Privacy Policy

1. Who is responsible for your data

The data controller is Filip Kowalski, trading as Nomadic Studio, publisher of the Prawo Jazdy GO app and the prawojazdygo.pl website (together, "the Service").

For anything concerning personal data, write to legal@prawojazdygo.pl. We answer every request, including the ones we decline — in that case we explain why.

We have not appointed a data protection officer, because we are not required to. Requests go straight to the people who run the Service.

2. What the app processes

The app works without signing in. An account is optional (section 17). We do not require your name, phone number or any identity document. The optional contact field in feedback is free text — fill it only if you want a reply. We do process the following.

Identifiers

None of these contains your name, but each one recognises the same device over time. That makes them personal data under the GDPR, and we treat them accordingly.

Usage data

• sessions, screens and study features used, exam results, bookmarks and explanation views
• onboarding choices: language, licence category, whether you attend a driving school, reminder settings
• subscription offers and your choices, purchases and restorations, amount and currency
• each answer you give: the number of the question, whether the answer was correct, and the time — sent as a usage event, so this part of your study history exists on our side too
• how many ads you watched, and how many questions you answered in a session and on the day
• subscription status: active or none

Technical data

• device model, operating system version, platform
• app version and build number
• device language, region and time zone
• IP address — visible to any server the app connects to; we use it only to determine the country and to prevent abuse, and we do not store it in our statistics

Question difficulty statistics

To measure question difficulty, we send the question number and whether the answer was correct, without an attached user or device identifier. We use the totals to show which questions learners find hardest.

Purchases and subscriptions

Payments are handled by the App Store and Google Play. We never see or store card numbers or payment details. We receive which product was bought, when it expires, whether it renews automatically, and whether a free trial was used.

Where an install came from

If you install the app after clicking an ad, we use campaign information from the store with RevenueCat and Superwall to measure which advertising leads to installs and purchases.

Notifications

Study reminders are created and shown by your own device, at the time you choose. Without an account, we do not send push notifications from a server and we hold no push token for your device; with an account, see section 17.

Crash reports

Crash reports sent to Firebase Crashlytics include error details, an installation identifier, and device and app information. We use them to diagnose and fix faults.

Reports and feedback

If you send feedback or report an explanation, we receive your message, any contact details you provide, the affected screen or question and relevant app and study context. We use this to handle your report. These reports do not include a device identifier.

3. What the website processes

prawojazdygo.pl is a set of static pages. There is no login, no comment system and no advertising on it.

Visit statistics

We use our own visit statistics to understand how the website is used. They process the page and referring page, browser and device information, language, approximate country and interactions such as scrolling and clicks. Your IP address is processed to derive the country and distinguish visits, but is not stored in our statistics. This tool sets no cookies or persistent browser identifier and runs before you make a cookie choice.

Google Ads measurement

The website uses the Google tag to measure whether our Google Search ads lead to account creation in the web app. Google requests can occur before consent: Google receives connection information, including your IP address, page address and consent state. Google Ads cookies are enabled after you agree. We use this measurement for our own campaigns, not for remarketing or personalised ads.

When you arrive from an ad, we retain its click identifier and campaign labels in tab storage and pass them in links to the web app, including before consent. The shared pj_consent cookie records your choice about Google Ads cookies for the website and web app. The storage names and durations appear in section 14.

You can change your choice at any time with the "Cookie settings" link in the site footer.

Driving school form

The page for driving schools carries a contact form. It asks for the school name, the contact person's name, an email address, optionally a phone number, the approximate number of students per year, and your message. We use this only to reply. We do not add it to any marketing list.

Hosting

The site runs on Cloudflare infrastructure. The host necessarily processes your IP address, browser headers, the requested URL and the time of the request — a page cannot be delivered or automated traffic filtered without them. It may set its own technical cookies in the process.

4. Data on your device

The app keeps the following on your device. Some answer history is also sent for usage statistics (section 2), and signing in uploads study history and progress to your account (section 17):

• study statistics: your error rate per question, consecutive correct answers, when you last saw a question
• bookmarks, and the questions in them
• settings: licence category, reminder time, offline mode, sound, haptics
• images and videos downloaded for offline study

When you have an account, we also send the app language to our server so notifications are in your language.

You can remove local data by clearing the app data in system settings or uninstalling it. This does not delete analytics records or account data held on our servers; account deletion and other requests are explained in sections 11 and 17.

5. Legal bases and purposes

Every processing operation rests on a basis in Article 6(1) GDPR:

6. Who receives the data

We do not sell, rent or trade data. We do not pass it to AI systems or data brokers. The full list of recipients follows.

Providers acting as our processors handle data on our instructions under processing agreements. Independent controllers decide their own purposes under their privacy policies; you can also contact them about their processing.

Beyond this we may disclose data to public authorities where the law requires it, and to a legal successor in the event of a sale or merger. In the second case we will say so on this page before any transfer.

7. Advertising, consent, and tracking on iOS

The free version of the app shows ads, which is what keeps the questions free. Subscribing removes them.

Consent to advertising

In the European Economic Area, the United Kingdom and Switzerland, the app shows a consent dialog on first launch, provided by a Google-certified consent management platform and conforming to the IAB TCF standard. You agree separately to storing information on your device and to each advertising purpose. Declining does not block the app — you will see non-personalised ads, chosen without using your advertising identifier. The dialog covers the ads shown inside the app. It does not cover campaign and revenue measurement — checking which of our own ads led to your install or purchase — which rests on our legitimate interest (section 5); you can object to it as described in section 8.

iOS: the tracking prompt

On Apple devices the system additionally asks for permission to track (App Tracking Transparency). That covers access to the IDFA and combining data from this app with data from other companies' apps or websites for advertising. If you do not allow it, the app cannot read the IDFA and ads will not be personalised. You can change your answer at any time under Settings → Privacy & Security → Tracking.

System-level controls

• Android: Settings → Google → All services → Ads — you can delete the advertising ID or turn off personalisation
• iOS: Settings → Privacy & Security → Apple Advertising, and Tracking

8. Withdrawing consent, and objecting

Advertising — withdrawing consent

You can withdraw consent to advertising at any time, and as easily as you gave it. Withdrawal does not affect processing that was lawful beforehand.

• In the app: Settings → Privacy choices — this reopens the same advertising consent dialog and lets you change any answer. The entry appears where the consent platform requires it, which in practice means the European Economic Area, the United Kingdom and Switzerland
• On iOS, additionally: System Settings → Privacy & Security → Tracking
• On the website: the "Cookie settings" link in the footer of every page reopens the Google Ads cookie banner
• In writing: email legal@prawojazdygo.pl

Statistics, crash reports and campaign measurement — objecting

These do not run on consent, so there is nothing to withdraw. You have the right to object instead, under Art. 21 GDPR. There is no switch for it in the app today — write to legal@prawojazdygo.pl and we will stop collecting for that installation. Include the analytics identifier from Settings → Analytics ID (copy it from the app) so we can find what we already hold and delete what we can identify.

Either way, study modes, mock exams, bookmarks and any access you paid for continue unchanged.

9. Transfers outside the EEA

Some providers listed in section 6 process data outside the European Economic Area, mainly in the United States. Each transfer relies on one of the mechanisms in Chapter V GDPR:

• a European Commission adequacy decision — for US providers participating in the EU–US Data Privacy Framework (Art. 45 GDPR)
• standard contractual clauses approved by the European Commission, together with a transfer impact assessment and supplementary technical safeguards, where no adequacy decision applies (Art. 46 GDPR)

The European Commission adequacy decision for the EU–US Data Privacy Framework is in force but is under appeal before the Court of Justice of the European Union. Should it cease to apply, we will move those transfers onto standard contractual clauses.

We will provide a copy of the safeguards on request — write to legal@prawojazdygo.pl.

10. How long we keep data

11. Your rights

You have the following rights against us:

• access to your data and a copy of it (Art. 15 GDPR)
• rectification of inaccurate or incomplete data (Art. 16)
• erasure — the "right to be forgotten" (Art. 17)
• restriction of processing (Art. 18)
• portability in a machine-readable format (Art. 20)
• objection to processing based on legitimate interest (Art. 21) — this is the one that covers usage statistics, crash reports and campaign and revenue measurement; see section 8
• withdrawal of consent at any time (Art. 7(3)) — this covers advertising; see section 8

We make no decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you (Art. 22 GDPR). The question-selection algorithm runs entirely on your device and only changes the order you study in.

Send your request to legal@prawojazdygo.pl. We answer within one month. If the matter is complex we may extend that by two further months, and will tell you within the first month if we do. The steps for deleting your account or selected data are on the data deletion page.

Complaint to a supervisory authority

If you believe we process your data unlawfully, you can lodge a complaint with a supervisory authority. Because we are established in Spain, our lead supervisory authority is:

You may also complain to the authority of your habitual residence or of the place of the alleged infringement. For residents of Poland that includes the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw — uodo.gov.pl.

12. Children and young people

The app is for people preparing for a driving licence exam. In Poland a course may start no earlier than three months before the required age, so most users are 16 or older.

Under Art. 8 GDPR and Art. 4 of the Polish Personal Data Protection Act, a person aged 16 or over can consent to information-society processing on their own. That matters here for advertising consent. Usage statistics and crash reports do not run on consent — they run on legitimate interest — so a parent who wants them stopped should object under Art. 21 (see section 8), not “withdraw consent”.

If you are under 16, a parent or guardian should give or approve consent to advertising. Study modes, mock exams and bookmarks all work without advertising consent. If you are a parent and believe your child under 16 consented to ads without your knowledge, or you want analytics stopped for their install, write to legal@prawojazdygo.pl — include the Analytics ID from Settings if you have the device.

13. Security

• all app and website connections are encrypted with TLS
• Firebase Authentication handles sign-in through Apple, Google or an email link; our app server does not store passwords for those accounts
• the operating system’s app sandbox protects your local study database; access to account data on our server requires authentication
• only the person running the Service has access to the statistics
• we collect only what is described above — less data means a smaller consequence if anything goes wrong

No safeguard is absolute. If a personal data breach occurs that is likely to result in a high risk to your rights, we will notify the Agencia Española de Protección de Datos within 72 hours and tell you on this page and in the app.

14. Cookies and device storage

Storing information on your device, or reading information already stored there, requires consent unless it is necessary to deliver a service you asked for — Art. 399 of the Polish Electronic Communications Law, implementing Art. 5(3) of the ePrivacy Directive. The rule covers not only website cookies but also identifiers written by an app. Advertising identifiers are used only after you consent. The analytics identifier is different: it is a random string the app writes to its own storage on first launch, which we treat as necessary to run and improve the Service. If you disagree, you can object — see section 8. Everything we store is listed below.

Website

Our visit statistics set no cookies or persistent browser identifier and run before a cookie choice. Google requests may also occur before consent, as section 3 explains. Google Ads cookies are enabled after you agree. You can change your choice with the "Cookie settings" link in the footer.

App

The app stores the settings, progress and identifiers described in section 2 in its own system-allocated storage. Advertising identifiers are used only after you consent; the analytics identifier is written on first launch.

15. Changes to this policy

We update this policy when the way we process data changes — for example when a provider is added or removed. The date of the last change appears at the top.

We will announce material changes in the app before they take effect, particularly any that need fresh consent. We never repurpose data under a consent you gave for something else; we ask again.

16. Contact

Write in Polish, English, German or Ukrainian — we reply in the same language.

The Polish version of this policy is the binding one, as the Polish Language Act requires for consumers in Poland. This translation is provided for convenience; where the two differ, the Polish text governs.

17. Account, friends and progress sync

An account is optional. Without one the app works exactly as before, and sections 1–16 cover everything we process. You only create an account if you want your progress saved on our server, to add friends and to compare results with them. This section explains what happens to your data then.

Signing in creates your Firebase account and starts account setup and progress sync. Closing the username screen does not delete the account or sign you out; you can choose a username later. Progress sync does not require one.

The sign-in provider may also share your display name and profile photo URL with Firebase. We do not copy them into our friends database or show them to friends; we use the username and icon you choose.

What we store when you create an account

• the user ID assigned by Firebase Authentication
• your email address, if the sign-in provider shares it; if you sign in with Apple and hide your address, we only get Apple’s relay address
• the username you choose, and the icon you pick
• how you signed in: Apple, Google or an email link
• the app language
• for each device you sign in on: the install ID, the platform (iOS or Android), the push token and the app version

We keep account and sync records needed to manage your account and study history.

Study progress

When you sign in, we upload the study history on your device and then sync new answers, study modes, exam results and progress. We use this to calculate your points, streak and rankings among friends. We also keep friend requests, friendships and ranking history to provide those features and related notifications.

Who can see what

Your username and icon are visible to anyone who knows your exact username or has your invite link. Your daily streak and scores are visible only to your friends — people with whom you have both accepted a friend request. There are no public profiles, and nobody can search by part of a name. Your email address is never shown to anyone.

Blocking and reporting other users

You can block another user. We store who blocked whom until the block is lifted or until either account is deleted. A block removes any friendship and pending friend requests between the two of you, and hides each of you from the other’s username search.

You can also report another user, choosing a reason from a list: offensive username, harassment, spam or other. We store your user ID and theirs, their username at that time, the reason and the time, and send them to our internal moderation channel on Telegram. We do this to keep the friends feature safe. The legal basis is our legitimate interest in keeping the feature safe and preventing abuse (Art. 6(1)(f) GDPR); you can object under Art. 21. Telegram’s infrastructure sits outside the EEA, see section 9.

We keep reports for 12 months. If you made a report and delete your account, we remove the link between you and that report from our database; copies already sent to the moderation channel are not deleted automatically. We do not tell the reported user who reported them.

Who processes this data

If you sign in with Apple or Google, that provider confirms your identity to us under its own privacy policy. Transfers to the United States rely on the safeguards in section 9. The legal basis is performance of a contract (Art. 6(1)(b) GDPR): the account and friends features are a service you ask us for. We do not sell this data either, and we do not feed it to any AI system.

Notifications

With an account, our server can send you push notifications: when someone sends you a friend request, when someone accepts yours, and once a day in the evening if friends overtake you in the weekly ranking. The friends feature asks for notification permission after your first friendship. The app may ask for that permission earlier when you turn on reminders. You can turn them off at any time in your system settings.

How long we keep it, and how to delete your account

We keep your account data until you delete the account. You can do that in the app: Settings → Account → Delete account. You can also email help@prawojazdygo.pl — we will then ask you to confirm the account is yours. The data deletion page sets out the steps, and what we delete and keep.

Deleting your account removes your account and sign-in records, linked devices, progress, friendships, blocks and rankings from our active service. Friends will no longer see you. We reserve the released username for 30 days, then delete that reservation. Account deletion does not cancel a subscription; manage it through the App Store or Google Play. RevenueCat retains purchase data as described in section 10.

You can delete your account before choosing a username. If you cannot sign in or the delete option is unavailable, use the support email above. Signing out or uninstalling the app does not delete your server account.

Account deletion covers our active account and friends database and Firebase Authentication. It does not automatically erase earlier analytics events, purchase records or backups. Other data remains subject to the retention periods in section 10; contact legal@prawojazdygo.pl to request its deletion.