Privacy Policy

Effective 2 November 2026 Version 2026-11-02 Applies to the Hypermilers Android app and hypermilers.tech

This policy explains what personal data Hypermilers ("we", "us") collects, why we need it, who processes it, how long we keep it, and what you can ask us to do with it. It is written to be read alongside the Terms & Conditions and the Account Deletion Policy.

1. Who we are

Hypermilers is an independent software project that publishes the Hypermilers Android app and operates the hypermilers.tech website. For the purposes of Egypt's Personal Data Protection Law No. 151 of 2020 ("PDPL"), we are the controller of the personal data described in this policy.

Privacy contact: [email protected]. General support: [email protected].

2. Scope of this policy

This policy covers personal data processed when you:

• install and use the Hypermilers Android app;
• create an account with an email address and password, or continue with Google;
• purchase, renew, cancel or restore a Pro subscription through Google Play;
• contact support, or exercise a privacy right by email; and
• browse this website, which is a static site with no analytics or tracking scripts.

It does not cover Google Play itself, your Google Account, your device manufacturer, or any other service you use. Those services have their own privacy policies.

3. Personal data we collect

We collect only what the product needs. You choose what to enter, and much of the app works without the optional fields.

3.1 Account and identity data

Email address and account identifier

Required to create the account, sign in and recover access. The identifier is generated by our identity service; when you use Google it is derived from your Google account identifier.

Email verification status

Required to know whether the address has been confirmed.

Display name, language and unit preferences

Used to address you in the app and to render distances, currency formats and text direction correctly. Language and units are stored with the account so they follow you across devices.

Notification preference

Records whether you asked for reminders. Notification permission itself is granted in Android settings and can be revoked there.

Profile photo (optional)

If you upload one, the image and its technical metadata (content type, pixel dimensions, file size, revision) are stored so the app can display and replace it.

3.2 Vehicle and maintenance records you create

Vehicle details

Name or nickname, make, model, model year, engine code, platform, VIN (optional), currency, starting mileage and current mileage.

Service catalog and schedule

Service names, descriptions, fluid specifications, part numbers, mileage and time intervals, baselines and per-vehicle overrides.

Activities and history

Service, expense, refuel and odometer entries: dates, odometer readings, amounts, currency, quantities such as fuel volume, fill status, expense categories, notes of up to 2,000 characters, and the revision history of each entry.

Imported data

If you import data from another app, we process the file you select, store a summary of the import result and fingerprints that prevent the same record being imported twice.

3.3 Subscription and billing data

Pro subscriptions are sold and billed by Google Play. We never see or store your card number, billing address or Google Account password. To verify and maintain your entitlement we store:

• the plan and store-reported status (active, in grace period, on hold, canceled, expired, revoked or paused);
• the store product and base-plan identifiers;
• the Google Play purchase token and the obfuscated account identifier supplied at purchase time;
• start, expiry, acknowledgement and last-verification timestamps, and whether the subscription will auto-renew; and
• an audit trail of store subscription events for support and dispute resolution.

3.4 Technical data

Our servers keep bounded, rotated operational logs when the app calls the API: timestamp, HTTP method and request path, HTTP status, response time and the client IP address. Log files are size-limited and rotated, so older entries are discarded. We do not use third-party analytics, advertising SDKs, device fingerprinting or cross-app tracking. We do not collect your contacts, calendar, SMS, call logs, precise location, health data or installed-app list.

3.5 What we do not collect

• No advertising identifiers and no cross-site tracking.
• No push-notification token is registered with us; reminders are scheduled on your device.
• No camera, microphone or location data is requested by the app.
• No payment card data — billing is handled entirely by Google Play.

4. How and why we use your data

• Run your account. Authenticate sign-in, refresh sessions, verify email addresses and recover access.
• Provide the product. Store and display vehicles, schedules, history, fuel logs and statistics for your own account.
• Enforce plan limits. Decide whether your account may add another vehicle or read the statistics reports.
• Verify purchases. Confirm with Google Play that a subscription is valid, handle renewals, grace periods and refunds, and prevent a purchase token from being reused on another account.
• Keep the service safe. Detect abuse, protect accounts, debug failures and maintain availability.
• Support you. Answer your emails and resolve data or billing questions.
• Meet legal duties. Keep records required by accounting, tax and consumer-protection law.

We do not use your vehicle, service, fuel or cost records for advertising, profiling, machine learning model training, resale, or any purpose unrelated to showing them back to you.

5. Signing in with Google

If you choose Continue with Google, the app asks Google for a one-time authorisation code and sends it to our identity service, which exchanges it for an authentication token. From that exchange we receive your Google account identifier, your email address, whether Google has verified that address, and your basic profile name and picture.

• We request only the email and profile scopes. We do not request access to Gmail, Drive, Calendar, Contacts or any other Google service.
• We use this data solely to create and sign in to your Hypermilers account, as described in this policy.
• Hypermilers' use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not transfer Google user data to third parties, do not use it for advertising, and do not allow humans to read it except where you ask us to for support, where it is necessary for security or abuse investigations, or where the law requires it.
• You can revoke the app's access at any time in your Google Account's Third-party apps & services settings. Revoking access does not delete your Hypermilers account; use the Account Deletion Policy for that.

6. Legal bases for processing

Under the PDPL we rely on the following bases:

• Performance of our agreement with you — creating your account, storing and displaying your records, and providing a purchased subscription.
• Your consent — optional profile photo, optional notification reminders, and any optional field you choose to complete. You can withdraw consent at any time without affecting the lawfulness of earlier processing.
• Our legitimate interests — securing the service, preventing abuse and fraud, debugging, and keeping aggregate operational metrics. We balance these against your rights and never use them to justify advertising or data sales.
• Legal obligations — retaining transaction records required by accounting and consumer-protection law, and responding to lawful requests from competent authorities.

7. Who we share data with

We do not sell personal data, and we do not share it with data brokers or advertising networks. We share data only with the processors that make the service work, and only as far as needed:

• Google Play — to sell, verify and manage subscriptions, and to receive subscription lifecycle notifications. Google acts under its own terms and privacy policy.
• Our hosting and database infrastructure — servers that run the Hypermilers API and the PostgreSQL database holding your records.
• Object storage — for profile photos you upload.
• Email delivery — to send verification and password-recovery messages.
• Our identity service — to authenticate sign-in and manage sessions.
• Authorities — when we are legally required to disclose data, or when disclosure is necessary to protect someone's safety or our legal rights. Where lawful, we will tell you first.
• Successors — if the service is transferred to another operator, data may move with it under this policy; we will notify you before that happens.

Support staff access is limited to a small allowlist of operators. In the operator console they can see account identifiers, email addresses, plan state and support-relevant metadata. They cannot browse your vehicle, service, fuel or expense content through the console.

8. International transfers

Our servers and processors may be located outside Egypt. Where personal data is transferred abroad, we require the recipient to protect it to a standard consistent with the PDPL, and we use contractual safeguards for transfers to countries without an adequacy decision. Contact [email protected] for details of the safeguards that apply to your data.

9. How long we keep data

• Account and workspace data — retained while your account is active.
• After account deletion — access is disabled immediately and your identity cache is removed. Permanent erasure of your records is completed on request within 30 days. See the Account Deletion Policy for the full breakdown.
• Consent records — the version of the terms you accepted and when you accepted them are retained as proof of consent, including after account deletion.
• Subscription and transaction records — retained for the period required by Egyptian accounting and tax law, and for as long as needed to resolve a billing dispute.
• Operational logs — kept in size-bounded, rotated files and then discarded.

10. How we protect data

• All traffic between the app and our servers uses HTTPS with modern TLS.
• Authentication tokens are short-lived and stored in the Android keystore-backed secure storage, never in plain files.
• Every data request is authorised per account: a record belonging to one account is never readable with another account's token.
• Database access is limited to the application and migration roles, over a private network link.
• Store purchases are verified server-side against Google Play; a purchase token cannot be replayed onto a second account.
• Access to production systems is restricted to operators, and credentials are never shipped inside the app.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the competent Egyptian authority as required by the PDPL.

11. Your rights and choices

Subject to the PDPL, you may ask us to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data — most fields are editable directly in the app;
• Delete your account and records, using the app or the deletion route;
• Restrict or object to processing, including processing based on our legitimate interests;
• Receive a copy of data you provided, in a structured, commonly used format;
• Withdraw consent for optional processing such as the profile photo or reminders;
• Complain to the Egyptian Personal Data Protection Center if you believe we have handled your data unlawfully.

Email [email protected] from the address registered to your account. We answer verified requests within 30 days and may ask for information needed to confirm that the request comes from you. Exercising your rights is free.

12. Children

Hypermilers is intended for adults. You must be at least 18 years old to create an account or purchase a subscription. We do not knowingly collect personal data from children. If you believe a child has created an account, email [email protected] and we will delete it.

13. Cookies and this website

hypermilers.tech is a static website. It sets no cookies, loads no third-party scripts, fonts or trackers, and does not profile visitors. Our hosting provider may keep standard access logs (IP address, timestamp, requested URL, user agent) for security and capacity purposes; those logs are short-lived and are not combined with app accounts.

14. Changes to this policy

We may update this policy when the product changes or the law requires it. The effective date and version at the top of this page always identify the current text. If a change materially affects how we use your data, we will ask you to accept the updated documents in the app before you continue, and the version you accepted is recorded against your account.

15. Contact us

Privacy questions and rights requests: [email protected].
Product and billing support: [email protected].
You can also read the Support page for response expectations.