Yalla KörkortPrivacy policy
1. Who we are
The data controller is Ahmad Toron, a private individual in Sweden who develops and runs Yalla Körkort. For any privacy question or request, email support@yallakorkort.se.
Yalla Körkort is an independent study app. It is not affiliated with, endorsed by or operated by Trafikverket, Transportstyrelsen or any other government authority.
2. What we collect
| Data | Example | Why |
|---|---|---|
| Account identifier | A random user ID. We create one even if you use the app without signing in. | To keep your progress tied to you |
| Email address | Only if you create an account with email | Signing in, account recovery, essential service messages |
| Learning progress | Lessons opened, questions practised, which questions you find hard (spaced-repetition schedule) | To show progress and run the "Weak spots" review |
| Answer history | The option you chose for each question, whether it was correct, and when | To score your answers and build your review queue |
| Exam results | Mock exams started and finished, scores, time used | To show your results and history |
| Language preference | Arabic, Swedish or English | To show the app and our emails in your language |
| Purchase status | Whether you have bought Premium (a one-off purchase), which product, when it was bought or refunded, and the purchase events from RevenueCat (product, price, currency, country and store) | To unlock paid content |
| Emails to us | Your email address and what you write, for example when you report a mistake in a question | To answer you and fix the mistake |
We do not collect:
- your name, phone number, location, contacts or photos
- advertising identifiers
We do not show ads, and we use no tracking, analytics or advertising tools. We do not sell your data, and we do not share it for advertising.
Some data stays only on your device: your sign-in session, your language setting, and saved lesson and question text. Uninstalling the app removes it.
3. Payments
Premium is a one-off purchase, not a subscription. Apple (App Store) or Google (Google Play) handles the payment. We never see your card or payment details. Apple and Google process your payment as independent controllers under their own privacy policies.
We use RevenueCat to check whether you have bought Premium. RevenueCat receives your random user ID and the purchase receipt from Apple or Google. It does not receive your email.
4. Who processes your data for us
| Provider | Role | Location |
|---|---|---|
| Supabase Inc. | Database and sign-in. Stores everything in section 2 except emails to us. | Data hosted in the EU (Stockholm, Sweden). Supabase Inc. is a US company. Any access from outside the EU is covered by the EU Standard Contractual Clauses. |
| RevenueCat Inc. | Purchase status | USA. Covered by the EU Standard Contractual Clauses. |
| Resend Inc. | Sends the app's emails, such as account confirmation and password reset. Receives your email address and the email's content. | Sent from the EU (Ireland). Resend Inc. is a US company; covered by the EU Standard Contractual Clauses. |
| Cloudflare, Inc. | Runs this website and forwards email sent to support@yallakorkort.se. | USA, with servers worldwide. Covered by the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses. |
| Microsoft (Outlook.com) | The mailbox where email to support@yallakorkort.se is received and answered. | Microsoft Ireland Operations Limited, with servers in and outside the EU. |
Supabase, RevenueCat, Resend and Cloudflare act only on our instructions, under data processing agreements. We share data with authorities only when the law requires it.
5. Legal basis
We process your data to provide the service you asked for (GDPR Art. 6(1)(b), contract). That covers your account, progress, exams and purchase. When you email us, we process the email so we can answer you (Art. 6(1)(f), legitimate interest). If we must keep some data to meet a legal obligation, such as accounting rules, the basis is Art. 6(1)(c).
6. How long we keep data
- Your account data is kept for as long as you have an account.
- We keep your data for as long as you have an account. You can delete the account at any time in the app or by email.
- When you delete your account, we delete your data from the live database right away.
- Backups are overwritten within 30 days at most.
- RevenueCat keeps purchase records under its agreement with us. We ask RevenueCat to delete your record when you delete your account.
- We keep emails to us for as long as we need them to handle your request.
7. Deleting your account
- In the app: Settings › Delete your account.
- Without the app: follow the steps at yallakorkort.se/en/radera-konto.
Deletion removes your account, email, progress, answer history, exam results and our record of your purchases.
There is no subscription to cancel, and deleting your account does not refund Premium. The purchase is tied to your App Store or Google Play account, not to your account with us. To use it again later, tap Restore purchases in the app while signed in to the same store account.
8. Your rights
Under the GDPR you have the right to:
- access your data
- get it corrected
- have it deleted
- restrict processing
- receive your data in a portable format
- object to processing
To use any of these rights, email support@yallakorkort.se. We answer within one month.
You can also complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), at imy.se.
9. Children
The app is meant for learner drivers. In Sweden, supervised practice driving starts at 16. It is not directed at children under 13. If you believe a child under 13 has given us data, contact us and we will delete it.
10. Security
- All traffic is encrypted (HTTPS/TLS).
- The database uses row-level security, so each user can reach only their own records.
- Correct answers are checked on the server.
11. This website
yallakorkort.se uses no cookies, no analytics and no tracking tools. It loads nothing from other websites: fonts, icons and images are served from the same server. That is why there is no cookie banner.
Cloudflare, which runs the website, processes your IP address and technical details of the request to deliver the page and protect it against attacks. We keep no visitor logs of our own.
12. Changes
If we change this policy, we will update the date at the top. For significant changes, we will also tell you in the app.