Privacy Policy
1. Who we are
“Turas: Driving Test Routes” (“Turas”, “the app”) is developed and published by Maksym Myronenko, an individual sole developer based in Ukraine. There is no company behind the app. It is one person.
For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, Maksym Myronenko is the data controller for the personal data described in this policy.
| Controller | Maksym Myronenko (a natural person, sole developer) |
| Contact email | maximusik2@gmail.com |
| App | Turas: Driving Test Routes, iOS 17 or later, iPhone (and CarPlay where available) |
| Bundle identifier | com.myronenkomaksym.ietestroutes |
| App Store | https://apps.apple.com/app/id6816729591 |
Email is the only contact channel. If you need a postal address, for example to send a formal legal notice or a written data subject request, email maximusik2@gmail.com and it will be provided to you on request.
No EU representative under GDPR Article 27 and no UK representative have been appointed at this time. If you are in the EU/EEA or the UK you can still exercise every right described in section 9 directly by email, and you can complain to your national supervisory authority, which in Ireland is the Data Protection Commission (section 10).
There is no Data Protection Officer; one is not required for processing at this scale.
1.1 Scope of this policy
This policy covers the Turas iOS app (including its CarPlay screen), the backend API that supports it, and this website.
It does not cover Apple’s own processing of your Apple Account, your App Store purchases and payment details, Sign in with Apple, or Apple Maps. Apple is an independent controller for those. See Apple’s privacy policy: https://www.apple.com/legal/privacy/
Turas is not affiliated with the Road Safety Authority (RSA) or any government body, and no data about you is shared with the RSA.
2. The short version
- There is no sign-up. The app creates an anonymous account tied to your device. Signing in with Apple is optional and only lets your purchases follow you to a new phone.
- Location is used on your phone to guide you along a route and to find your nearest test centre. It leaves your phone only in two cases: while “Share drives” is on (it is on unless you turn it off), and when the app asks Apple Maps for directions.
- With Share drives on, the app sends your position every 10 seconds during a drive, the whole drive from start to end. With “Always” location it also records a drive by itself when you wait at your test centre and then drive off (Settings → Record drives from my centre). We keep those points for 400 days. You can delete any drive, or everything, at any time in the app.
- Answers you give after a drive, route problem reports, and your purchases are stored with your account.
- There is no advertising, no advertising identifier, no App Tracking Transparency prompt, no tracking across other apps or websites, no data selling and no data brokers.
- Payments are handled entirely by Apple. We never see your card, bank details or billing address.
- The website sets no cookies, runs no analytics and loads no third-party scripts.
The rest of this policy is the detail.
3. What we collect, and what we do not
3.1 Data we do collect
A. Your anonymous account. When you first open the app it generates a random device identifier and registers an anonymous account with our backend. The app stores the account’s sign-in token on your iPhone. This identifier is not your Apple Account, your device serial number or an advertising identifier; it exists only for Turas.
B. Sign in with Apple (optional). If you choose to sign in with Apple, Apple gives us a stable identifier for your Apple Account in this app. The app asks Apple for no name and no email address, so we receive neither. We use the identifier only so your passes, subscription and drives follow you to a new phone.
C. Purchases and access. When you buy a Centre Pass, a subscription or Lifetime access, the app sends Apple’s signed transaction to our backend so we can confirm it and unlock the routes. We store the product, the transaction identifier Apple gives us, the dates it covers, and, for a Centre Pass, which centre it is for. We receive App Store Server Notifications about renewals, expiries and refunds. We do not receive your card number, billing address or Apple Account email.
D. Location on your phone. The app asks for location permission to follow your position along a route, speak each turn, reroute you if you leave the route, and find the test centre nearest to you. “Always” permission lets guidance and “Record my test” keep working while the screen is locked or another app is open, and lets the app notice when you arrive at your chosen test centre (iOS region monitoring) so it can record the drive when you leave it (see F). Location is used only for drives, your centre and finding a centre.
E. Apple Maps. Maps and directions are provided by Apple MapKit. When the app shows a map, or asks for directions to the start of a route or back onto it, Apple receives the request and the locations involved, under Apple’s own privacy policy. We do not receive anything back from Apple about you.
F. Shared drives (while “Share drives” is on). Settings → Share drives to improve routes is on unless you turn it off. While it is on, for each drive:
- the app records a GPS fix (time, latitude, longitude, accuracy, and where available speed and heading) every 10 seconds, including in the background, queues the fixes on your phone and uploads them about every 60 seconds and when the drive ends;
- the whole drive is kept, from its first fix to its last: a test route starts and ends at the test centre, so its ends are the part that matters;
- a drive is recorded when you start one (a route, or “Record my test”), and, with “Always” location and Settings → Record drives from my centre on, also by itself when you have waited at your chosen test centre for a few minutes and then drive off. That recording starts at the centre, not at your home, and ends when you are back at the centre, after ten minutes standing still, or after two and a half hours; one under a kilometre is dropped;
- fixes outside Ireland or with poor accuracy are discarded;
- we also store a summary: the drive’s mode (following a route, or “Record my test”), the centre and route, start and end time, distance and how much of the route you completed.
The setting is fixed for each drive when it starts. With Share drives off, the app still guides you but uploads no positions and no drive record, and records nothing by itself. (Where analytics is configured, the usage events in (J) still note that a drive started and finished, without any location.) You can switch it off at any time in Settings.
G. Your answers after a drive. After a shared drive the app may ask up to three questions, each of which you can skip: whether it was your real driving test, whether the test followed the route (or which route it looked like), and, if it was your test, how it went (passed, failed, or rather not say). If you say the test was different you can add an optional note of up to 500 characters. We store your answers with the drive, and the drive’s date as your test date if you said it was your test.
H. Route problem reports. If you report a problem with a route (for example a wrong turn, roadworks or a closed road), we store the route, the kind of problem, any note you write, and, where the app includes it, the location the report refers to.
I. Onboarding answers. The onboarding questions (your centre, your test date, what worries you, and your choices about location, sharing and notifications) are stored on your phone to set up the app.
J. Product analytics (only where analytics is configured in the app build). Where an analytics key is configured in the app, the app sends usage events to Amplitude, in Amplitude’s EU data centre, keyed to your account’s identifier: for example the app opened, a centre chosen, a route opened, a drive started or finished and how much of it was completed, going off and rejoining a route, the paywall shown, a purchase started or completed, an onboarding answer given, a report sent, sharing turned on or off, and the account deleted. Amplitude also records app sessions and app lifecycle events, and your device model, iOS version, app version, language and approximate country. Analytics events never contain your GPS positions. Where no key is configured, no analytics events are sent.
K. Server logs. When the app calls our API, the hosting layer records the request: timestamp, endpoint, HTTP status and the connecting IP address. We use these logs only to keep the service running and to investigate abuse and outages.
L. Crash data. If you have agreed to share analytics with Apple in your iOS settings, Apple may make aggregated crash reports available to us through App Store Connect. We do not use a third-party crash SDK.
M. Correspondence. If you email maximusik2@gmail.com, we hold your email address and whatever you write, for as long as needed to deal with your message and keep a record of it.
3.2 Data we do not collect
Turas does not collect your name, email address (unless you email us), phone number, password, contacts, photos, camera, microphone, health data, payment card or bank details, any advertising identifier, or biometric data. It does not read your driving licence or learner permit details, and it does not know your RSA test booking.
There is no advertising SDK in the app, no ad network, no attribution SDK and no App Tracking Transparency prompt, because there is nothing to track.
4. Why we process it, and our lawful basis
| # | Data | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|---|
| 1 | Anonymous account, Sign in with Apple identifier | Create and recognise your account so your access and drives persist, and follow you to a new phone if you sign in | Art. 6(1)(b), performance of the contract with you (our Terms of Service) |
| 2 | Purchases and access | Confirm what you bought and unlock the right routes at the right centres for the right period | Art. 6(1)(b), performance of the contract |
| 3 | Location on your phone | Turn-by-turn guidance, rerouting, “Record my test” and finding your nearest centre; you control it through iOS location permission | Art. 6(1)(b), performance of the contract (it is the service you asked for) |
| 4 | Shared drives: GPS points and drive summary | Show your drive history; keep routes current (“Driven on N tests this month”, “Last seen on a test”); review recordings to find new or changed test routes; decide the real-test reward | Art. 6(1)(f), legitimate interests in keeping test routes accurate for every learner, which is the service itself. “Share drives” is on by default and you can object at any time by turning it off in Settings, which stops all uploads |
| 5 | Answers after a drive | Work out whether a route is still used on real tests, improve the routes, and decide the real-test reward | Art. 6(1)(a), your consent (the questions are only asked about shared drives, and each is optional) |
| 6 | Route problem reports | Fix wrong or outdated routes | Art. 6(1)(f), legitimate interests in accurate routes, which is also what you are asking for by reporting |
| 7 | Product analytics (where configured) | Understand which features are used and where learners get stuck, and improve the app | Art. 6(1)(f), legitimate interests in understanding and improving our own product; see section 5 |
| 8 | Server logs, including IP address | Keep the API available, detect and stop abuse, investigate incidents | Art. 6(1)(f), legitimate interests in security |
| 9 | Crash data | Find and fix crashes | Art. 6(1)(f), legitimate interests in app stability |
| 10 | Correspondence | Answer your question or request | Art. 6(1)(b) or (f); Art. 6(1)(c) for data subject requests |
| 11 | Purchase records | Accounting, tax and consumer-law obligations | Art. 6(1)(c), legal obligation |
Your test result (“passed”, “failed” or “rather not say”) is optional and private: it is never shown to anyone else. We do not process any special-category data under GDPR Article 9.
Where we rely on legitimate interests you have the right to object (section 9.6). Where we rely on consent you can withdraw it at any time, and withdrawing is as easy as giving it (section 9.9).
5. Analytics in the app
Where an analytics key is configured in the app, the Amplitude SDK starts when the app launches and sends the pseudonymous events described in section 3.1(J). The app does not currently show a separate analytics consent prompt. We rely on legitimate interests (Art. 6(1)(f)), on the basis that the events are limited to how the app itself is used, contain no GPS positions, are stored in Amplitude’s EU data centre, are not combined with data from other companies, are not used for advertising and are not sold.
If you are not comfortable with analytics, email maximusik2@gmail.com and object under Art. 21 GDPR: we will stop analytics for your account and delete the events already collected for it (section 9.6). Deleting your account also stops it.
We recognise that some EU/EEA regulators take the view that analytics of this kind needs prior consent. We intend to add an in-app analytics choice; until then, the description above is what actually happens.
6. Who else processes your data
These are all of them. We do not sell personal data, share it with data brokers, or disclose it for anyone’s advertising.
| Provider | What they do for us | What they receive | Their privacy policy |
|---|---|---|---|
| Apple | App Store distribution; in-app purchases through StoreKit and App Store Server Notifications; Sign in with Apple; maps and directions through MapKit; deciding refund requests | Your App Store transactions and Apple Account (as an independent controller); map and direction requests from the app | https://www.apple.com/legal/privacy/ |
| Railway | Cloud hosting for the backend API and PostgreSQL database, region EU West (europe-west4, Netherlands) | Everything stored server-side: account, purchases and access, shared drives and answers, route reports, server logs | https://railway.com/legal/privacy |
| Amplitude (only where analytics is configured) | Product analytics, in its EU data centre | The pseudonymous events in section 3.1(J) | https://amplitude.com/privacy |
Apple acts partly as our processor (StoreKit billing on our behalf) and partly as an independent controller. Railway and Amplitude act as our processors under GDPR Article 28 data processing terms.
We may also disclose data where we are legally required to, for example in response to a valid, binding request from a competent authority, or where necessary to establish, exercise or defend legal claims. If Turas were ever transferred to another owner, your data could transfer with it; we would update this policy before that took effect.
6.1 What other learners can see
Nothing about you. Routes can show counts such as “Driven on N tests this month” or “Last seen on a test N days ago”. These are whole numbers per route, calculated from shared drives, and they name nobody. Your GPS points are never shown to other users and are never served back by the API to anyone, including you.
6.2 How recorded drives are used to improve routes
Shared “Record my test” drives that you said were real tests may be exported by the developer, as map lines, to review whether a centre has a test route the app does not have yet. That export is for internal review only and is never published. A route in the app is built from many drives and snapped to the OpenStreetMap road network, and it does not reveal any individual drive.
6.3 The website
This website is a static site. It sets no cookies, runs no analytics, loads no third-party scripts, fonts or images, has no forms and serves every page from its own origin. The hosting provider (Railway) processes standard web server logs, including your IP address, only to deliver the pages and keep them secure.
6.4 Refund requests
If you ask Apple for a refund, Apple may ask us how the purchase was used. If we answer, we send only facts about the app (for example that routes were delivered and working) and, at most, a recommendation; we never send your location, your drives, your answers, your name or any payment data. Email maximusik2@gmail.com before or when you ask for the refund if you would rather we did not answer.
7. International transfers
Our backend API and database are hosted by Railway in the EU West region (Netherlands), and analytics, where configured, is stored in Amplitude’s EU data centre, so your data is stored inside the EEA by default.
Apple and Amplitude are US-linked providers and processing may involve access from the United States and other countries outside the EEA and the UK. Where personal data is transferred outside the EEA or the UK, we rely on the EU–US Data Privacy Framework adequacy decision (and its UK Extension) where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses, with the UK Addendum where UK data is involved.
We ourselves are based in Ukraine. Ukraine is not currently covered by an EU adequacy decision, so where we access EEA or UK personal data from Ukraine that access is itself an international transfer, covered by the safeguards above. You can ask for details of the mechanism used for any provider by emailing maximusik2@gmail.com.
8. How long we keep it
| Data | Retention |
|---|---|
| GPS points of shared drives | 400 days, then deleted automatically; sooner if you delete the drive or your account |
| Drive summaries and your answers | Until you delete the drive or your account |
| Route problem reports | Until you delete your account; the route fix they led to stays |
| Anonymous account and Sign in with Apple identifier | While the account is in use; deleted when you delete the account, or after 24 months of continuous inactivity |
| Purchase and access records | For the life of the purchase, then as long as needed for accounting, tax and consumer-law purposes |
| Real-test reward grants | Until they expire, and deleted with your account |
| Product analytics events (where configured) | 24 months from the event, then deleted or irreversibly aggregated |
| Server logs, including IP addresses | 30 days, longer only where a specific security incident or legal claim is under investigation |
| Email correspondence | 24 months after the matter is closed, or longer where it relates to a live or foreseeable legal claim |
| Onboarding answers and preferences | On your phone, until you delete the app or your account |
Per-route counts (“Driven on N tests”) are whole numbers that identify nobody, so they stay after a drive or account is deleted.
9. Your rights
If you are in the EU/EEA or the UK, GDPR Articles 15 to 22 give you the rights below. We extend the same rights to everyone using the app, wherever you are. Ukrainian data protection law gives you comparable rights.
Many of them you can exercise yourself in the app, straight away:
- Delete one drive: Settings → Your Drives, then delete the drive. Its points and answers are removed from our server.
- Stop sharing drives: Settings → turn off “Share drives to improve routes”. Nothing more is uploaded from the next drive.
- Delete everything: Settings → Delete Account. This deletes your account and your data from our server and from your phone, including every drive, point, answer, report and reward.
- Stop location: iOS Settings → Privacy & Security → Location Services → Turas.
For anything else, email maximusik2@gmail.com. We will respond within one month, and tell you if we need to extend that by up to two further months because the request is complex (GDPR Art. 12(3)). It is free.
9.1 Identifying your records
Your account is anonymous. If you email us rather than using the app, we may need details to find the right records: whether you signed in with Apple, your device model, roughly when you started using the app, which centre you chose, and for purchase questions the Apple order ID from your receipt. If we cannot establish that records are yours, GDPR Art. 11(2) allows us to say so; we will never hand one person’s data to someone who merely claims it.
9.2 Access (Art. 15) and portability (Art. 20)
You can ask what personal data we hold about you and receive a copy, including your drives and their points, in a machine-readable format (JSON).
9.3 Rectification (Art. 16)
You can ask us to correct inaccurate data, such as a wrong post-drive answer.
9.4 Erasure (Art. 17)
You can delete your data in the app as described above, or ask us to. We delete everything except records we must keep by law, such as accounting records of a purchase, and tell you what we kept and why.
9.5 Restriction (Art. 18)
You can ask us to stop processing your data while a dispute about its accuracy or our lawful basis is resolved.
9.6 Objection (Art. 21)
Where we rely on legitimate interests, you can object. For analytics we will always honour it. For security logging we may need to continue where there are compelling grounds, such as an active abuse investigation. We do not do direct marketing.
9.7 Automated decisions (Art. 22)
We do not make decisions about you by solely automated means that have legal or similarly significant effects. One automated rule is worth naming: the real-test reward of 30 free days at a centre is granted automatically when a shared drive you say was your real test meets fixed checks on the recorded track (for example its length and that it started and ended near the centre). It is a free promotional extra, not a decision about you; if you think it was wrongly withheld, email us and a person will look at it.
9.8 Withdrawing consent
You can stop drive sharing at any time by turning off “Share drives” in Settings (and stop drives being recorded by themselves with “Record drives from my centre”), and delete drives already shared as described above. Stopping does not affect processing that took place before.
10. Complaining to a supervisory authority
If you think we have handled your personal data unlawfully, please tell us first at maximusik2@gmail.com and we will try to put it right. You also have the right to complain to a data protection authority:
- Ireland: the Data Protection Commission, https://www.dataprotection.ie/
- Elsewhere in the EU/EEA: the authority where you live, work or where the alleged infringement took place; list at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en
- UK: the Information Commissioner’s Office, https://ico.org.uk/make-a-complaint/
- Ukraine: the Verkhovna Rada Commissioner for Human Rights, https://www.ombudsman.gov.ua/
You also have the right to an effective judicial remedy under GDPR Art. 79.
11. Children
Turas is made for learner drivers. In Ireland you must be at least 17 to hold a learner permit for a car. The app is not directed at children under 16, the digital age of consent in Ireland, and we do not knowingly collect personal data from anyone under 16. Accounts have no age field, and we do not attempt age inference.
If you are a parent or guardian and believe a child under 16 has used the app, you can delete the account in the app (Settings → Delete Account), or email maximusik2@gmail.com and we will delete the associated records free of charge.
12. Security
- All traffic between the app and our API uses HTTPS/TLS.
- The account’s sign-in token is stored on your iPhone, not sent anywhere but our API.
- There are no passwords to steal, because there are none.
- We never receive card numbers or bank details; Apple handles payment end to end.
- GPS points are never served back by the API; they can only be exported by the developer, for the route review in section 6.2.
- Backend access is limited to the sole developer and protected by strong, unique credentials and multi-factor authentication where the provider supports it.
No system is perfectly secure. If a personal data breach poses a risk to your rights, we will notify the competent supervisory authority within 72 hours where GDPR Art. 33 requires it, and affected users without undue delay where Art. 34 requires it. Because we usually hold no way to contact you directly, such a notice may be given in the app and on this website.
If you find a security issue, please report it to maximusik2@gmail.com rather than disclosing it publicly.
13. App Store “App Privacy” mapping
Data Used to Track You: none. We do not track you as Apple defines tracking.
Data Linked to You:
| App Privacy category | Data type | Purpose | Section |
|---|---|---|---|
| Location | Precise Location (shared drives only) | App Functionality, Analytics (product improvement) | 3.1(F) |
| Identifiers | User ID (the account identifier) | App Functionality | 3.1(A), 3.1(B) |
| Purchases | Purchase History | App Functionality | 3.1(C) |
| Usage Data | Product Interaction | Analytics | 3.1(J) |
| User Content | Other User Content (post-drive answers and notes, route reports) | App Functionality, Analytics (product improvement) | 3.1(G), 3.1(H) |
If the label on the App Store and this policy ever disagree, treat it as an error on our side and email maximusik2@gmail.com so we can correct whichever is wrong.
14. Changes to this policy
We may update this policy, for example when a feature ships, a processor changes or the law changes. The current version always lives on this website with its “Last updated” date at the top. For material changes, such as a new category of data, a new purpose or a new processor, we will give notice in the app before or when the change takes effect, and ask for consent again where the law requires it.
15. How to reach us
Email maximusik2@gmail.com for anything in this policy: a data subject request, a privacy question, a security report, or a request for our postal address. Please put “Privacy” in the subject line.