify or erase data,
• restrict processing,
• data portability,
• object to processing,
• withdraw consent at any time (without affecting the lawfulness of processing before withdrawal),
• lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland, or with your local supervisory authority in the EU.

To exercise your rights, write to: hello@wattrate.eu

8. Security

We use TLS (HTTPS) encryption, restricted server access, regular software updates and data minimisation. The API is not openly available without limits — we use rate limiting and monitoring.

9. Children

The Service is not directed at people under 16. We do not knowingly collect children’s data.

10. Changes to this policy

We may update this policy as the Service evolves (e.g. after introducing user accounts, ads or new providers). We will announce material changes on this page and — if needed — in the app. The last-updated date is shown at the top of this document.

Terms of use · Back to the homepage