Privacy Policy - Prometheus

Effective Date: October 19, 2026
Last Updated: November 11, 2026

1. Introduction

Welcome to Prometheus. Prometheus is an app for drivers who run private tours and transfers: it records the tips you receive and the extras you make, your income and your costs, and turns them into daily, monthly and yearly summaries. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what we collect, why, how we protect it and what you can do with it.

Data Controller: Dimitrios Daskaleas d/b/a FineApps
Contact: prometheus@fineapps.gr
Location: Athens, Greece

2. Information We Collect

2.1 Information You Provide

Account Information

• Email address (required)
• Password, stored only as a one-way cryptographic hash (bcrypt) — we never see or store the password itself
• If you sign in with Google, Apple or Facebook: the account identifier that provider gives us, and the email address it shares

Settings

• How you work: vehicle owner (freelancer) or employee
• Language, currency and time zone
• The city you work in
• Whether you take part in city comparisons (on unless you turn it off)
• Opening balance and, for employees, monthly salary

Records You Enter

• Jobs (tours, transfers, disposals): date, time, type, pick-up and drop-off place, the agency or platform that booked it, the fare, tips and what you spent on your clients
• Extras you make, and the names of the places and partners they relate to
• Other income (bonuses, salary) and expenses, including recurring ones
• Vehicle odometer readings
• Notes you write on a job

About your clients: job notes are free text that only you see. Please do not record your clients' full names, contact details, passport details or other sensitive information in them; a short reminder ("couple from Texas") is all the app needs.

Places You Add to the Shared Directory

• The names of places you type as a pick-up, drop-off or city (hotels, ships, ports, airports, addresses)
• Which places you use, and the spelling suggestions ("did you mean…?") you accept

2.2 Information Collected Automatically

Technical Information

• IP address and request times, in our hosting provider's server logs
• Error information when a request fails, used to fix the problem

On Your Device

• A copy of your records in your browser's storage (IndexedDB), so the app works without signal and syncs when you are back online
• Sign-in session tokens and your language preference (local storage)

2.3 Information from Third Parties

Google, Apple and Facebook Sign-In (optional)

• Your account identifier with that provider and the email address it shares with us
• No access to your contacts, photos, posts, friends or any other data on those accounts

Google Place Identifiers

• When a new place name enters the shared directory, our server asks Google for its identifier for that place, sending only the place name, its city and its country — never who typed it, never your location
• We store only that identifier, to recognise two spellings of the same place; no other Google content is fetched or kept

2.4 Information We Don't Collect

• Your location (no GPS, no tracking of where you drive)
• Payment-card details — the app is free and takes no payments
• Contacts, photos, microphone or camera
• Advertising identifiers — there are no ads, no analytics services and no third-party trackers

3. How We Use Your Information

3.1 To Provide the Service

• Create your account and sign you in
• Store your records on our server so they survive uninstalling the app or changing phones, and keep your devices in sync
• Calculate your daily, monthly and yearly totals, averages and projections
• Keep a shared directory of places, so drivers of a city can pick a hotel or port instead of typing it, with one spelling for everyone
• Compare your tips and extras with the anonymous figures of your city, and show you your own position among its drivers
• Send the password-reset email when you ask for one

3.2 To Keep the Service Working and Safe

• Fix errors and improve reliability
• Protect accounts (rate limits on sign-in, detection of reused sign-in tokens)
• Enforce our Terms of Service

4. Information Sharing and Disclosure

4.1 With Other Users

Your account, your email, your records and your own totals are private to you. Two things are shared, and neither ever names you:

• Place names. A place you add is visible only to you until at least 3 drivers have used it; then it appears in the suggestions of the drivers of that city. Nobody can see who added a place or who uses it.
• City comparisons. Your tips and extras count, anonymously, in your city's figures. A figure is published only when at least 5 drivers contribute to it; it is the middle value of those drivers, rounded to €0.50, and an extreme value is left out. A ranking shows each driver only their own position ("#3 of 41") — never another driver's position, amount or name. Fares, salaries and expenses are never part of a comparison.

Comparisons begin only after an account has been in regular use for about two months. You can stop taking part at any time in More → Settings → Take part in city comparisons; your figures leave the city's numbers at the next update, and the comparisons are hidden from you as well.

4.2 With Service Providers

We use a small number of providers who process data only to run the service for us:

• Hetzner (Hetzner Online GmbH, Germany): hosts our server and database in its data centre in Germany, as our processor under a data processing agreement (Art. 28 GDPR). Hosting involves no transfer outside the European Union.
• Cloudflare (Cloudflare, Inc., USA): stores the nightly backups of our database, encrypted at rest, in its R2 storage, as our processor under a data processing agreement (see section 9)
• Resend: sending the password-reset email
• Google (Places API): the place identifiers described in 2.3 — a place name, city and country, nothing about you
• Google, Apple, Meta: only if you choose to sign in with them, to confirm who you are

4.3 We Don't

• Sell, rent or trade your personal information
• Share data with advertisers or data brokers
• Use your data for marketing

4.4 Legal Requirements

We may disclose information if required by:

• Court orders
• Legal proceedings
• Government requests
• To protect rights and safety

5. Data Retention

5.1 Active Accounts

We keep your account and records for as long as your account exists, so your history is never lost.

5.2 Deleted Accounts

When you delete your account, it and every record in it — including the places you used, the suggestions you accepted and your statistics — are erased from our database immediately. Place names you added that other drivers use stay in the shared directory, with no link to you. Copies in our encrypted nightly backups are deleted as those backups expire, within 8 weeks. See the Data Deletion page.

5.3 Sessions and Reset Links

• Sign-in sessions expire after 60 days without use
• Password-reset links expire after 1 hour
• Server logs are kept by our hosting provider for a limited period and then deleted

6. Data Security

6.1 Security Measures

• Encryption in transit: all data travels over HTTPS (TLS)
• Passwords: stored only as bcrypt hashes
• Sessions: short-lived access tokens and rotating sign-in tokens, stored as hashes; a reused token signs the whole session out
• Account isolation: every record is tied to its owner and the server refuses any attempt to read or write another account's records
• Sensitive actions: deleting the account or connecting a new sign-in method requires a recent sign-in

6.2 Your Responsibilities

• Keep your password secure
• Don't share account credentials
• Sign out on shared devices
• Report suspicious activity

6.3 Breach Notification

If a data breach occurs, we will:

• Notify affected users and the supervisory authority within 72 hours
• Provide details of the data involved
• Offer guidance on protective measures

7. Your Rights and Choices

7.1 Access and Portability

You can:

• See all your records in the app at any time
• Download everything as CSV files or one JSON file, including your contributions to the shared directory: More → Export my data
• Request a copy by email

7.2 Correction

• Edit or delete any record and change your settings at any time

7.3 Deletion

• Delete individual records at any time
• Delete your whole account yourself: More → Settings → Delete account

7.4 Restriction and Objection

• Stop taking part in city comparisons yourself, in Settings
• Ask us by email to limit or stop any other use of your data

To exercise any right by email, write to prometheus@fineapps.gr from the address of your account, with the subject PRIVACY — [your request]. We respond within 30 days.

8. Children's Privacy

Prometheus is a work tool for professional drivers and is intended for adults. You must be at least 18 years old to use it. We do not knowingly collect data from anyone under 18; if we learn we have, we will delete it.

9. International Data Transfers

Our server and database are located in the European Union (Germany). The nightly backups are stored by Cloudflare (USA) under the EU-US Data Privacy Framework, under which Cloudflare is certified, with the European Commission's Standard Contractual Clauses in its agreement as a fallback. Where another provider processes data outside the EU (for example a sign-in provider you chose), it does so under appropriate safeguards such as Standard Contractual Clauses.

10. Cookies and Tracking

Prometheus does not use tracking or advertising cookies. It uses your browser's storage only for what the app needs to work: your offline copy, your sign-in session and your language.

11. Third-Party Services

If you sign in with Google, Apple or Facebook, that provider's own privacy policy applies to the sign-in itself. We are not responsible for their practices; please review their policies separately.

12. Marketing Communications

We do not send marketing emails. We contact you only for essential service matters, such as the password reset you request, security issues or important changes to these policies.

13. California Privacy Rights (CCPA)

California residents have additional rights:

• Right to know what personal information is collected
• Right to know if information is sold or disclosed
• Right to say no to sale of personal information
• Right to equal service and price

We do not sell personal information.

14. European Privacy Rights (GDPR)

Lawful basis: performance of our contract with you (providing the app you signed up for) and our legitimate interests (keeping the service secure and working, and offering a shared directory of places and anonymous city comparisons, which you can opt out of at any time). You may lodge a complaint with your local data-protection authority; in Greece, the Hellenic Data Protection Authority (dpa.gr).

15. Changes to This Policy

We may update this Privacy Policy as the app evolves. Changes will be announced:

• In the app
• By email for material changes
• By the "Last Updated" date on this page

If we add a feature that uses your data in a new way, this policy is updated before that feature is released.

16. Contact Us

For privacy questions, concerns, or requests:

Email: prometheus@fineapps.gr
Website: fineapps.gr/prometheus
Address: Athens, Greece

Response Times:

• General inquiries: 7 days
• Rights requests: 30 days
• Urgent security: 48 hours

17. Additional Information

17.1 No Sale of Data

We never sell, rent, or trade your personal information.

17.2 Privacy by Design

Privacy considerations are built into new features from the start.

If you have any questions about this Privacy Policy or our practices, please contact us at prometheus@fineapps.gr