Antlia shows retail fuel prices for Cyprus. It is run by Achilleas Eftychiou, an independent developer based in Cyprus, who is the data controller for the purposes of the EU General Data Protection Regulation (GDPR) as it applies in Cyprus. This policy explains what the Antlia app and its backend do with information. Antlia is built to collect as little as possible.
We don't know who you are, but some data is still personal
Antlia has no sign-up, login, email or password. We don't know who you are: there is no name, email or account. The identifiers we hold — a random device ID, a push token (if you turn on alerts), and your IP address while a request is handled — still count as personal data under the GDPR, and we treat them that way. On first launch the app registers an anonymous device: the server stores a random device ID, the platform (iOS or Android), the app version, timestamps, and your subscription tier.
Your location stays on your phone
Station lists are fetched for the whole island. Distances, sorting by distance and "which district am I in" are all computed on your device. Your coordinates are never sent to, stored by, or logged by our servers.
Route finder (Antlia Plus): the start and destination you choose are sent, for that single request only, to our own routing server to calculate the route. They are not stored or logged.
Saved places you create for the route finder are stored only on your phone.
Directions open your device's maps app with the station's coordinates only.
What the backend receives
The device record described above (random device ID, platform, app version, timestamps, tier).
Price reports: if you report a price that looks wrong, we store the station, fuel, reason and (optionally) the pump price. Reports carry no device ID and no location.
Price alerts (Plus): the rules you create (a district or station, a fuel, a price) and, if you enable notifications, your device's push token — used only to send the alerts you asked for.
Weekly price summary (free, optional): if you turn it on, a flag on your push-token record marks you in. The summary is the same generic island-wide figures for everyone — no personal data and no location.
Subscription status for Antlia Plus (see "Recipients and transfers").
Technical request data: like any internet service, our servers and the network provider in front of them briefly process your IP address and basic request metadata needed to deliver and secure each request. Our application logs record the request route, status and a request ID, and the device ID at the moment of registration; they do not record IP addresses, locations or request contents.
What stays only on your device
Favourites, your fill-up log, app settings, saved places and the offline price cache live only on your phone (and in your own device backups, which we do not control or access). We never receive them.
Legal bases (GDPR)
Legitimate interests — running, maintaining and securing the service and preventing abuse (the device record, technical request data, price reports).
Performance of a contract — providing Antlia Plus and its features to subscribers (subscription status, alert rules).
Consent — sending push notifications, and crash diagnostics (Sentry). Both are off by default and turned on by you in the app; you can withdraw at any time in the app or your device settings, without affecting anything processed before.
Recipients and transfers
Hetzner (Germany, EU): hosts our server and database. Your data for the core service stays on an EU server; this is not an international transfer.
Cloudflare: routes and protects our API traffic and processes your IP address to do so, as our processor. Where this involves processing outside the EEA, it is covered by the EU Standard Contractual Clauses.
RevenueCat (United States): processes your random device ID, purchase and subscription records and technical data such as IP address, as our processor, under the EU Standard Contractual Clauses.
Apple / Google: process Antlia Plus purchases and deliver push notifications (APNs / FCM) as independent controllers under their own terms and transfer safeguards.
Expo (United States): relays alert notifications to Apple/Google as our processor, under the EU Standard Contractual Clauses.
Sentry (United States): crash reporting is off by default; if you turn it on in Settings and the app then crashes or hits an error, it sends a diagnostic report — the error and its stack trace, your device model, OS and app version, and your random device ID — to Sentry, as our processor under the EU Standard Contractual Clauses. These reports carry no name, no location and no content you entered; they are used only to find and fix bugs.
OpenStreetMap Foundation: on Android, map tiles are requested from the public OpenStreetMap servers as you browse the map, which reveals the map area and your IP to them. On iOS, Apple Maps draws the map.
Antlia uses no analytics, no advertising and no tracking SDKs (crash diagnostics via Sentry are used only to find and fix bugs, not to track you, and carry no profiling, session replay or advertising data), declares no tracking to Apple or Google, and makes no automated decisions that produce legal or similarly significant effects.
How we protect data
All traffic between the app and our servers is encrypted in transit (HTTPS/TLS). The backend follows data-minimisation and least-privilege principles, keeps secrets out of logs, and restricts access to the server. No system is perfectly secure, but we hold so little that there is little to expose.
How long data is kept
A device record, and its alert rules and push token, are deleted after about 90 days without use. This happens whether or not you have a subscription; your subscription itself continues with Apple or Google regardless.
Price reports are kept about 180 days.
Application logs rotate by size and are short-lived.
Crash diagnostics are kept by Sentry under its own retention policy (about 90 days).
Purchase and subscription records are kept by RevenueCat, Apple and Google under their own policies, which can be longer than the periods above.
Price history shown in the app is public market data, not personal data.
Deleting your data
Deleting the app removes the data stored on your phone. Two things to know:
On iOS, the app keeps its anonymous login token in the system Keychain, which can survive reinstalling, so a reinstall may resume the same device identity.
The server-side device record (and any alert rules and push token) is deleted automatically after about 90 days of inactivity.
To delete your data sooner, use Settings › Data & privacy › Delete my data in the app: it erases the server-side device record together with its alert rules and push token straight away. This does not cancel any subscription — a subscription is managed by Apple or Google and is cancelled in your store account. You can also email axilleasftq23@gmail.com with the device ID shown in the app (Settings › Data & privacy › Device ID) and we will delete the record for you.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw any consent you gave. To exercise a right, email axilleasftq23@gmail.com and include the device ID shown in the app so we can match the request. You also have the right to lodge a complaint with the Cyprus supervisory authority, the Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy).
Children
Antlia is not directed at children and does not knowingly collect information from them.
Changes
We may update this policy; the effective date above will change and material updates will be noted in the app.
Contact
Achilleas Eftychiou, an independent developer based in Cyprus.