Privacy

The controller is the operator of Gas. The company behind Gas is being set up; until it is incorporated, the person who runs Gas is the party responsible for your data, and this page will name the company, its registration and its address the day that changes.

Contact: support@fillgas.xyz. A rights request gets an answer within one month, which is the legal deadline. A wrongly refused claim gets a human look within 72 hours.

• Your location is read only while the claim screen is open. There is no background location.
• A claim is one position fix and a device fingerprint. We keep the fix, a one-way hash of the fingerprint, your IP address, your browser's user agent, what our hosting provider's edge worked out from the address (country, region, city, approximate coordinates, timezone and network number), and Fingerprint's report on your browser with its own copy of your IP address, its visitor id and any location it worked out taken out first.
• We do not decide anything from your nationality or where you are standing. We show you the rules that apply and you confirm them yourself.
• You sign in with Google or X through Privy. We never see a password.
• We do not sell data or run ads. We set one cookie of our own: if you arrive on someone's invite link, it remembers their code for thirty days so we can record who brought you in. The other cookie is Fingerprint's bot check, set when you hold to pump. Page views are counted without cookies.
• A paid claim is a transfer on Robinhood Chain. It is public and permanent, and nobody, including us, can delete it.

Only while the claim screen is open:

• Your position: latitude, longitude, the accuracy your phone reports in metres, and the time of the fix. The app may send a few readings taken in the seconds before you tap; the server uses the one inside its time window.
• Request headers: your IP address, user agent and language. The server keeps the IP address and the user agent on the claim or refusal record, turns the IP into a one-way hash and a country code as well, and turns the headers into a one-way device hash.
• A photo of the pump, when the server asks for one. The picture is sent to our server, shown to Anthropic's Claude model to judge whether it is a real fuel dispenser, and kept privately for seven days in case you dispute a refusal. Two hashes of it stay on the claim record, so the same picture cannot win twice.
• Your wallet address and the id of the Gas NFT you claim with.

On sign-in: the identifier Privy gives your account, the wallet Privy derives for it, whether your email is verified, and your X handle if you linked X. Your email address and name are read to verify you and are not stored by us; Privy keeps its own copy.

If you add a profile picture: the picture you choose. Our server turns it into a 512 × 512 JPEG and removes its metadata, including any location, before storing it. It is shown on the public leaderboard and in the app’s “Live pumps” list, left of your name or address, while your name is set to Public in your garage (the default), and on the card of any claim you share. Set it to Private and the leaderboard and the list stop showing it within a minute; removing the picture does the same.

If you choose a username: the name you type, stored with your account. Your username is shown on the public leaderboard, and beside your claims in the app’s “Live pumps” list (decided 1 October 2026), unless you set it to Private in your garage. The same switch governs your profile picture in both places: Public shows both, Private hides both. Public is the setting every account starts with (decided 30 September 2026), and you can change it there at any time; while it is private, the leaderboard and the list show your wallet address shortened to its first six and last four characters instead, as they do for anyone without a username. The leaderboard shows, beside that name or address, how much you have claimed. Your username also appears on the card of any claim you share (below). Signed-in players can also tap you on the leaderboard, in the Live pumps list or on one of your Dealership listings to open your profile (decided 15 October 2026): it shows your username and picture while they are Public, your shortened wallet address, and the five cars you ride (your Starting 5). While your name is Private the profile shows neither your username nor your picture, only a blurred placeholder in their place. Your cars are on Robinhood Chain, so someone determined can look up the full wallet that holds them. No other screen in the app shows your username to other players.

If you tap Share on a claim (only then): we publish a page and an image for that claim, with your nickname, your profile picture, the amount, what it was worth in dollars at the time, the multiplier, the station and its city. Anyone with the link can see it, and link previews on X, Telegram and messaging apps fetch it. A claim you have not shared has no page and no image — but every claim we pay does show, briefly, in the live feed described next. Ask us to withdraw a share card by email: we take it down straight away, but copies already held by the networks that deliver our pictures can keep showing it for about a day after that, and anyone who saved or reposted the image still has their copy.

Whenever we pay a claim (everyone’s, with no tap, decided 24 September 2026; you can take the place off your own, below): for about ten minutes after you claim, it can appear as a passing card to anyone with the app open, anywhere, and it stays in the app’s “Live pumps” list (decided 26 September 2026) for as long as it is among the twenty most recent claims we have paid, which on a quiet day can be a long time. The ten minutes are counted from the moment you tap, not from the moment the payment settles on Robinhood Chain — a card appears only once the chain has confirmed the payment, so a payment that takes a few minutes to settle is shown for whatever is left of the ten, and one that takes longer than that is never shown at all. The card carries the wallet address on your account when the card is shown — normally the one we paid, though if you change your wallet in the minutes between claiming and the card appearing it is the new one — shortened to its first six and last four characters, the amount, what it was worth in dollars, and the station’s city and country (not while your Location switch is off, below). The “Live pumps” list shows the same claim with the station’s city and country and its position on the map (so a reader can go to that pump; neither while Location is off), the time you started the claim (shown as how long ago), the shortened address, and a link to your player profile. It also shows your username in place of the address, and your profile picture beside it, while your name is set to Public (the default) and you have set them; set it to Private and the list shows the shortened address and no picture, as the leaderboard does (decided 1 October 2026). The passing card never carries your username or your picture. Neither carries the transaction or where YOU were standing: the position is the station’s, never your phone’s.

Location (switch). When it is off, your claims still show on Live pumps, in the passing cards and on the leaderboard — with your name and picture if those are public, your shortened wallet, the amount and how long ago you claimed — but without the station or its position. This hides which station you used from people reading the app. It does not hide it from everyone: the time of a claim, together with every station’s public page that shows how long ago each pump was used, or a payout’s public time on Robinhood Chain, can let someone work out the station, especially someone watching the stations near you. To also hide your name and picture, set your profile to Private. If you need your location kept from a determined person, this switch is not enough.

The switch (decided 16 October 2026) is on your profile card, next to Public / Private, and is on by default. Turning it off takes the station off your earlier claims at once, and it shows again if you turn it back on. It also leaves these as they are: the station’s public count of claims and of free pumps still changes; anything someone saw or saved before you turned it off stays with them, and the profile link connects your older claims to newer ones; a claim card you choose to share still shows the station’s town; and the chat still shows the country you signed in from while your name is Public.

We keep no page and no image for a feed line; once it leaves the feed there is nothing left to visit. We publish the feed because a payment is already a public transfer on Robinhood Chain: the address, the amount and the time can be read by anyone watching the chain or our own proof page. What the feed adds is the station.

Never: background location, contacts, calendar, messages, microphone, your photo library beyond the pictures you choose to take or upload, step counts, or advertising identifiers.

Gap we are naming rather than hiding: the refusal log has no expiry clock yet. It holds your IP address, a position and a time, and it should expire on its own. Adding that clock is on our list, and this page will change when it lands.

• Privy signs you in with Google or X and derives a non-custodial wallet on your device. It holds the sign-in session and a copy of the email or handle the provider gave it.
• Google or X, whichever you choose, learns that you signed in to Gas and gives us a subject id. They never give us a password, your contacts or your posts.
• Vercel hosts the site, sees request IPs and headers in normal operation, and stores profile pictures privately in Vercel Blob. A stored picture is served publicly in four places: a shared claim’s card, only after you tap Share, and the leaderboard, the Live pumps list and your profile, while your name is set to Public. Vercel Web Analytics counts page views without cookies or a cross-site identifier.
• Amazon Web Services runs our API server in the US (Virginia); requests reach it through Vercel, with your IP and headers. Its Redis-compatible store (ElastiCache) holds the counters and cooldowns.
• PlanetScale (Postgres) holds the database rows above.
• Fingerprint tells a real phone from a bot. Its script runs in your browser while you hold to pump: it reads signals from the device, and it sees your IP. The requests go to anti.fillgas.xyz, a subdomain of ours that Fingerprint runs, so an ad blocker does not cost you a claim — the device data reaches Fingerprint either way. It answers with a visitor id. We never store that id, only a one-way hash of it. We do keep the rest of its report on each claim and refusal: its bot verdict and signals such as a VPN, a proxy or a tampered browser, how busy the browser has been, and the browser, system and network provider it saw. Before that report is saved we remove your IP address, the visitor id, the location Fingerprint worked out from your IP, and anything after the page address in the link you were on. None of it decides whether a claim pays.
• Anthropic judges the pump photo when the server asks for one. The picture goes to its Claude model with the station's coordinates and nothing else about you, and the model answers whether it shows a real fuel dispenser.
• OpenFreeMap serves the map tiles straight to your browser from tiles.openfreemap.org, so it sees your IP and the area you are looking at. That traffic never passes through our servers.
• Robinhood Chain is a public ledger. A paid claim is written there for anyone to read.
• Our email host receives whatever you put in a support message.

There is no advertising network and no crash reporter. Fingerprint's script is the only third-party script that reads your device, and it runs on a claim, not on a page view; the separate device hash is still computed on our server from request headers. If we add another provider, it is listed here before the code ships. Privy, Vercel, Amazon Web Services, PlanetScale, Fingerprint and Anthropic are US companies; processing can happen outside the EU under each provider's own data-processing terms.

Gas sets one cookie of its own, and only one: an invite code, if you arrived on somebody's invite link. It is kept for thirty days, it holds nothing about you, and it is dropped as soon as we have recorded who invited you. Your session does NOT travel in a cookie — it is a request header, which is also what stops cross-site request forgery. The browser stores your theme choice, a device id for the claim flow, and Privy's sign-in session so a reload does not log you out. Signing out clears the session; the invite code and the theme choice go when you clear site data, or on their own once they expire.

Fingerprint is the exception: when you hold to pump, its script stores a cookie and a storage entry of its own under anti.fillgas.xyz, which is how it recognises the same browser next time. None of it is read for advertising, and clearing site data clears it too.

Nothing on the site reads an advertising identifier, and page-view counting uses no cookie.

Whether a claim is paid is decided by software with no human in the loop: is the fix inside the station radius, does the device pass the sybil and bot limits, does the wallet hold a Gas NFT whose cooldown has passed, and, when asked, does the photo show a real pump. The outcome is pay or refuse. A refusal costs you nothing and comes with a reason code; it never tells you the threshold, because that would tell a cheater too.

This is allowed under GDPR Article 22(2)(a) because it is how the contract is performed. There is no profiling for advertising and no category is built about you. Safeguards: every refusal is recorded with its reason, and you can have a human review it (see Your rights).

Your wallet is non-custodial: Privy derives the key on your device and we never hold it, so we cannot sign for you or move your tokens. A paid claim is a transfer of the USO Stock Token from the prize pool wallet our backend holds, straight to your wallet, sent by our server. That transfer, with your wallet address, the token, the amount and the time, is readable by anyone forever. There is no delete button, for you or for us.

Everything else, your profile, your positions and your station history, is off-chain and is deleted on request. If permanence is not acceptable to you, do not claim.

This page is a file in the repository that builds the site. A change that adds a provider, reads a new piece of data or keeps something longer is written here before the code ships, and the date at the top moves. Changes are never retroactive.

support@fillgas.xyz, read by a person. No legitimate support request will ever ask for your seed phrase, your password, a wallet connection, or an "unlock fee". Do not send proof of identity over X.