PumpWitness privacy policy
Effective 11 October 2026. PumpWitness is made by Geekopolis.
Short version: your fill-ups, cars and photos live on your phone. There's no account, no ads and no analytics. A few things have to go to outside services for the app to work, and they're all listed below.
What stays on your phone
- Your cars, their photos, and every fill-up: odometer, gallons, price, grade, station, notes, and the photos you took.
- A diagnostic log of what the app read from each photo, so a misread can be traced. It stays on the phone unless you send it (see "Sending us photos" below).
- Your Gemini API key, if you add one, and the name you type into "Who filled up". These are kept in the app's own storage and aren't included in backups.
We don't run a server that receives any of this, and we never see it.
Backups
If Android backup is on for your Google account, Android copies the app's database (your cars and fill-ups, not the photos) into your own Google account backup, so it can come back on a new phone. That's Android's backup, governed by Google; you can turn it off in your phone's settings.
Copies of your photos in the gallery
When you save a fill-up, PumpWitness copies its photos into your phone's gallery, in a folder called PumpWitness, as a record you can show if a repair is ever disputed. Each copy has the date, the GPS location and a one-line summary of the sale (car, station, gallons, grade, price, total, odometer) written into the photo's details. These copies are ordinary photos on your phone: if you use a photo backup service, it may back them up, and they stay until you delete them, even if you uninstall the app.
Camera
The camera is used only to take the photos you choose to take: the pump, the posted prices, the dashboard, and your car.
Location
When you log a fill-up, the app asks for your precise location, only while it's open, to work out which station you're at. Your coordinates are sent to:
- OpenStreetMap's Overpass servers (overpass-api.de, and overpass.private.coffee if the first is busy), to find the filling station nearest to you. These are public services run by others; they see the request and your IP address.
- Google Play services' geocoder, built into Android, to turn the coordinates into a street address.
The coordinates are also saved with the fill-up on your phone, so the app can recognise a station you've used before and track how its fuel performs. If you turn location off, the app still works; you type the station in.
Reading the photos
How the numbers are read off your photos depends on whether you've added a Gemini API key in Settings.
- Without a key, the photos are read on the phone, by Gemini Nano through Android's AICore on phones that have it, or otherwise by Google's ML Kit text recognition running on the phone. The photos don't leave your phone for this. These Google libraries send Google basic statistics about how the libraries themselves are performing (for example, which feature ran and how long it took), not your photos or your fill-ups.
- With your own key, the pump, prices and dashboard photos are sent to Google's Gemini API to be read, under your key and Google's terms for that API. Your location is not sent with them. On Google's free tier, Google says it may use what you send to improve its products. You can remove the key in Settings at any time.
Vehicle lookups
When you add a car, the year, make and model you type are sent to fueleconomy.gov, the US EPA's public fuel economy service, to suggest models and fetch the official MPG rating. Nothing about you is sent.
Sending us photos
The "Send these photos to the developer" button is for reporting photos the app misread. It only ever runs when you tap it. It hands the fill-up's photos, the numbers as you corrected them, and the diagnostic log to your phone's share sheet, pre-addressed to us; you choose the app, can change the recipient, and nothing goes until you send it. Nothing is sent automatically.
What we don't do
- No account or sign-in.
- No advertising and no ad identifiers.
- No analytics or crash reporting of our own, and no tracking. (Google's on-device reading libraries report their own usage statistics to Google, as described above.)
- We don't sell or share your data, because we don't receive it.
Deleting your data
Delete a fill-up or a car in the app and it's removed from your history. The photos it was logged from stay in the app's private storage as evidence until you uninstall; uninstalling removes everything the app stored. The gallery copies of your photos are yours and stay until you delete them from your gallery. To delete the Android backup copy, use your phone's backup settings or your Google account.
Children
PumpWitness is a fuel log for drivers and isn't aimed at children.
Changes
If this policy changes, the new version will be posted here with a new effective date.