Teoriflyt.
Privacy policy
This page explains what Teoriflyt stores about you, why, and for how long. We store as little as possible.
In short
- Without an account, your progress is stored only on your device.
- With an account, we store your email address and your progress, so it follows you.
- Purchases are made in the App Store or Google Play. We never get your card details.
- We have no ads, sell no data and use no tracking.
- You can download your data and delete your account yourself, in the app or on the web.
Who is responsible?
The controller is the sole proprietorship Davarpanah Konsulenttjenester, organisation number 934 075 994, Gamleveien 138B, 1475 Finstadjordet, Norway. Teoriflyt is a service of this business.
If you have questions about privacy, or want to use your rights, write to kontakt@teoriflyt.no. You can also call +47 414 89 849.
Without an account
If you use the app without an account, your progress and settings are stored only on your device. They are not sent to us.
A few things reach our server even without an account: crash reports (see below), and a report about a question if you send one. If you create a challenge for a friend, the app makes a random user id on the server, with no email address. It is deleted after 30 days without use if no data is linked to it.
With an account
You create an account and sign in with your email address. We email you a one-time code, and you type it into the app. This is what we store:
| What | Why |
|---|---|
| Your email address | So you can sign in, and to send you the sign-in code |
| Your answers, sessions, test results, study plan, badges, daily goal and your answer if the app asks whether you passed the theory test | So your progress follows you between devices, and to adapt your practice |
| Settings, language, test date and your choice about usage statistics | So the app works the way you chose |
| A random id for each device you use | To keep progress from several devices apart when it syncs |
| Display name, if you choose to give one | Shown to the other people in a challenge |
| Sign-in log with time and IP address | For security, for example to detect misuse of the account |
The legal basis is that the processing is necessary to provide the service you asked for (GDPR Article 6(1)(b)). For the sign-in log, the basis is our legitimate interest in keeping accounts safe (Article 6(1)(f)).
We keep the account until you delete it. If you create an account but never enter the code, we delete the account after 24 hours.
The 24-hour trial
When you create an account, you get full access for 24 hours. Each email address should get only one trial. So we store a cryptographic checksum (hash) of your email address. It is a code calculated from the address that cannot be turned back into the address. We do not store the address itself for this.
If you delete your account, the hash and the time stay, but with no link to the account. This stops the same address from getting a new trial. We keep the hash for as long as we offer the trial. The basis is our legitimate interest in preventing misuse of the trial (Article 6(1)(f)).
Purchases
You buy access in the App Store or Google Play. Apple and Google are the sellers. They take the payment and handle withdrawal and refunds under their own terms. We never get your card number or any other payment details.
The store sends us a confirmation of the purchase. We store which access you bought, when, the price, the store's transaction id and the store's receipt. We need this to give you access, for “Restore purchases” and for our accounts.
We keep purchase records for five years after the end of the financial year, even if you delete your account. We then remove the link to the account. The basis is our contract with you (Article 6(1)(b)) and our duty under the Norwegian Bookkeeping Act (Article 6(1)(c)).
If you redeem a code at teoriflyt.no/kode, we store that the code was used, when, and which account used it. We also store the time of each attempt, to stop guessing.
Challenges and classrooms
If you challenge a friend, the other people in the challenge see your score and your display name. Without a name it says “Guest”. Anyone who opens the link to a challenge you made sees your name and how long the challenge is open. If you join a classroom, your driving instructor sees that you have done the assignments. You must agree before you join, and you can leave whenever you like.
Reporting a question
If you think a question is wrong or unclear, you can report it in the app. We then store which question it is about, the reason you chose, an optional comment (at most 300 characters), the app version, the platform and the user id the report came from. Please do not write personal details in the comment. Only Teoriflyt can read the reports, and we use them only to correct questions.
The user id is used to limit the number of reports and to delete the reports with the account. If you send one without an account, the app makes a random user id with no email address. Reports are included when you export your data, and they are deleted when you delete your account. The basis is our legitimate interest in correct questions for everyone who practises (Article 6(1)(f)).
Crash reports
When the app crashes, it sends a short technical crash report to our server: the app version, the platform and operating-system version, the screen where the error happened, the error message and where in the code it happened. Email addresses and ids in the error message are replaced before it is sent. The report does not contain who you are, your email address or your answers. To limit the number of reports, we use a random code that changes every day.
If you tap “Send error report”, the app's last 50 technical log lines are included too. We delete crash reports after 90 days. The basis is our legitimate interest in fixing errors in the app (Article 6(1)(f)). We use no outside service for crash reports.
Usage statistics
In the settings you will find the switch “Share usage statistics”. It is off by default. The app does not send any usage statistics at the moment, even if you switch it on.
If we start collecting statistics, this applies: the app sends only short events, for example that you finished a lesson, to our own server. The events contain technical codes and numbers, never question text, your answers, your name or your email address. They are tagged with a random code that changes every 30 days and cannot be linked to your account. We delete them after 13 months. The basis is your consent (Article 6(1)(a)), and you can switch it off whenever you like. We will update this page before we start.
Reminders and ratings
The daily reminder is a local notification that your phone shows by itself. We use no push service, and nothing about the reminder is sent to us or anyone else. After you have passed, the app may ask your phone to show Apple's or Google's box for rating the app. The rating goes to Apple or Google, not to us.
Who processes data for us
We never sell data, and we have no ads or tracking from others.
| Who | What they do |
|---|---|
| Hetzner Online GmbH | Runs our server in Nuremberg, Germany, inside the EU/EEA. All the data on this page is stored there. Hetzner is our data processor. |
| Resend, Inc. | Sends the email with the sign-in code to your address. Resend is our data processor. The company is based in the USA, so your address may be processed there. The transfer relies on the EU standard contractual clauses, which are part of the data processing agreement. |
| Apple and Google | Sell access in the App Store and Google Play and take the payment. They do this as independent controllers, under their own terms and privacy policies. We send them no information about you. We only ask the store whether a purchase is valid. |
How long we keep data
| What | How long |
|---|---|
| The account and everything synced to it, the sign-in log and question reports | Until you delete the account |
| An account where the code was never entered | 24 hours |
| A random user id from a challenge, with no data | 30 days after last use |
| The hash of your email address for the trial | As long as we offer the trial, with no link to the account after deletion |
| Purchases | Five years after the end of the financial year, with no link to the account after deletion |
| Crash reports | 90 days |
| Usage statistics (not collected at the moment) | 13 months |
| Server backups | 14 days |
| Server logs with IP addresses | A short time; they are overwritten continuously |
Your rights
You have the right to access, correct and delete your data, and to get a copy of it. You can do most of this yourself:
- Access and a copy: in the app, under Settings → Data → “Export my data”. You get one file with what is stored on the device and everything your account has stored on the server. For the sign-in log, write to us.
- Delete account: in the app, under Settings → Data → “Delete account and data”, or at teoriflyt.no/slett-konto. We delete the account and everything linked to it at once, except what is described under the trial and purchases above. Copies in the backups are gone within 14 days.
- Correction: you change your name, test date and settings in the app. We correct anything else when you write to us.
If you think we handle your data against the rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet. We would appreciate it if you contacted us first.
Cookies and local storage
Teoriflyt uses no cookies. The web version of the app stores your progress, settings and sign-in in the browser's own storage (local storage and IndexedDB) on your device. The app needs this to work, and nobody else reads it. You remove it by clearing the data for teoriflyt.no in your browser, or with “Delete account and data”. These pages store nothing.
Children and young people
Teoriflyt is made for people preparing for the theory test, and is for people aged 15 and over.
Changes
If we change this policy, we update the date at the top.