Privacy Policy

Who we are.

Naj Autoškola is an independent app for people preparing for a driving-theory test. It is not made by, affiliated with, or endorsed by any government authority.

The controller responsible for your data — the person who decides why and how it is used — is Tomáš Beňo, who publishes Naj Autoškola under the name Tree Among Shrubs. That name is a developer name rather than a company: there is no registered entity behind it, and the address and the email at the foot of this page are how you reach the controller. They are the same name and address the app's store listing carries.

You can reach us about anything on this page, including any of the rights below, at anima@tree-among-shrubs.com

The short version.

• There is no account and no sign-in. Your tests and your answers stay on your device, and we keep no copy of them.
• The app can send two things: crash reports and usage statistics. Both are switched off until you turn them on.
• The app shows ads. Whether they are personalized for you is your choice, and personalization is switched off until you turn it on. In the EEA, the UK and Switzerland, Google's own consent form comes first, and if you decline it you are shown only limited ads, which often means none.
• We do not sell your data, and we do not build an advertising profile of you. We never ask for your location, your contacts, your photos, your camera or your microphone.

What stays on your device.

The app stores these on your device:

• Every test you take: the questions, your answers, the timestamps, whether you passed, and the mistakes you made.
• Your statistics, your per-question results, and the list of questions you got wrong.
• Your settings: the exam and licence category you picked, the app language, whether answers are checked as you answer, and your three consent answers.
• Where you were in the app when you last left it.
• The identifier our analytics knows this device by, once anything has been sent: it is kept here so that you can read it in the app's Settings and quote it to us, with the switches on or off.

There is no account and no sync, and nothing in this list is sent to us as a copy: the only things from this list that we ever receive are the five things the next paragraph names. The one copy of this list that leaves the device on its own is the system backup described below. Clearing the app's data or uninstalling the app deletes everything the app itself holds.

Five things in this list are also sent, as part of the usage events described below and only while you have Usage statistics switched on: the identifier listed above, which is what those events are filed under (and which crash reports carry too, if you have those switched on), plus which exam and licence category you picked, which language you chose, how you answered the consent screen, and which screen you were on. Each test also contributes what kind it was, how long it took, whether you passed and how many answers were wrong. What you were asked, what you answered, and which questions you got wrong do not leave your device in any form.

The one copy that leaves your device on its own.

On Android, the operating system's own backup (Android Auto Backup, on by default for apps) copies the app's data file into your own Google Drive account, so that reinstalling the app or moving to a new phone brings your history back. On iOS, the equivalent is the device backup to your iCloud account or to your computer. That copy is made by the operating system, not by us: we cannot read it, we never write to it and we never read it back, and it sits in your account under Google's or Apple's terms. You can turn the backup off in your device's backup settings, and delete the copy from your account.

If you switch the Android backup off, you will lose your test history on a reinstall.

Crash reports — off until you agree.

If you turn on Crash reports, then when the app crashes it sends us the crash: the error and its stack trace, the device model and operating system, the app version, a pseudonymous identifier the analytics service keeps for your device — one that singles out the device rather than naming you — and the country the request came from. We use it for one thing — finding and fixing the crash. It is not linked to your name, we have no name to link it to, and we do not use it to profile you.

With the switch off, no crash report is sent, and no connection for crash reporting is opened on your behalf.

Usage statistics — off until you agree.

If you turn on Usage statistics, the app sends us how the app is used, so that we know what to fix and what to build. What it carries:

• That you finished onboarding, which exam and licence category you picked, and which language you switched to.
• That you started or continued a test or a drill, and whether you finished it or abandoned it.
• How a finished test went: how long it took, how many answers were wrong, and whether you passed, for the kinds of test that have a pass mark. A test you abandoned contributes how long you had spent on it and how many answers you had given.
• Which screen you were on, that you opened a situation, and that a question bank or a question's picture was missing or failed to load.
• How you answered the three questions on the consent screen, and whether you later changed one of them in Settings.

It does not carry your answers, which questions you got wrong, any test number, anything you typed, or any identifier that names you. The events also carry the platform (Android, iOS or the web), the app version, whether the build is a release or a development one, and the country the request came from. That country is worked out from the connection as the event arrives — not from anything on your device — and the address it is worked out from is not kept. There is no login, so nothing is ever attached to an identity: every event carries a pseudonymous device identifier instead, one that singles out your device rather than naming you. That is what lets us count how many people reach a screen without knowing who they are.

With the switch off, nothing is sent.

Ads — generic unless you agree to personalized ones.

Ads appear in the Android app. The web version shows none, because the SDK the ads come from serves apps rather than web pages, and the iOS version shows none because it has no ad support yet. The ads come from Google, through its Google Mobile Ads SDK (AdMob). The app shows them whether or not you agree to personalization.

Each time the app asks Google for an ad, Google's SDK sends that request with:

• Your IP address, from which the approximate location is derived.
• Device and app details: model, operating system version, app version, language and screen size.
• Which ad was shown and what you did with it — that you saw it, or that you tapped it.
• An identifier the SDK stores on your device, used to limit how often you see the same ad.
• The advertising ID of your Android device, which you can reset or delete in your device's settings. With Personalized ads off, the app tells Google not to use it to choose the ad for you; Google's SDK may still use it to deliver and measure ads and to prevent fraud.

Ads appear in the practice flow: a banner, and occasionally a full-screen ad before a test.

Google is not acting on our instructions here. For serving and measuring ads it acts as an independent controller, with its own purposes, its own legal bases and its own privacy notice at policies.google.com/technologies/partner-sites. Google also shares ad data with the advertising partners listed in its own notices, and neither its servers nor theirs are confined to the European Union: that transfer rests on Google's own safeguards, not on anything we do. Ad data is kept for as long as Google's own retention rules say, which is not a period we can set or promise on their behalf.

Whether the ads are personalized is the one choice you make here. If you turn on Personalized ads, Google may use your advertising ID and what it already knows about you to choose ads that suit you. If you leave it off — which is where everyone starts — the app asks Google for generic ads, which are not chosen for you, and tells Google not to use your advertising ID to choose them. This choice changes which ads you see, not whether there are any. Generic does not mean that nothing is read: an ad request reads and stores something on your device whether or not the ad is personalized, as the list above says. Personalized ads are only for people 18 or older; the section on users under 18 says what that means for everyone else. You can change your mind at any time in Settings, and the change takes effect at the next ad request.

In the EEA, the UK and Switzerland, Google shows its own consent form before the first ad is requested, after this app's consent screen. It asks whether Google and its partners may store and read information on your device to serve ads, and whether the ads may be personalized. Google is an independent controller for what you tell it there. If you decline, Google serves limited ads only — ads that do not use cookies or other storage on your device and are not personalized — and often has none to show; everything else in the app works as before. The form is not shown to anyone under 16, who are served generic ads as described below. Where the form applies, Settings has an Ad privacy choices entry that reopens it, so you can change your answer at any time.

Removing the ads.

The app is free and supported by ads. Google Play sells a one-time purchase, Remove ads, that switches them off for good. Google Play handles the payment: its own terms and privacy policy govern that side of the transaction, and we never see your name, your card number or your billing address. When the app starts, and each time you come back to it, it asks Google Play whether your Google account owns that purchase, and if it does the app shows no ads. That question and its answer stay between the app and Google Play, and nothing about them is sent to us. If we add other paid features later, this page and the terms will say so before you can buy anything new.

Feedback you send us yourself.

The app's feedback screen opens your own email app with a message addressed to us, containing what you wrote, the app version, and — if you leave it in — the device model and operating system. If you ask for it as a privacy request there, the app also puts the device identifier from Settings in the draft, because that is what lets us find what we hold about you; an ordinary message carries no identifier. Nothing is sent unless you press send in that email app, and any line can be deleted before you do. We use what you send to reply to you and to fix what you reported.

Who else receives your data.

This is the complete list of third parties that can receive anything because you use the app:

PostHog

The usage statistics and crash reports described above, if you turned them on. They are stored in the European Union, in PostHog Cloud's EU region. PostHog is our processor: it acts on our instructions, under a data processing agreement, and does nothing else with them.

Google (Google Mobile Ads)

The ad request described above, which the app makes for every user and which asks for a personalized ad only if you agreed to that. Google is an independent controller for ad serving and measurement, with its own purposes and its own legal bases.

Google Play, Apple App Store

The purchase, if you bought Remove ads, and the app's question to Google Play whether you own it. The store is an independent controller for the payment and for the answer to that question.

Your own Google Drive or iCloud account

The device backup described above, which the operating system puts into your own storage rather than sending to us.

There is no other SDK in the app that talks to a server. We do not sell your data, and we do not share it for anyone else's advertising except as the Google entry above describes.

How long things are kept.

• On your device: until you clear the app's data or uninstall the app. Nothing expires on its own.
• Usage statistics: one year, which is how long PostHog keeps events for us.
• Crash reports: one year.
• Ad data: according to Google's own retention rules, as described above.
• Emails you send us: as long as it takes to answer you and keep a record of the fix.

Your rights.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to:

• Know what we hold about you, and receive a copy of it.
• Have it corrected if it is wrong, and deleted.
• Have its use restricted, or object to it.
• Receive it in a portable form.
• Withdraw your consent at any time. The three switches in Settings do exactly that: after you switch one off, crash reports and usage statistics are no longer sent and your ads are no longer personalized. Withdrawing does not affect the lawfulness of what was done with your consent before you withdrew it.
• Complain to a supervisory authority. In Slovakia that is the Office for Personal Data Protection of the Slovak Republic, and you may also complain in the country where you live.

Our legal basis is your consent (Article 6(1)(a) GDPR) for usage statistics, crash reports and personalized ads — including, for those three, the consent the law requires before information is stored on or read from your device (ePrivacy Directive, Article 5(3)). That is why all three switches start off, and why nothing they govern is sent or used before you answer. For ads, where Google's consent form is shown it is that form that collects the consent the law requires before ad information is stored on or read from your device, and where you decline, only limited ads that need no such storage are served. Two things rest on a different basis, because no switch governs them: showing generic ads, and the ad request that needs, on our legitimate interest (Article 6(1)(f)) in paying for the app by showing ads; and the emails you send us, on our legitimate interest (Article 6(1)(f)) in answering the people who write to us.

Because the app has no account, most of what we could hand over is already on your own device, where you can read it. What we do hold — the usage statistics and crash reports — is filed under an identifier the app shows you in Settings, and puts in the draft when you write from the feedback screen as a privacy request. Either way we can find your records. If you would rather we delete them, write to the address at the foot of this page and we will. We answer any request under these rights within one month of receiving it.

Users under 18.

Learner drivers are not all adults: a moped licence (AM) can be taken from 15, and a light motorcycle or light four-wheeler (A1, B1) from 16. So the app is written for learner drivers from about 15 up, and the questions it carries are the ones those candidates are examined on.

There are two lines, and they are not the same. Under 16, you cannot agree to crash reports or usage statistics yourself: in Slovakia a person under 16 cannot give that agreement alone, and only a parent or guardian can agree on your behalf. Until they do, leave both off — nothing in the app depends on them. From 16, those two are yours to answer. Personalized ads are for people 18 or older: under 18 that switch is locked, whatever a parent or guardian agrees to, and the ads you are shown are generic. The app still shows ads to everyone, you included, and tells Google your age band when it asks for one: under 16, or before you have answered, it flags the user as under the age of consent and limits the ads to general-audience content; from 16 to 17 it limits them to teen content. Apart from that ad request, we do not knowingly collect data from anyone under 16 unless a parent or guardian has agreed to it on their behalf.

Security.

What the app stores stays inside the app's own storage on your device, protected by the operating system's app isolation and, on a locked phone, by your lock screen. The little that leaves — statistics, crash reports and ad requests — travels over an encrypted HTTPS connection. No system is perfect, but collecting as little as possible in the first place is the most reliable protection there is.

Changes to this policy.

The policy has a version, and the app remembers which version you accepted. When this text changes in a way that matters — a new data flow, a new recipient, a change in what we collect — we bump the version, and the app asks you again on its next launch rather than stretching your earlier agreement over something it never covered. This is version 4. It changes what the ads switch means: before, the app showed ads only to people who turned them on; now it shows them to everyone, and the switch decides only whether they are personalized. That is why you are asked again, and why everyone starts again from generic ads.

The copy you accepted is the copy the app itself shows you, and it carries the date at the top of this page. Where the two have drifted apart, an app you have not updated yet is showing you the older one.

Contact.

Write to us about anything on this page: a question about your data, a request to see it or delete it, or a complaint.

Tomáš Beňo, publishing as Tree Among Shrubs
Podháj 6139/51, 974 05 Banská Bystrica, Slovakia
anima@tree-among-shrubs.com