Privacy policy for DrivePrep RO

The studying happens on your device. Questions, explanations, the spaced-repetition schedule and the record of what you got wrong are held in a database inside the app, and none of it needs an account or a connection.

What we hold on a server is what an account requires and what you choose to sync to it. We run no analytics, serve no advertising, and ship no tracking or attribution SDK of any kind — there is nothing in the app whose purpose is to watch you use it.

This policy describes the application as it is built. Where a part of it is not switched on yet, it says so rather than describing an intention as a fact.

You can practise as a guest. A guest session is issued by our server so that the app has something to authenticate with, and creating one records a single line in our security log: the time, the fact that a guest was created, and the identifier the app generates for the install. That identifier is not linked to a person, is not used for advertising or measurement, and exists so that an abusive flood of guest sessions can be investigated. It is deleted after 180 days.

Nothing you answer as a guest is sent to us. Your attempts, your review schedule and your mistakes stay in the app's own storage on the device.

An account can be created with an email address and a password, or through Sign in with Apple or Sign in with Google. What we store is: your email address, if you registered with one; a BCrypt hash of your password, never the password itself; the opaque subject identifier Apple or Google issues for you, if you signed in that way; and the display name, licence category and language you set in your profile.

We also store a hash — not the value — of the refresh token that keeps you signed in, along with the short-lived, single-use tokens that verify an email address or reset a password. Those are likewise stored hashed.

The lawful basis for all of it is performance of a contract under Article 6(1)(b) GDPR: it is what an account has to have in order to be an account. If you do not want any of it, use the app as a guest.

The question bank, the explanations, the legal texts and the road signs are shipped as content and are the same for everybody — they are not personal data and they do not travel back to us.

Your practice and exam attempts, the individual answers and timings inside them, the FSRS scheduling state that decides when a question comes back, your mistake bank and your settings are written to a SQLite database in the app's private storage. On the web build they live in the browser's own storage for that site. Uninstalling the app, or clearing the site data, removes them.

A signed-in account can upload its practice history so it continues on another device. What is uploaded is: the attempt records — category, mode, timing, whether it was passed — the per-question answers and response times inside them, and the spaced-repetition state for each question.

That is your own progress and nothing else. There is no field in it for a location, a contact, a photo, an advertising identifier or anything else about you, because none of it is collected in the first place. As a guest, sync does not happen at all.

The tutor explains a question you are looking at. When you ask it to, our server sends the language model three things: the text of that question, the answers you selected, and the passages of theory or law our own content retrieval judged relevant. It does not send your email address, your name, your account identifier or anything else that identifies you.

The model is Mistral AI, in the European Union. A second provider exists in the code, hosted in China, and it is off by default and stays off; if that ever changes, this page will be updated before it does, not after.

We keep a per-day counter of how many tutor requests an account has made and roughly what they cost, because that is what a quota is made of. We do not store the conversations: there is no table in our database that holds the tutor's questions or its answers.

The tutor says on screen that it is a machine and that it is a study aid rather than legal advice, and it is worth taking that literally. It can be wrong. The article cited under each question is the thing to trust.

No analytics or product-measurement library. No advertising, no ad identifier and no attribution SDK. No social-network SDK. No session recording, no heatmaps, no A/B testing service, no push-notification vendor. Nothing is sold to anyone, ever, because there is no arrangement under which anything could be.

The website build keeps your session token in the browser's local storage so that you stay signed in. That is storage strictly necessary for a service you asked for, and it is not used to follow you anywhere. There are no advertising or analytics cookies.

When you sign in, register, ask for a password reset or start a guest session, your IP address is held in the server's memory for a short window in order to rate-limit those requests. It is not written to our database.

The reverse proxy in front of the application keeps ordinary web access logs, which include IP addresses, in the way that every web server does. Errors are reported to LightTrace, our own error-monitoring service, which runs on our own machines — it is not a third party, and its purpose is a stack trace, not a profile.

Account data — the email address, the password hash, the Apple or Google identifier, the profile — is kept while the account exists, and is removed when you delete it.

Refresh tokens expire after about 45 days and are deleted 30 days after that. Email-verification tokens expire in 24 hours and password-reset tokens in 30 minutes; both are deleted 7 days after expiry. The nonces used to make Sign in with Apple replay-proof expire in five minutes and are deleted after a day. The security log is deleted after 180 days.

Those periods are enforced by a job that runs every night, not by a promise. Encrypted database backups are kept for seven daily copies and four weekly ones; deleting your account does not reach backwards into a backup already taken, and those copies age out on that schedule.

The application server, the database and the backups are hosted with Hetzner Online GmbH, in the European Union. Backups are encrypted with a key we hold before they leave the machine, so the storage they sit on cannot read them.

The question bank and the sign drawings are distributed through Cloudflare R2. That bucket holds published educational content and no personal data at all.

Apple and Google are involved only if you choose to sign in with them, as the identity provider you are already using, and — once the app is on sale — as the shops that take the payment. Mistral AI receives what section 06 describes, and only when you use the tutor. That is the whole list.

Under the GDPR you have the right to see the personal data we hold about you, to correct it, to have it erased, to restrict or object to what we do with it, and to receive it in a portable form.

Export and erasure are already built on the server. An export returns your profile, your attempts and the answers in them, your spaced-repetition state, your entitlements and your tutor usage counters as a single file — it deliberately leaves out your password hash. Deleting your account revokes every session immediately, removes the rows that belong to you, and anonymises the account record so that nothing left in the system points back at you.

The app's own buttons for the two of them sit in Settings, marked as not yet available, and that is the truth rather than a placeholder. Until they work, ask us: write to info@robomiri.com and we will run the export or the deletion for you and reply within the month the law allows us — usually the same week.

You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the supervisory authority where you live — in Romania, the ANSPDCP.

Passwords are stored only as a BCrypt hash at cost 12. Access tokens are signed with RS256 and are short-lived; refresh tokens are stored hashed, rotate on every use, and reuse of an old one is treated as theft and invalidates that whole session family. Deleting an account or resetting a password invalidates tokens issued before it, rather than letting them run out their clock.

Backups are encrypted before they are uploaded. We are not claiming full-disk encryption of the live database here, because that is a property of infrastructure we do not administer and we would rather say less than we can show.

The paid tier is not live. Neither store has a product for it yet, no purchase has ever been made or verified, and no payment provider currently receives anything about you.

What is built and waiting is this: fifteen questions and the whole theory and road-sign section are free, and sixty days of everything else costs a single payment of 35 lei, bought again when it runs out rather than renewing itself. On the phone, Google Play and the App Store take the money and hand us a receipt to check — never your card details, your billing address or your name. On the web, Paddle would be the merchant of record and would hold the billing and tax details that role requires; what reaches us is the fact of a valid purchase, not the payment behind it.

This page will be updated before the first payment is taken, not afterwards.

The app is for people preparing for a Romanian driving licence, which puts its audience at roughly sixteen and upwards. It is not directed at younger children, it asks for no more about you than an account needs, and it shows no advertising to anyone.

DrivePrep RO is independent. It is not affiliated with, endorsed by or connected to DRPCIV, DGPCI or the Romanian Police. The questions are written here against OUG 195/2002 and HG 1391/2006, both published law, and each one names the article it tests. No official question bank is reproduced in it, and no result in the app counts for anything outside it.

If this policy changes, the date at the top changes with it, and anything material is called out in the app's release notes. Anything that changes what the app does with data is written here before it ships, not after. We do not change it retroactively.

RoboMiri, Rotterdam, the Netherlands — info@robomiri.com. A real person reads it.