Beta privacy notice · Effective October 4, 2026

Privacy

WorthStop is operated by BZ Labs. This notice explains how the WorthStop website and mobile app handle personal information. Questions and verified privacy requests can be sent to team@worthstop.app.

Information we collect

Account and preference information

If you create an account, we process your name, email address, user identifier, sign-in and verification information, acceptance timestamps and account status. A third-party identity provider may share the basic identity information needed to create or access your account; WorthStop does not receive the password you use with that provider. You may also save vehicles, fuel or charging details, memberships, trip preferences, favorites and routes.

Vehicle settings may include year, make, model, version, estimated fuel economy, tank capacity, battery capacity and consumption. Catalog search helps you select a vehicle without providing a vehicle identification number (VIN). When you confirm a vehicle in setup or vehicle settings, we remember it for your next trip and save it in your account garage if signed in, or on this device if using WorthStop as a guest. You can later edit or delete the vehicle.

Reward preferences may include selected card or program names, membership choices, custom cashback rates and offer limits. WorthStop does not ask for your payment card number, security code or bank login and does not receive your bank transactions or verify that a reward was credited. Do not enter payment credentials into names, comments or other free-text fields.

Route and location information

To calculate a recommendation, WorthStop processes the start and destination you enter, or precise coordinates if you choose Use current location, plus vehicle and trip settings. This is foreground use that you initiate. WorthStop does not collect background location.

Before the app requests device location, it explains two choices. You may use exact location only for the requested route, or also allow de-identified route-area analytics. With that optional choice, the server immediately converts route endpoints to coarse cells approximately 7–11 km across; exact coordinates and addresses are not written to analytics.

For signed-in users, we keep one last successfully planned route in account preferences to prefill the planner on your next visit, including on another device. Each new successful plan replaces it. This is separate from visit history and favorites. Saved routes and the last route can retain the choice “Current location”; reusing that choice requests a fresh device location instead of reusing an old starting position. You can forget the last route in My routes; account deletion also removes it.

Visit history is enabled by default for new accounts. While enabled, opening navigation saves the selected visit, route labels, relevant settings and a station snapshot so you can return, rate the stop or report a price. A search by itself is not added to visit history. Turning history off stops future visits but does not erase earlier ones.

Contributions and communications

If you contribute, we process the station, ratings, amenity answers, optional comment, reported fuel price and conditions, observation time and moderation status. Reports are linked to an account and selected visit to reduce fraud. If you contact us, we process the message and contact information needed to respond.

Station information from contributions and field research can be used to update shared prices, shop and amenity information, opening hours and aggregate benchmarks. Public station facts and aggregate information do not include your account contact details. Do not include private information in a contribution intended for display.

Product analytics, web activity and diagnostics

If you allow optional product analytics, WorthStop records de-identified interactions such as planner use, broad settings selected, recommendation success or failure, result views, station and map choices, navigation, arrival, rejection, favorites, saved routes, ratings and price reports. Events may include a random browser or app identifier, session identifier, recommendation or station identifier, broad route-distance and performance bands, interface surface, device platform and coarse route-area cells when separately allowed.

Analytics events never contain names, email addresses, passwords, tokens, full IP addresses, raw coordinates, full addresses, free-form comments, exact reported prices, contacts, photos, files or messages. The random identifier is used only to measure product journeys, prevent duplicate counts, honor deletion and protect the service; it is not an advertising identifier.

With your permission, we use cookie-free, aggregated web analytics and performance measurement to understand which pages are useful, measure loading and interaction speed, and identify reliability problems. Specialist analytics and performance service providers process this information on our behalf. Your optional analytics choice controls these services and WorthStop product analytics. They do not start until you accept. Web measurement may process a page path, timestamp, referring site, approximate country or region, browser, operating system, device type, short-lived visitor hash and page-performance timings. Query strings, URL fragments and sensitive route-link identifiers are removed from page URLs before they are sent for web measurement.

WorthStop product analytics and website measurement are separate from the information needed to calculate your trip. Declining analytics does not prevent trip planning, signing in, using your garage or saving routes. Allowing analytics does not grant device-location permission. Approximate route-area analytics require a separate choice; they use coarse cells approximately 7–11 km across, not exact route endpoints. We do not use these reports for targeted advertising.

Limited crash and diagnostic records remain enabled to protect and maintain the service. They contain a sanitized error category, irreversible error fingerprint, affected feature and response status. We do not transmit error text, stack traces, form values or route contents in product telemetry. Infrastructure providers may separately process network information as described below; the exclusion of full IP addresses from product analytics does not mean that a connection to our service is anonymous.

Infrastructure and security services may process IP address, request time, browser or device information and network logs to deliver the service, enforce rate limits, investigate abuse and maintain security.

How we use information

We use information for app functionality, account management, authentication, security, fraud prevention, legal compliance, personalization requested through saved settings, aggregate analytics, reliability and product improvement. We do not use precise or approximate location to infer sensitive characteristics or build an advertising profile. We do not send promotional messages based on analytics.

When information is disclosed

We disclose information only as needed to service providers that support hosting, content delivery, storage, authentication, account email, security, analytics, performance measurement, and mapping or directions. These providers process information for WorthStop under applicable agreements, or as an independent service when you deliberately leave WorthStop.

Address suggestions and place resolution may send the query or place identifier to an external address-search and mapping provider. Importing a map link uses the supplied link to resolve route locations. Map providers receive the network requests needed to display the map, including the requested map area and connection information. These requests are separate from optional product analytics.

When you choose navigation, the starting point, selected stop as a waypoint, and destination are sent to the external mapping service you open. Its own terms and privacy policy apply. We may also disclose information when required by law, to protect users and the service, or in a merger, financing, acquisition or asset transfer subject to appropriate protections.

WorthStop has not sold personal information or shared it for cross-context behavioral advertising. We do not use advertising SDKs or advertising cookies.

Cookies and device storage

Cookies, local storage and session storage have different roles. Some features need device storage even when optional analytics are off. Our website traffic and page-speed measurement is cookie-free; optional product analytics may use random identifiers kept in browser or app storage.

• Necessary operation: session technology supports sign-in, request security, abuse prevention and your saved privacy choices. Limited error diagnostics help us maintain reliability. These functions are not controlled by the optional analytics checkbox.
• Your settings and trip continuity: device storage remembers vehicle choices, setup progress and trip settings. A calculated result may remain in the current tab for up to one hour; an unfinished trip draft may remain for up to two hours. Other saved device preferences remain until changed or cleared. For guests, garage vehicles are stored on the device. When signed in, confirming a vehicle in setup or settings saves it to the account garage; it can be edited or deleted later.
• Optional analytics: with consent, feature events and website measurements help us understand usage and improve performance. Vehicle-search events use count and timing bands rather than search text or a vehicle nickname. A random device identifier can persist until reset or cleared, while a session identifier is scoped to the browser session. These identifiers are not advertising identifiers.
• Optional approximate areas: a separate setting allows coarse route-area information alongside product analytics. Turning optional analytics off also turns this choice off.

You can accept or reject optional analytics, or review the choices in Privacy settings. Closing the panel does not accept anything. A saved choice applies to the current browser or app storage, not automatically to every device. Clearing storage may sign you out, remove local preferences and cause us to ask for your choice again. Blocking all storage may affect sign-in and saved settings.

Changing your choice to reject stops future optional collection controlled by that choice; it does not automatically erase previously collected reports. To remove linked detailed product analytics, use Account → Privacy choices or contact us using the details below. Already aggregated reports that can no longer identify you may remain. The retention periods below apply to our stored records.

Retention

• Account content: retained while the account is active or until you delete an item, make a verified deletion request or delete the account.
• Visit history and contributions: retained with the account unless removed through a verified request or account deletion.
• Temporary navigation records: expire after approximately 24 hours and are periodically deleted.
• Detailed product and coarse-area analytics: expire after 90 days.
• Crash and diagnostic events: expire after 30 days.
• Security and rate-limit logs: generally retained for up to 30 days unless a longer period is needed for an active security or legal matter.
• De-identified daily totals: retained for up to 24 months.

Deletion removes active account records and linked detailed analytics. Limited backups, security or legal records, and aggregated information that can no longer identify you may remain until their normal deletion cycle.

Your controls and privacy rights

Open Privacy settings without signing in to allow or reject optional feature, traffic and performance analytics, and separately choose approximate route areas. Your choice applies to this browser and can be changed anytime. Closing settings does not give consent. Necessary security and limited error diagnostics remain enabled. In Account → Privacy choices, you can also delete detailed analytics linked to the account and current browser. The planner remains available if you decline analytics or location permission. Device location can be disabled in your device or browser settings.

You can edit account and vehicle information, remove favorites and saved routes, turn future visit history off, change your password and delete the account from Account. The public account deletion page explains the in-app and email methods. You may also email team@worthstop.app to request access, correction, a portable copy or deletion. We may verify identity and authority before acting.

Applicable rights vary by location. Where required, California residents may request to know, access, correct or delete personal information and will not be discriminated against for exercising a privacy right.

Security, age and international use

WorthStop uses administrative, technical and organizational safeguards appropriate to the information handled, but no online service can guarantee complete security. WorthStop accounts and personalized features are intended for people 18 or older. The service is not directed to children under 13; if we learn that we collected a child's personal information without required permission, we will delete it.

WorthStop is a United States-focused service. If you use it elsewhere, information may be processed in the United States, where privacy laws may differ.

Changes and contact

We will post material changes here and update the effective date. If a revision materially affects account information already collected, we will provide additional notice when required. Contact team@worthstop.app with questions, complaints or privacy requests.