Privacy Policy

This Privacy Policy explains what information Noble Gas ("we", "us", "the app") collects when you use the mobile app and the website at noble-portal.com, how we use it, who we share it with, and the choices you have. By creating an account or using the app you consent to the practices described below.

Effective date: February 1, 2023 · Last updated: July 28, 2026

Operator: Noble, 131 Buckingham Street, Suite 301, Hartford, CT 06106.
Contact: jfrisbie@noblegasct.com

1. Guest browsing

You do not need an account to browse outlet locations, wash sites, or the rewards catalogue. In guest mode we process only anonymous technical data. An account is required only for account-based features: earning points, redeeming rewards, your membership card, and your profile.

2. Information we collect

2.1 Required at signup

• Full name and email address.
• Password, hashed with Argon2 on our server. We never store, view, or transmit the plaintext password.

2.2 Optional

• Phone number.
• Date of birth, only collected for birthday rewards and gated by a minimum age.
• Referral code.
• Email and SMS marketing consent. Both are off by default — we only contact you this way if you opt in.
• Profile photo, from your camera or photo library, stored on our AWS media storage.
• Fleet accounts additionally provide business contact information, vehicle count, and monthly gallon estimate.

2.3 Generated automatically

• Loyalty points balance, tier status, and transaction history (fuel grade, wash type, amount, date, location, points earned or redeemed, barcode scans).
• Streak, badge, and spin-the-wheel activity.
• Push notification tokens (Firebase Cloud Messaging) and device information (model, OS version).
• Crash and diagnostic data.

2.4 Location

• Approximate and precise location, only while the app is in use and only after you grant OS permission. Used to find nearby outlets and wash sites and to give directions; cached on your device and sent to us only over an authenticated connection.

3. How we use it

• To create and operate your loyalty account.
• To award and redeem points at fuel pumps and wash kiosks.
• To deliver notifications you have opted into.
• To detect, investigate, and prevent fraud or misuse.
• To meet our legal and tax obligations.
• To produce aggregated, de-identified analytics that help us improve the product.

4. Payments

The app does not process payments and collects no payment card data. Fuel, in-store, and car wash purchases happen at the pump or point of sale, outside the app. Any car wash membership billing is handled by the DRB car wash operator at the kiosk.

5. Sharing

We do not sell your personal information and do not share it for cross-context behavioral advertising. The app contains no advertising SDKs and no cross-app or cross-site tracking, so it does not show the Apple tracking prompt. We share data only with the service providers required to run the app, each contractually required to protect it to at least the standard set out in this policy:

• Firebase Cloud Messaging (Google) — delivers push notifications; receives device push tokens.
• Firebase Analytics (Google) — pseudonymous usage events; never includes your name, email, or phone number, and is disabled in debug builds.
• Firebase Crashlytics (Google) — receives crash reports.
• Sentry — error and performance monitoring, with PII scrubbing enforced before events leave your device.
• Google Maps — powers the outlet locator map; Google receives your IP address and the map viewport when a map loads.
• Google Sign-In and Sign in with Apple — optional social login; we receive only your name and email.
• Apple Wallet (iOS) — optional membership pass, generated by our servers and added to your device locally.
• Amazon Web Services (AWS) — hosts the app backend, database, and media (including your profile photo), in US regions.
• Mailchimp — only if you opt into our newsletter; unsubscribing in the app removes you from the audience.
• DRB Patheon — operates the car wash point-of-sale that validates your wash redemption codes and handles any car wash membership billing at the kiosk, not in the app.
• Invenco / Gilbarco Passport — receives only the loyalty identifier needed to recognize you at the fuel pump, no other personal data.

6. Security

Passwords are hashed with Argon2. All network traffic is encrypted in transit using TLS. Authentication tokens are stored in the iOS Keychain or Android Keystore, never in plain app storage.

Every points event is appended to a tamper-evident, SHA-256 hash-chained audit log, and database access is restricted to the systems and staff that need it.

7. Retention

• Account profile data — kept for the life of your account and deleted when you delete your account.
• Transaction and audit records — retained up to 6 years in anonymized or pseudonymized form for tax and compliance purposes.
• Crash and diagnostic data (Crashlytics, Sentry) — approximately 90 days.
• Analytics data (Firebase) — up to 14 months.
• Push notification tokens — until you log out or uninstall the app.
• Cached location — short-lived and kept only on your device.

8. Your rights and choices

• View or correct your name, email, and phone number from Profile → Personal Details.
• Delete your account permanently, in-app from Profile → Delete account, or at noble-portal.com/account-deletion.
• Request a data export by emailing jfrisbie@noblegasct.com.
• Turn push notification categories on or off in-app.
• Opt out of marketing emails or SMS at any time.
• Revoke location permission from your device settings at any time.

California residents (CCPA/CPRA) have the right to know, delete, correct, and receive a portable copy of their personal information, the right to non-discrimination for exercising these rights, and may designate an authorized agent to submit requests on their behalf. We do not sell personal information and do not share it for cross-context behavioral advertising.

9. Children's privacy

Noble Gas is not directed to children under 13 (COPPA). Date-of-birth entry is gated by a minimum age. We do not knowingly collect personal information from children; if you believe we have, contact us so we can delete it.

10. International transfers

Our service providers process data in the United States. By using the app you consent to your information being transferred to and processed there.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced in the app and by updating the "Last updated" date at the top of this page.

12. Contact

Questions or requests: support@noble-portal.com. We respond to verified requests within 30 days.