Pikeworks
Privacy policy
Last updated 29 September 2026.
Fillo is made by Pikeworks, a sole trader in Northern Ireland, which decides how the information in this policy is used (the controller). Fillo shows fuel prices in the UK and the Republic of Ireland. It was built to need as little about you as it can. This is what it keeps, where, and why.
In short
- Your location stays on your phone and is never sent to Pikeworks. A near home alert sends only a rough area, about 5 km across, and only if you set one.
- There is no account. Your copy of the app gets a random install token instead.
- Reports and prices you add are anonymous to everyone else. Reports are deleted within a few days, and the link from a price to your install is removed after 30 days.
- There are no adverts, no analytics and no tracking.
- Delete my data, in Settings, erases everything the server holds for your install.
Your location
Fillo asks for your location only while you are using it, never in the background. Android lets you give it your approximate location instead, and it still works.
The app downloads the prices for the whole of the UK and the Republic and ranks them on your phone. So your location is never sent to Pikeworks for a search, the list, the map or the widget. If you would rather not share it at all, type a town or postcode instead.
Two things outside Fillo can see a place, and each works under its own privacy policy:
- Place search. When you type a town or postcode, your phone's own place search looks it up: Google's on Android, Apple's on iPhone. If it cannot find a UK postcode, the app asks postcodes.io, a free public postcode service, with only that postcode.
- The map. It is drawn by Google Maps on Android and Apple Maps on iPhone, which load the map for the area on screen from Google or Apple. On Android, Google's map also tells Google how the map is used (panning and zooming) and about any crash inside it, with an id of its own.
When you tap Take me there, the sat nav app you chose (Google Maps, Apple Maps, Waze or another) opens with the station's position, and that app's own policy applies from then on.
Adding a price in the Republic is only allowed within 500 metres of the station. Your phone checks the distance itself and sends only "nearby", never where you are.
Near home alerts
If you set an alert for fuel near home, the app sends a rough area with it: a square about 5 km across, never your exact position or address. It is kept with that alert and deleted when you delete the alert. Alerts for your favourite stations send only which stations, and no area at all.
Your install token
Fillo has no accounts. Instead, the Fillo server gives your copy of the app a random install token. It is made of random numbers and says nothing about you or your phone. The server keeps only a scrambled form of it, which cannot be turned back into the token.
With it the server keeps the date it was made, whether you are on Android or iPhone, the app's version, and the last day your copy of the app used it. It lets you undo a report, change your alerts, and keeps the limits fair, such as one report per station an hour.
For prices added in the Republic, the server also keeps a trust score for each install. It starts low, goes up when other drivers confirm your prices, and goes down when one is contradicted. If it falls very low, prices from that install are no longer shown. If an install keeps sending false reports or prices, I can mark it so they are no longer accepted. Nothing else is decided from either.
Reports and prices you add
Reports (wrong price, closed, out of this fuel, does not sell this fuel, wrong details) are stored with the station, the kind of report, the fuel if you picked one, the time and a link to your install. Other drivers see only a count and a time, such as "2 drivers: closed, 40 min ago". A report stops showing after a few hours, or up to a day if others confirm it, and is deleted two days after that.
Prices in the Republic are stored with the station, the fuel, the price, the time and a link to your install. Your answers to "Still €1.729? Yes / No" are stored the same way and deleted after 30 days. Other drivers see the price and whether it is new or confirmed, never who added it. A driver's price stops showing after 14 days.
After 30 days the link from a price to your install is removed. The price keeps the trust score it was sent with, but nothing ties it to anyone. There is no free text anywhere in reports or prices, so nothing you send can hold a name or a message.
Official UK prices are never changed by a report. Fillo can open the government's own form so you can report a wrong price there; that form is a GOV.UK service under its own privacy notice.
Alerts and your push token
An alert rule holds the stations or the rough area it watches, the fuel, the price or drop you asked for, and your quiet hours. To deliver alerts, your phone gives the app a push token from Google's Firebase Cloud Messaging on Android (with Google Analytics switched off) or Apple's push service on iPhone, and the app sends it to the server. Alerts reach your phone through Google or Apple, and hold only the fuel, the price, the station and its town, how much the price dropped and when the station closes.
The push token is deleted when you turn alerts off, when Google or Apple say it no longer works, or with Delete my data.
Feedback
Feedback is only sent when you write it and tap Send. It contains what you type, a way to contact you if you choose to give one, and, so I don't have to ask, the app's version, whether you are on Android or iPhone, the model of phone, the screen size, the language and the fuel you have chosen.
It goes to a server Pikeworks runs in the UK. A copy is posted to a private Discord channel that only I can read, so I see it straight away; Discord is a company in the United States. Feedback is kept until it has been dealt with and deleted within six months after that, Discord copy included. It is not linked to your install token.
Purchases
Fillo Plus and the tips are one-off purchases through Google Play or the App Store. They handle the payment, and I never see your name, email address or card details. RevenueCat, a company that checks store purchases for app makers, receives the store's receipt and a random id it makes for your copy of the app, so Fillo can tell whether you have Plus and restore it on a new phone. That id is not linked to your install token.
What Fillo does not do
There are no adverts, no analytics, no crash reporting service and no tracking of any kind. Nothing is sold, and nothing is shared for advertising. (Google's map on Android does its own reporting, as above.)
Adverts for people who have not bought Plus may come in a later version. If they do, you will be asked for your choice first wherever the law requires it, and this policy will be updated before that version is released.
Where it is kept
The Fillo server runs on Cloudflare, and its database is kept in Western Europe. Cloudflare sees your network address when the app connects, as with any website. The server does not store it. To limit how many install tokens one network can make in a day (three), it keeps a scrambled form of the address that cannot be turned back, and deletes it after two days. Cloudflare's own record of requests to the server, which I use only to find faults, is kept for three days.
Downloading prices, reports and a station's price history needs no token. Those requests are the same for everyone and say nothing about who is asking.
Cloudflare, Google, Apple, RevenueCat and Discord are companies based in the United States. Where they handle information outside the UK or the European Economic Area, it is protected by the safeguards UK GDPR and the GDPR require, such as the UK and EU arrangements with the United States or standard data protection clauses.
How long it is kept
| What | Kept until |
|---|---|
| Your install token, and the date, platform, version and last use with it | You use Delete my data, or 180 days after your copy of the app last contacted the server |
| Alert rules, and the rough area of a near home alert | You delete the alert, use Delete my data, or 180 days unseen |
| Your push token | You turn alerts off, it stops working, you use Delete my data, or 180 days unseen |
| The trust score for prices in the Republic | It goes with the install token |
| Reports | Two days after they stop showing, or straight away with Delete my data |
| Your answers to "Still the same price?" | 30 days, or straight away with Delete my data |
| The link from a price to your install | 30 days, or straight away with Delete my data |
| A driver's price in the Republic, shown to others | 14 days at most |
| The scrambled network address | Two days |
| Cloudflare's record of requests | Three days |
| Feedback | Dealt with, then deleted within six months |
| The database's restore history at Cloudflare | Up to 30 days, so deleted data is gone from it within 30 days |
Your choices, favourites, saved setups, home and settings are kept on your phone only.
Permissions
- Location, only while you use the app, to find prices near you. You can say no and type a place.
- Notifications, only if you set an alert.
- Internet, to download prices and send what you choose to send.
Fillo never asks for your location in the background, your contacts, your photos, the camera or the microphone.
Children
Fillo is made for drivers. It is not aimed at children.
Deleting your information
In the app, open Settings, then Delete my data. That erases, straight away, your install token and everything tied to it on the server: your alert rules, any rough area, your push token, your trust score, your reports and answers, and the link from any price you added. It also clears your choices, favourites, setups and settings on the phone. Uninstalling the app removes everything kept on your phone too.
Because there are no accounts, I cannot find your information from your name or email address. Delete my data is the sure way. If you cannot open the app any more, whatever is tied to your install is deleted by itself 180 days after it was last used.
Your rights
Under UK GDPR, and the GDPR in the Republic of Ireland, you can ask for a copy of the information held about you, and ask for it to be corrected, deleted or no longer used. Fillo relies on providing the service you asked for (alerts, purchases, feedback) and on Pikeworks' legitimate interest in keeping prices accurate and the service safe from abuse (the install token, reports, prices and trust scores). You can object to that at any time by using Delete my data.
You can complain to the Information Commissioner's Office in the UK at ico.org.uk, or the Data Protection Commission in Ireland at dataprotection.ie.
Changes
If this policy changes, the date at the top changes and the new version replaces this one. Anything new Fillo sends will be on this page before the version that sends it is released.
Contact
Email fillo@pikeworks.co.uk.