Privacy Policy

Who we are

PlugCompass ("we", "us") is a free tool that helps electric-vehicle drivers find charging stations and compare prices. It is operated by Lissjos Engineering LLC, Encinitas, California, USA, which is the "controller" responsible for your personal data. Contact for all privacy questions and requests: our contact form.

The short version

• You can use PlugCompass without an account. Signing in (with Google) is only needed to write station feedback.
• To show nearby chargers we use the location you share or search for, and send those coordinates (without your name or IP address) to our station-data providers.
• Visitors from Europe (EU, EEA, UK, Switzerland) are asked first: Google Analytics and our analytics cookie only run if you click "Accept". Without consent we count visits without cookies, using an anonymous ID that changes every day.
• Visitors from other countries: we use a first-party cookie and Google Analytics to understand how the site is used. You can switch this off with "Cookie settings".
• We do not store your IP address with your visits. We do not sell your personal information.
• AI (Anthropic's Claude) helps read station prices, understand plain-English searches and screen community comments. We never send it your name, email or IP address.

Information we collect

Location and searches. If you allow it in your browser, your browser shares your current location so we can show nearby stations; you can say no and search by place name instead. When you type a place name, your browser sends that text directly to OpenStreetMap's Nominatim service to turn it into coordinates. If you use the plain-English search ("fast charger near coffee"), the words you type are sent to our server and to Anthropic to work out the filters. If you use voice input, your browser's own speech service turns your voice into text (for example Google in Chrome or Apple in Safari); we only receive the text. The coordinates of a search are sent to our server to find stations.

Usage information. When your browser runs our page, it sends us small usage events: pages viewed, the website you came from (domain only), stations opened, filters used, searches (city/state and coordinates rounded to about 1 km), "directions" clicks, calculator use, "Did it work?" votes, clicks on advertising links, device type (phone, tablet, desktop, car), your text-size setting and your chosen car model. We never store the text you type into search boxes in these events. Events are linked to:

• the random ID in our cb_anon cookie, if you are outside Europe or accepted cookies; or
• an anonymous daily ID (see next paragraph), if you are in Europe and did not accept.

Usage statistics without cookies (Europe, no consent). Our server computes a one-way scrambled code ("hash") from a random secret that changes every day, your IP address and your browser type. We store only the result, never the IP address. Because the secret is deleted after one day, the code cannot be turned back into your IP address and cannot be linked to your visits on other days. We use it to count daily visitors, to stop the same person voting twice on the same day, and for rate limits.

Visitor records. For each cookie or daily ID we keep the time of the first and last visit, the number of visits and your browser's "user agent" (browser and device type). We do not store your IP address in these records.

Account information (optional). If you sign in with Google, our sign-in provider Hexclave (formerly Stack Auth) gives us your email address, your name on your Google account and an account ID. We store them with your sign-up date and last login. After you sign in, earlier usage records from that browser (cookie ID) are linked to your account. We never see your Google password.

Things you contribute.

• "Did it work?" check-ins: your yes/no answer for a station and the time. Instead of your account, cookie or daily ID we store a one-way hash of it, so we can count one vote per person and limit abuse.
• Price reports: the prices you enter and an optional note. We do not store who sent them. They are shown publicly as unverified community submissions.
• Station feedback (sign-in required): your star rating, tags and comment. Shown publicly without your name; stored with your account so you can edit or delete it.

Advertising waitlist. If you join the waitlist at /advertise we collect what you enter (business name and type, address or city, website, your name, email, phone, message, and which placement interests you) plus a secret-salted hash of your IP address and your browser type, to fight spam.

Contact form. If you write to us at /contact we collect the topic you choose, your name (optional), your email address and your message, plus a secret-salted hash of your IP address to fight spam. We use them only to answer you and, for privacy requests, to carry out your request.

Feedback, problem reports and the recommend question. If you use "Feedback", "Report a problem" on a station, the "What did you mean?" box after a smart search or the occasional "How likely are you to recommend PlugCompass?" question, we store what you enter (your message, a thumbs up/down, the problem type or a 0–10 score) and, only if you give it, your email address so we can reply. To help us understand and fix the issue we automatically add a few non-personal details: the page you were on, your country (from Cloudflare), your device type (phone, tablet, computer, car), text size and light/dark mode, the "My car" model you chose, the station you had open (for problem reports) and the kinds of smart-search filters in use (e.g. "DC fast", "café nearby"), plus the version of the website. We do not add your location, what you typed into search, your name or a cookie ID. We keep a secret-salted hash of your IP address to fight spam and, for the recommend question only, a secret-salted hash of your browser ID so we ask at most once every 30 days.

Directions and "Did you make it?". When you tap "Get Directions", the navigation app you choose (Google Maps, Apple Maps or Waze) opens with the station as destination; that app's own privacy policy applies there. The station you chose and the time are kept only in your browser, so that when you come back we can ask whether you made it and whether charging worked. Your answer is saved as a normal "Did it work?" check-in. If you allow location, your browser checks whether you are near that station so we can say "Looks like you're at…"; this check happens on your device and only the yes/no result is counted, never your coordinates. If you allow the reminder (the box is ticked by default, but your browser asks for your permission first and you can untick it at any time), your browser gives us a push address that we keep until the reminder is sent (at most one day) and then delete; the reminder itself contains no information about you or the station.

Security records and server logs. To prevent abuse we keep short-lived counters keyed by a hash of your IP address, daily ID or account. Our servers keep technical logs of requests (IP address, time, address requested, which can include map coordinates, and browser type) for up to 90 days.

Why we use it, and our legal bases (GDPR)

If you are in the EU, EEA, UK or Switzerland, the GDPR (or its UK/Swiss equivalent) requires a legal basis for each use:

• Providing the service you ask for (finding stations, prices, scores, plain-English search, accounts, letting you manage your feedback): performance of a contract with you, Art. 6(1)(b) GDPR.
• Google Analytics and the cb_anon cookie in Europe: your consent, Art. 6(1)(a) GDPR and the ePrivacy rules on cookies (for example § 25 TDDDG in Germany). You can withdraw consent at any time with "Cookie settings".
• Cookie-free usage statistics, security, spam and abuse prevention, rate limits, server logs, and showing community check-ins, reports and feedback: our legitimate interests in running, protecting and improving a free service, Art. 6(1)(f) GDPR. You can object (see "Your rights").
• Advertising waitlist: steps you ask us to take before a possible agreement, and our legitimate interest in answering business inquiries, Art. 6(1)(b) and (f) GDPR.
• Contact form: our legitimate interest in answering your message, Art. 6(1)(f) GDPR, and for privacy requests our legal obligation, Art. 6(1)(c) GDPR.
• Feedback, problem reports and the recommend question: our legitimate interest in fixing wrong station data and improving PlugCompass, and in answering you if you left an email, Art. 6(1)(f) GDPR. Giving your email is optional. You can object (see "Your rights").
• Complying with the law: Art. 6(1)(c) GDPR.

We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not build advertising profiles.

AI processing

PlugCompass uses Anthropic's Claude models to: turn published price text into comparable prices; turn plain-English searches into map filters; write a one-line "best nearby option" tip from public station data; check station feedback for spam, abuse or personal information before it is published; summarise approved comments and public Open Charge Map comments; write the owner's weekly statistics summary from totals only; and group the week's feedback messages into themes for the owner. Before feedback text is sent, email addresses, links and phone numbers are removed, and no email, IP address or ID is sent with it. We send only the text needed for the task, never your name, email, IP address, account ID or cookie ID. Under Anthropic's commercial terms, data sent through its API is not used to train its models by default. AI output can be wrong; see our Terms of Service.

Who receives information

We do not sell your personal information and do not share it for others' advertising. Service providers that process data for us:

• Hetzner Online GmbH (Germany): hosts our server and database in Germany.
• Cloudflare, Inc.: security and delivery network in front of plugcompass.com; handles every request, including your IP address, and tells us your country so we know whether to ask for cookie consent.
• Google Analytics (Google): usage measurement with cookies. In Europe only after you click "Accept". Google receives your IP address with each request; Google says Google Analytics 4 does not log or store IP addresses.
• Hexclave (formerly Stack Auth) and Google: "Sign in with Google".
• Anthropic, PBC (USA): AI processing as described above.
• Your browser's push service (Google, Mozilla, Apple or Microsoft): only if you allow the "How did charging go?" reminder; it delivers an empty message to your browser (and, if you tap "Still charging", one more 30 minutes later).
• Resend: sends the owner an email for each advertising-waitlist sign-up, each contact-form message and each feedback message or problem report (with the details entered, including your email if you gave one, up to 20 feedback emails a day), and the weekly statistics summary (totals and a few example feedback quotes with emails, links and numbers removed).
• Stripe, Inc. (USA): processes payments when a business books an ad: the advertiser's name, email, billing address, tax ID and card details (card details go only to Stripe, never to us). Drivers using the map are not affected.
• U.S. Department of Energy / NREL and Open Charge Map: our server sends them the coordinates and filters of a search to get station data, without your identity or IP address.

Your browser also connects directly to:

• OpenFreeMap for map images (sees your IP address and the map area you view);
• OpenStreetMap Nominatim for place-name search (sees your IP address and the text you type);
• Google Maps, only if you click "Directions".

We may disclose information if the law requires it, to protect the rights and safety of users or others, or as part of a sale or merger of the business (this policy would continue to apply).

International transfers

Our server is in Germany. Some providers above are based in the USA or other countries, so your data may be processed there. Where the GDPR applies, we rely on the provider's certification under the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses included in the provider's data-processing terms. Contact us for more information about these safeguards.

Cookies and browser storage

You can change your choice at any time with the Cookie settings link at the bottom of every page (on the map: in the About box under the station list).

Strictly necessary (always on; no consent needed):

Analytics (in Europe only after "Accept"):

If you click "Reject" (or later change to "Reject"), Google Analytics is not loaded and we delete cb_anon, cb_sess_ts and the Google Analytics cookies from your browser for plugcompass.com. You can also block cookies in your browser; searching still works, but signing in does not.

How long we keep information

• Usage events and visitor records: 14 months.
• "Did it work?" check-ins: 18 months.
• Reminder push addresses: deleted when the reminder is sent, at the latest after 1 day.
• Advertising waitlist entries: 24 months, or sooner if you ask.
• Contact-form messages: 24 months, or sooner if you ask.
• Feedback messages, problem reports, smart-search notes and recommend answers: 24 months, or sooner if you ask.
• Account information: until you ask us to delete your account.
• Station feedback: until you delete it, we remove it, or your account is deleted.
• Price reports: as long as they are useful to other drivers (they do not identify you).
• Daily secret for cookie-free statistics: 1 day. Security counters: a few days.
• Server logs: 90 days.
• Server backups are kept for a short period and then overwritten.

Advertisers. When a business books an ad we keep the ad text, contact details, the area it targets and the billing records (from Stripe) for as long as tax and accounting law requires, generally up to 7 years. Advertisers only receive totals (how many times their ad was seen and clicked), never information about individual visitors.

Your rights

• Everyone: you can ask for a copy of your personal data, ask us to correct or delete it (including your account), and edit or delete your own feedback at any time. Use our contact form (choose "Privacy request"). We may need to confirm the request comes from you. Data stored only under an anonymous daily ID cannot be linked to you, so we cannot find it for a request.
• In the EU, EEA, UK and Switzerland you also have the right to restrict processing, to data portability, to object to processing based on legitimate interests, and to withdraw consent at any time (Cookie settings) without affecting earlier processing. You can complain to a data-protection supervisory authority, in particular in the country where you live or work (in the UK: the ICO). We answer within one month.
• Location: you can refuse or revoke location permission in your browser at any time.

California residents. You have the right to know what personal information we collect, use and disclose, to ask us to delete or correct it, and not to be treated differently for using these rights. The categories we collect are listed above (identifiers such as account email and cookie ID, internet activity on our site, approximate location from searches, and what you contribute). We do not sell personal information and do not "share" it for cross-context behavioural advertising. Requests: our contact form; we answer within 45 days.

Do Not Track and Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as "Reject": Google Analytics and our analytics cookie stay off unless you choose "Accept" yourself. We do not respond to the older "Do Not Track" signal; you can use "Cookie settings" instead.

Children

PlugCompass is not intended for children under 13, and we do not knowingly collect their personal information. In the EU, EEA, UK and Switzerland, if you are under 16 (or the lower age set in your country), please do not create an account, contribute, or accept analytics cookies without a parent's permission. If you think a child has given us personal information, contact us and we will delete it.

Security

We use encrypted connections (HTTPS), restrict access to our server and database, do not store IP addresses with visits, and keep check-in identities and waitlist IP addresses only as hashes. No online service is perfectly secure, but we work to protect your information.

Changes to this policy

We will update this page when our practices change and change the "Last updated" date. For significant changes we will show a notice on the site.

October 22, 2026: added the feedback, problem-report and recommend forms. October 21, 2026: updated for visitors in Europe (GDPR, cookie consent).

Contact

Lissjos Engineering LLC, 1106 2nd St, Ste 103 #726, Encinitas, CA 92024, USA. Contact: plugcompass.com/contact