CostoAuto: Car Expenses and Consumption
Last updated: 23 July 2026 · Versione italiana
CostoAuto does not sell your data, shows no ads, and performs no cross-app or cross-site tracking. The data you enter (vehicles, fill-ups, expenses, deadlines, attachments) stays on your device. If you choose to sign in (Apple on iOS, Google on Android, or an email code), the same data also syncs to the developer's sync service so it follows you across devices; it is used only to provide sync and is deleted when you delete your account. The only other transmissions are platform geocoding lookups you start yourself and data-minimized usage statistics relayed to PostHog (EU-hosted).
If you sign in, your ledger syncs to sync.costoauto.app (Cloudflare Workers with Cloudflare D1/R2 storage) so it survives a phone change, including between iPhone and Android. For sign-in we process your email address (or the pseudonymous identifier Apple/Google supplies) and send sign-in codes via Resend from noreply@costoauto.app. Credentials are stored only as salted hashes; encrypted daily backups expire after roughly 35 days. Signing out keeps your data on the device and server; deleting your account in the app (Profile → Sync → Delete account) erases the server copy and its attachments, with backups expiring on the same ~35-day cycle.
Location is requested only when you start a station lookup during a fill-up. The platform geocoding service returns a place or station name. If you save the fill-up, its station name and coordinates become part of the local ledger and, when sync is enabled, the synced record. Deadline notifications are generated locally on the device. Usage analytics are SDK-free and relayed through e.costoauto.app to EU-hosted PostHog. EEA, UK, and Swiss events are anonymized at the relay; elsewhere events use a random app identifier with no name, email, or advertising identifier. In Germany and Austria (and when the region is unknown) analytics stay off until you consent; elsewhere they can be turned off any time in Profile → Privacy & Data. Crash and performance reports (MetricKit / Play Vitals) are always on, aggregate, and content-free.
Local data stays on your device until you delete it. Synced data remains while you keep the account and is erased when you delete it; encrypted backup copies expire within roughly 35 days. Analytics events do not contain your vehicle ledger and are retained only to measure product use and stability. When a provider processes data outside the EEA or United Kingdom, we limit the transfer to what is needed for the requested feature and apply the contractual safeguards required by applicable law.
Full CSV export and a backup file are available at any time. Without an account, deleting the app removes your data. With an account, delete it in-app (Profile → Sync → Delete account); backups expire within ~35 days. For access, rectification, erasure, restriction, portability, or objection use the Prighter portal or support@costoauto.app.
Controller: Iulia Brezeanu Sole Professional No. 106465 (Dubai Development Authority), Building 16, Ground Floor, Dubai Internet City, Dubai, United Arab Emirates.
EU representative (Art 27 GDPR): Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria. UK representative: Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom.
CostoAuto is not directed to children and does not knowingly collect children's personal data.