Privacy Policy

Effective Date: October 31, 2026

1. Who we are

One Spoke LLC ("One Spoke", "we", "us") makes fuel stations, the One Spoke app and the services behind them. Businesses with private fleets and on-site fueling use them to control fuel pumps, track fuel, equipment, maintenance, tanks and irrigation, and manage the people who use them.

One Spoke LLC
265 N Main St Ste D #326
Kaysville, UT 84037-1471
United States

This policy explains what information we collect, why, who we share it with, where it is kept, how long we keep it, and the choices you have. It covers the One Spoke app on iPhone, Android and the web, our fuel stations, the onespoke.com website, and the text messages and emails we send.

2. The business and its workers

Most people in One Spoke are there because a business added them.

• Account holders sign in to the app. For your own account, One Spoke is responsible for your information.
• Workers are added by their employer, for example as a name with a fuel PIN or an RFID tag used at a station. Some workers never sign in. The employer decides what it records about its workers and is responsible for those records. We hold and process them on the employer's behalf and follow its instructions.

If you are a worker and want your information seen, corrected or removed, ask your employer first. If you contact us, we will pass your request to your employer and help them act on it.

3. What we collect

Account and profile

• Your name, email address, phone number and profile photo.
• If you sign in with your phone number, that number is your sign-in. We send it a one-time code by text message each time you sign in with it.
• Your company, your role and your notification settings.
• Push notification tokens for your phone or browser, so we can send you alerts.

Fuel access

• Your fuel PIN and the ID of any RFID tag or card assigned to you.

Fuel and work records

• Fuel logs: who fueled, which equipment, which station and pump, how many gallons, the meter reading and the time.
• Equipment, maintenance, task, tank and irrigation records, and the photos and files you attach to them.

Station and location information

• Each station's location, taken from its cellular modem's GPS or from the cell tower it uses. We keep the latest value.
• Station and modem identifiers: SIM number (ICCID), modem number (IMEI), mobile operator and cell ID.
• The site or device location you place on the map during setup. We work out the ZIP code from it on our own systems; we do not send it to a mapping service to do that.
• Your phone's location, only while you are placing something on the map, such as when you tap "use my location" or set up a device. We use it to center the map. When you confirm a device's spot during setup, that spot (which may be your phone's current location) is saved as the equipment's location. We do not track or store your movements.

Text message consent

• How and when you agreed to receive texts, the phone number you agreed on, and your YES and STOP replies.

Records we keep to run the service

• Which version of this policy and our Terms of Service you accepted, and when.
• Feedback messages you send us in the app.
• An audit trail of changes: who changed what, the app version and the device used.
• IP addresses in our server logs.

App usage and crash information

• Screens viewed and app events, with device type, operating system and region (through Google Analytics for Firebase). We do not attach your name, email or user ID to this.
• Crash and error reports: device type, operating system, app version, the screens used just before the error, and performance timings (through Sentry). Crash reports do not include your IP address or your account or company ID.

Payments

• Card details are entered on Stripe's own payment pages and go directly to Stripe. They never reach our servers. We keep the billing IDs Stripe gives us and your invoice history.

4. Device permissions

The app uses these device permissions. You can turn any of them off in your device settings; the feature that needs it will then stop working.

• Bluetooth: to find and set up nearby One Spoke equipment.
• Camera: to take photos of equipment and to scan the pairing QR code shown on a display.
• Photos: to attach photos you already have.
• Location, while using the app: to center the map on you and to place fields, zones and equipment. The app does not use your location in the background.

The app does not read your contacts.

5. How we use information

• To run the service: sign you in (by email and password, or by a code texted to your phone number), control stations and pumps, record fuel, and keep equipment, maintenance, tank and irrigation records.
• To send the alerts, account emails, push notifications and texts you or your employer set up.
• To bill for subscriptions and hardware.
• To support you and your business when you ask for help.
• To keep the service secure, investigate problems and fix crashes.
• To understand which features are used so we can improve them.
• To keep records the law requires, such as tax records and consent records.

We use information only for these purposes. We do not send marketing email; every email we send is about your account, your equipment or the service. We do not use your information for advertising.

6. Who we share it with

We do not sell your personal information. We share it with the service providers below, who process it for us to run One Spoke, and only as much as each one needs. If your business works with a One Spoke dealer, we also share it with that dealer and its sales representative, as described after the list.

• Google Firebase (Google LLC): hosts our database, file storage, sign-in (including the text message that carries a phone sign-in code), server code and push notifications (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging). Firebase App Check confirms requests come from our real app, using Apple App Attest, Google Play Integrity, and Google reCAPTCHA on the web.
• Google Analytics for Firebase (Google LLC): app usage statistics.
• Sentry (Functional Software, Inc.): crash and error reports and performance data, stored in the United States.
• Stripe: payments and subscriptions.
• Telnyx: sends and receives text messages.
• SMTP2GO: sends email.
• Odoo: our business system for customers, orders and invoices. It holds your company name, email address and billing IDs.
• Hologram: provides the cellular SIM cards that connect stations to the internet.
• Map providers Esri, Mapbox and OpenStreetMap: supply the map images. They receive your IP address and the area of the map you are viewing.
• Google Fonts: supplies the typefaces the app displays.
• Cloudflare: delivers our website and protects it from abuse. It processes technical data such as your IP address to do that.

Inside a business account, the people your employer gives access to can see the records the business keeps, such as fuel logs and equipment records.

Your dealer and its sales representative. If your business buys from, or is installed and supported by, a One Spoke dealer, the dealer's staff whom your business gives access can see and work on your account, including its stations, equipment, fueling and maintenance records, and the people listed on it, so they can install, set up and support your system. The independent sales representative who works with that dealer for One Spoke can view the same records but cannot change them, and each time a representative opens your account it is logged and the dealer can see that record. Dealers and sales representatives are independent businesses, not One Spoke employees; they may use your information only to sell, install and support One Spoke products for you. Your business's administrator can remove a dealer's access at any time in the app, and we keep a record of when access was given and removed.

We may also disclose information when the law requires it, to protect people or property, or as part of a sale or merger of our business, in which case this policy continues to apply to it.

7. Where your information is stored

We store and process information in the United States. Our database and server code run in Google's us-central1 region, and our service providers process information in the United States.

For users in Canada: your information is stored and processed in the United States, and it may be accessed by courts, law enforcement and national security authorities there under United States law.

8. How long we keep it

• While your company subscribes (a paid or trial subscription), we keep its information so the service works.
• When a subscription ends, we keep the company's information for 90 days so it can come back without losing anything. We email a warning first. After 90 days we delete it.
• If a company asks us to delete its account, we delete its information within 30 days of confirming the request.
• Billing and invoice records are kept for 7 years, because tax law requires it, even after the rest of the company's information is deleted.
• Text message consent and opt-out records, and records of who accepted our Terms of Service and Privacy Policy, are kept for 7 years after the relationship ends (the company is deleted, or the phone number opts out), as evidence of those choices. Then we delete them.
• Backups: deleted information can remain in our backups until those backups expire on their normal schedule. We do not restore it from them.
• When an employer removes a worker, the worker's sign-in is disabled and their fuel PIN and RFID tag stop working. The worker's fuel history stays with the business, because it is the business's own record of its fuel.

9. Your rights and choices

You can ask us to:

• See the personal information we hold about you.
• Correct information that is wrong. You can change most of your profile yourself in the app.
• Delete your information, as described in section 8.
• Withdraw consent, for example to text messages, at any time.

To make a request, email privacy@onespoke.com or contact support at support@onespoke.com. We may need to confirm who you are before we act. If you are a worker, your employer controls your work records, so we may involve them.

Accountability: One Spoke is responsible for the personal information it controls. Our privacy officer is responsible for our compliance with this policy and with Canadian privacy law (PIPEDA) and can be reached at privacy@onespoke.com. If you are in Canada and not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

10. Text messages

An employer can ask for a worker to get a text after each fueling. We then send that phone one message asking the owner to reply YES. We send nothing more unless YES comes back from that phone.

• Reply YES to opt in.
• Reply STOP at any time to opt out.
• Message and data rates may apply.

We keep a record of each consent and each opt-out (how, when and from which number) as evidence of your choice. If the phone number changes, we ask again. We do not share your mobile number or your consent with anyone for their marketing.

11. Cookies and browser storage (web app and website)

• Sign-in uses your browser's storage (IndexedDB) to keep you signed in.
• The app saves your settings in your browser's local storage.
• Google Analytics sets first-party cookies (such as _ga) to count visits and usage.
• Google reCAPTCHA, used by Firebase App Check, may set its own cookies to tell people from bots.

You can clear or block these in your browser settings. If you block browser storage, you may not be able to stay signed in.

The onespoke.com website itself has no forms, accounts, analytics or advertising, and it sets no cookies. If you email or call us, we use what you send only to reply and to follow up about One Spoke.

12. Security

Information travels between the app and our servers over encrypted connections. Access requires signing in, and each company's information is kept separate so other companies cannot see it. No system is perfectly secure, so we cannot guarantee that information will never be accessed without permission. If we learn of a breach that affects you, we will tell you as the law requires.

13. Children

One Spoke is a service for businesses and is not meant for children under 13. We do not knowingly collect information from children under 13. If we learn that we have, we will delete it.

14. Changes to this policy

When we change this policy, we update the Effective Date at the top and ask you to read and accept the new version in the app before you continue.

15. Contact us

Questions or requests about your privacy:

Privacy officer: privacy@onespoke.com
Support: support@onespoke.com
Phone: 385-424-0640
One Spoke LLC, 265 N Main St Ste D #326, Kaysville, UT 84037-1471, United States