Privacy policy

Who we are

TREX by Bytecraft Studio is operated by Issarapong Poesua, the data controller under Thailand's Personal Data Protection Act B.E. 2562 (PDPA), at 1655/46 Phaholyothin Road, Phayathai, Phayathai, Bangkok 10400, Thailand. You can reach us at [email protected].

TREX is made for people in Thailand, and the apps aren't offered in the European Union or the European Economic Area, so this policy follows the PDPA.

The short version

• No accounts, no ads and no tracking.
• The apps count anonymous usage, such as how often they're opened, so we know how many people use TREX.
• Your fill size stays on your device, and so do your fuels unless you turn on price alerts.
• We only receive personal data when you send us feedback, and what the app needs to deliver price alerts to your phone.
• Every feedback item is deleted within 18 months, and a price-alert registration 90 days after you last open the app.

What stays on your device

In the apps, My fuels, your fill size and your language are saved on your phone. On the website, only My fuels is saved, in your browser's local storage. They're never sent to us, except that your My fuels list is attached when you send feedback from the app, and your language, plus the fuels you choose for price alerts, go with your phone's alert registration (see below).

Deleting the app or clearing your browser's site data removes them.

What we receive when you send feedback

Sending feedback is optional. When you send it from the app, we receive:

• Your message and the type of feedback you picked.
• Your email, only if you type it in.
• An install ID: a random code the app creates once, on your device. It isn't linked to your name, phone number, or Apple or Google account, and it isn't your advertising ID. We can't use it to find out who you are.
• Your device model, operating system version, app version and build, and language setting (locale).
• The screen you sent it from, and your My fuels list.
• For a wrong-price report: the price TREX showed, its label and time, and the price you saw at the pump.
• A hash of your IP address: we turn your IP address into a one-way code with a secret key (HMAC) and keep only that code, never the IP address itself.

What we receive for price alerts

So that price alerts can reach your phone as soon as you turn them on, the app registers the phone with us once you allow notifications. It sends:

• The same install ID the app uses for feedback.
• A push token: an address Google's Firebase Cloud Messaging (FCM) gives this app on this phone, so a notification can reach it. It isn't your advertising ID, and it isn't linked to your name, phone number, or Apple or Google account.
• When the app starts, Google's Firebase software in it creates a Firebase installation ID for this app on this phone and sends it to Google with basic app and device details (such as app and system version). Google uses it to issue and refresh the push token. This happens whether or not price alerts are on, and it isn't your advertising ID.
• Your platform (iOS) and your language.
• The fuels you want alerts for, only while price alerts are on and notifications are allowed. Otherwise the list is empty and nothing is sent to you.
• When the phone was first registered and when you last opened the app.
• A hash of your IP address (HMAC, as for feedback), to limit how often one network can register. It's kept for one day.

We use these only to send you the alerts you turn on. The alert itself carries the price change; your phone works out what it means for your fill, so your fill size never leaves the phone.

Turning price alerts off in the app stops them and deletes your phone's registration at once. Turning off notifications for TREX in your phone's settings stops them at once, and the registration is deleted the next time you open the app. Uninstalling the app also ends them, and the registration is deleted as described below.

App usage statistics

When you open the iOS app, it sends anonymous usage signals to TelemetryDeck: that a session started and how long it lasted, the app version, operating system version, device model and language setting. It also sends which screens you open and which features you use, for example: alerts turned on or off and alert prompts answered, the Until prices change Live Activity and its buttons, opening the app from a widget, the Control Center control, Siri or Spotlight, changes to your usual fill and language, how many fuels you follow, whether notifications and Live Activities are allowed, and a short code when prices fail to load. It never includes the prices you pay, your location or anything you type. The website doesn't send these.

Each device is represented by a random code that's hashed on the device before it's sent. It isn't the install ID used for feedback and it isn't your advertising ID, so we can't link these statistics to your feedback or to you. The apps don't send which fuels or brands you look at.

Why we use it

• To read your feedback and reply, if you gave an email.
• To fix wrong prices and bugs. The device and app details tell us what went wrong.
• To prevent spam and abuse, and to limit how many messages one device or network can send. That's what the install ID and IP hash are for.
• To send the price alerts you turned on, for your fuels and in your language. That's what the push token, fuels and language are for.
• To know how many people use the apps, and on which versions and devices, so we can decide what to support. That's what the anonymous usage statistics are for.

Lawful basis

We rely on legitimate interests (PDPA section 24(5)): running a reliable price service, sending the price alerts you turn on, fixing the errors you report, keeping the feedback form and alert sign-up free of abuse and knowing how much the apps are used. We keep only what we need, and you can object at any time.

We only email you to reply, and only if you gave us your email. We never use feedback for marketing.

Who processes it, and where

Feedback is stored in a Supabase database, and the website and API run on Vercel. Both process the data for us in Singapore. That is a transfer outside Thailand, so as PDPA section 29 requires, it is covered by appropriate safeguards such as standard contractual clauses in our data processing agreement with each provider.

App usage statistics are processed by TelemetryDeck in the European Union, under the same kind of safeguards.

Price alerts are delivered by Google's Firebase Cloud Messaging: we send Google the push token and the price change, and Google delivers the alert to iPhones through Apple's Push Notification service (APNs). Google also receives the Firebase installation ID described above. Google and Apple process this outside Thailand, including in the United States, under the same kind of safeguards in their data processing terms.

Our hosting providers briefly log technical data such as IP addresses and request times, for security (see how long below). We don't sell or share feedback with anyone else.

How long we keep it

• The IP hash: deleted after 30 days.
• Feedback marked as spam: deleted 30 days after it's marked.
• Your email and install ID: removed 180 days after your feedback is closed.
• Every feedback item, whatever its status: deleted 18 months after you sent it.
• Price-alert registrations: deleted 90 days after you last open the app, straight away when you turn price alerts off or if Google reports the push token no longer works, or when you ask us.
• The install ID and IP hash recorded each time the app registers: deleted after one day.
• Vercel and Supabase request logs (including IP addresses): deleted within 7 days.
• App usage statistics: kept by TelemetryDeck in anonymous form, with no IP address, for as long as we use it. If we stop, we delete the app's data there.
• Copies of the public price feeds we collect (EPPO and PTT OR): they contain no personal data, and we keep them as a record of where each price came from.

Your rights

Under PDPA sections 30–36 you can ask us to:

• Give you a copy of your data (access).
• Correct it.
• Delete it.
• Stop using it (objection).
• Pause how we use it (restriction).
• Give it to you in a machine-readable format, or send it to someone else (portability).

Email [email protected] with the email address you used. If you didn't leave one, tell us roughly when you sent feedback and what it said, so we can find it. We reply within 30 days. To delete your price-alert registration, just turn price alerts off in the app; you don't need to ask.

If you're not happy with our answer, you can complain to the Office of the Personal Data Protection Committee (PDPC), Thailand's data protection regulator, at complaint.pdpc.or.th or on 02 111 8800.

Security

Data is encrypted in transit (HTTPS) and at rest by our providers. Only a few TREX team members can see feedback, after signing in, and the database restricts access as well.

Cookies

The website and apps use no cookies. The only cookies are for TREX team members signing in to the admin area.

No ads or tracking

TREX has no ads and doesn't track you across other apps or websites. It doesn't use your advertising ID and doesn't share data with advertisers or data brokers. The app usage statistics described above are anonymous and only used to improve TREX.

Children

TREX is a general information service and isn't made for children. We don't knowingly collect children's data. If you think a child has sent us personal data, email us and we'll delete it.

Changes to this policy

When we change this policy, we update the version and date at the top. We announce significant changes in the apps and on the website, and if we ever want to use data in a new way, we'll describe it here before we start collecting it.

Contact

Issarapong Poesua (Bytecraft Studio) · 1655/46 Phaholyothin Road, Phayathai, Phayathai, Bangkok 10400, Thailand · [email protected]