Maine Oil Prices — Privacy Policy

Last updated: 2026-10-11

Maine Oil Prices (“the app”) shows the heating-oil and kerosene dealers that deliver to a Maine town, with their prices, and lets signed-in people report what they actually paid. It is published by Stephen Goss (“we”). This page explains, in plain terms, what the app does with data. There is no advertising and no analytics SDK in the app, and we never sell or share your data with a data broker.

Summary

Browsing without an account

Prices, towns, favorites and other people’s reported prices all work without signing in. You are asked to sign in only at the moment you submit, confirm or dispute a report, add a dealer, or flag or block someone. Everything in that list except blocking also needs a verified email address.

Location

• The app asks for “while using the app” (foreground) location permission only when you tap “Use my location”. On an iPhone the prompt reads: “Maine Oil Prices uses your location to find your town. When you open the app, it may check again about once a week.” You can decline and type your town or ZIP code instead; every feature works without location.
• When you tap “Use my location”, and when the app re-checks a town you chose that way (see the last point below), it reads your position and asks your phone’s operating system to turn it into an address. The operating system’s geocoder does that by sending the coordinates to Apple (iPhone) or Google (Android). The app then matches the address to a Maine town using a list built into the app. After a tap it asks you whether that is the town your oil is delivered to; after a re-check it asks only if the town is a different one. Coordinates and addresses are then discarded; only a town you confirm is kept.
• Your coordinates and street address are never transmitted to our server. What does reach the server is the town on a price request — the same request every other person who chose that town makes — and, if you submit a price report, the delivery town you choose for it. If you are signed in, the list of reports near your town is requested with your sign-in, so that reports from people you blocked can be left out; we do not save the town with your account. A ZIP code you type to find your town is looked up inside the app and never sent.
• The app never uses background location; the build configuration disables it on both platforms.
• The town you confirm stays on your device until you change it. If you chose it with your location, then when you open the app it may check your location again, about once a week (at most once every 7 days, whatever the check finds and whether or not you answer it) and only if you have already granted permission. Each check goes through the geocoder described above. If you seem to be near another town it asks before switching; it never changes your town on its own.

Accounts and email

• You can sign in with Apple, sign in with Google, or create an account with an email address and a password. We identify an account by the provider and the provider’s subject identifier, never by the email address alone.
• If you sign in with Apple or Google for the first time using an address that Apple or Google itself runs (such as Gmail, iCloud or a Google Workspace address), and an account here already uses that address and has confirmed it, we add the sign-in to that account. If that account had a password, this removes the password and signs the account out on every other device; you can set a new one with “I forgot my password”. If it never confirmed the address, the address moves to a new account for this sign-in. With any other address, a first Apple or Google sign-in creates a separate account with no email address on file. We keep the address Apple or Google shared only with that sign-in, and use it to find the account if you ask us by email to delete it.
• If you use Apple’s Hide My Email, we receive and store only the private relay address Apple gives us.
• If you sign in with Apple and choose to share your name, Apple gives us your first and last name once, on your first sign-in, and we store it with your account. Google’s sign-in also passes us the name and profile photo on your Google account; we do not keep them. Email sign-up gives us no name.
• Passwords are never stored. We store a PBKDF2-SHA256 hash with a random per-account salt and 100,000 iterations.
• Sessions are opaque random tokens stored on our server as a SHA-256 hash and on your device in the operating system’s secure storage (iOS Keychain / Android Keystore). Signing out ends the session immediately: the token stops working on the very next request.
• We send transactional email — address verification and password reset — from [email protected] through Cloudflare Email Service. Those links are single use and expire (24 hours for verification, 1 hour for a reset). We send no marketing email.
• Everything travels over HTTPS. The .app domain is HSTS-preloaded, so plain HTTP is not possible.

Reported prices and other user-submitted content

• A price report contains the dealer, the price per gallon, whether you paid delivery fees and how much, the number of gallons, the delivery date, the delivery town and the fuel. It is public to everyone using the app, unless it was delivered to a town of fewer than 1,000 people (next point).
• A report is shown without your name or email address; other people see only the dealer and its branch town, price, any fees, gallons, delivery date, delivery town and fuel, and how many people confirmed or disputed it. A report delivered to a town of fewer than 1,000 people is never shown individually to anyone but you. It is not counted in any price figure, such as a dealer’s median or its number of reports. Where three or more different accounts have reported deliveries from a dealer to one town of 1,000 people or more, that dealer’s page may also show the town’s median; a smaller town never gets one.
• Reports also show which dealers deliver where. When two or more accounts report deliveries from a dealer to a town, whatever its size, that town’s price list may show the dealer with the note “Neighbours report deliveries here”. The note shows no report, price, date, amount or name.
• Signed-in users can tell which of the reports they are shown were filed by the same account, which is what lets them block it, but not whose account it is.
• If you add a dealer that is not on the board, the dealer name you type is stored and shown to other people, and is screened before it is created.
• Confirm and dispute votes, content reports (“Report this”) and blocks are stored against your account so each person votes once and so blocked authors disappear from your view.
• Content you flag is hidden pending review, and we act on flags promptly — our own target is within 24 hours.

Price data from the board

Dealer names, towns, phone numbers, websites and advertised prices are read by our server from the public price board at maineoil.com four times a day. Which towns a dealer delivers to comes from the dealer’s own website or, where it publishes none, from where its branches are. That data describes dealers, not you. Tapping “Call” hands the number to your phone’s dialer; the app does not record or observe calls.

Who else processes this data

• Cloudflare, Inc. — Workers, D1 and Pages host our API, our database and this site, and Email Routing forwards mail sent to [email protected] to our inbox. Cloudflare processes request metadata such as IP addresses to serve and protect the API; we do not store IP addresses in our database beyond short-lived rate-limit counters. Cloudflare privacy policy.
• Cloudflare Email Service — delivers verification and password-reset email; it receives the recipient address and the message.
• Apple and Google — only when you choose their sign-in button. They tell us an opaque subject identifier and, if you allow it, an email address; Apple can also share your name the first time you sign in, and Google’s sign-in carries your Google account’s name and photo, which we do not keep.
• Your phone’s location service (Apple on iPhone, Google on Android) — receives your coordinates when you use your location, to look up the address. That exchange is between your phone and Apple or Google; we never receive the coordinates.
• Apple App Store / TestFlight and Google Play distribute the app; EAS Update (Expo, Inc.) delivers JavaScript-only updates. Checking for an update sends the app’s runtime version, platform and update channel, which update it is running, a random identifier for this installation of the app (not linked to your account) and, like any internet request, your IP address; Expo uses them only to deliver updates.
• No analytics SDK, crash reporter, advertising SDK or other tracking is included in the app.

All of these act as service providers processing data on our instructions. We do not sell personal data and we do not share it for advertising.

Data retention and deletion

• Location: coordinates are not retained anywhere (see above); the town you choose stays on your device until you change it or remove the app.
• Account data — email address, any name Apple shared, sign-in identities, sessions, votes, flags and blocks — is kept while the account exists.
• Deleting your account deletes the account record, every sign-in identity and every session. Price reports you submitted are anonymised, not deleted: the link to your account is removed and the report is marked as having no author, so the community price record is not silently rewritten. The app states this on the confirmation screen before you proceed.
• Backups. Deleted data can stay in our database backups for up to 30 days, and in an encrypted export that only the owner can open for about three months. Backups are used only to recover from a fault. If we ever restore one, we delete again every account we know was deleted after the point we restore to.
• Cloudflare keeps a log of each request to our API for 7 days, which we use to find and fix problems: it holds the web address requested (such as the town on a price request), the request’s headers, including your IP address, the approximate location Cloudflare works out from that address, and anything our API notes, such as the ID of an account that was deleted.
• A content report you raised that we have not yet reviewed is kept, with nothing that identifies you, until we review it, so anything it hid stays hidden meanwhile. Content reports we have reviewed, your votes and the blocks you made are deleted with the account.
• If you block someone who later deletes their account, the block stays in effect: their anonymised reports stay hidden from you. The block then points at a random identifier that nothing links to that person, so they no longer appear under Blocked users.
• Email you send us, a “Doesn’t deliver here?” message included, is kept in our support inbox only as long as we need it to answer you and to correct the data it is about.
• You can delete your account inside the app: Settings → Account → Delete account. You can also request deletion on the web at maineoilprices.app/delete-account without reinstalling the app.
• When we delete an account because you asked us by email, we keep the date and the deleted account’s ID, but not your email address or the code we sent you, with no time limit. It is our record that we did it, and it lets us delete the account again if we ever restore a backup from before that date.
• Abuse-prevention (rate-limit) counters record the email address, IP address or account ID that a sign-up, sign-in, email, confirm or dispute vote, content-report or add-a-dealer request, or a signed-in load of reported-price summaries, came from, with a count. They are used only to stop abuse and are deleted automatically within three days, including after you delete your account.

Children

The app is meant for adults. You must be 18 or older to create an account. The app is not directed to children under 13 and knowingly collects no personal information from anyone under 13.

Changes

We will update this page and the “Last updated” date when the policy changes. Material changes are noted in the app’s release notes. If we ever add advertising, we will update this page before it starts and say so in the app’s release notes.

Contact

Stephen Goss — privacy contact: [email protected]