Privacy Policy

What we collect

• Account data — your name and email address when you register.
• Password — stored as a one-way hash (bcrypt). We cannot read your password.
• Driving sessions — date, duration (day/night minutes), location type, weather conditions, and optional notes that you enter.
• Student accounts — names and emails of student accounts you create as a parent.
• Cookies — on the website, used to keep you logged in (8-hour expiry). A separate cookie remembers which student account a parent last selected, for 30 days.
• iOS app — signs in with the same email and password and sends the same driving-session data. It stores your email, password and an access token in the iOS Keychain on your device (instead of cookies), and remembers the last email you used to prefill sign-in. Your email and password are sent only to sign in; the access token, which identifies your account (your account ID), goes with every request to our server.
• Technical data — our hosting provider records IP addresses in its request logs. Sign-in on the website and in the iOS app counts attempts by IP address and the email entered, to limit repeated failed attempts; that count is held only in the server's memory, never in our database, and stops applying after 15 minutes.

Analytics

The website uses Google Analytics 4 to understand aggregate usage patterns (page views, general traffic). It loads on every page of the website, including signed-in pages, sets its own cookies (named starting with _ga), and collects your IP address and browser information. You can opt out using the Google Analytics Opt-out Browser Add-on.

The iOS app contains no analytics and no tracking — no Google Analytics and no other analytics, advertising or tracking code.

Third-party services

Your data passes through these services to run the website and the iOS app:

• Vercel — hosting and serving the application.
• Turso — the database where your account and driving log data is stored.
• Resend — sends password reset emails on your request. Your email address is transmitted to Resend only when a reset is initiated.

No data is sold to third parties. Ever.

Students

A parent or guardian creates each student account and controls it. The parent can see and edit the student's driving log.

Data retention & deletion

Your account data is kept for as long as your account exists. A parent or guardian can delete their account on the website: sign in to the parent account and go to Settings → Danger Zone → Delete My Account. Deleting a parent account also deletes all of its student accounts and every driving session.

Deletion removes your data from our live database immediately and can't be undone. Copies in our service providers' backups and logs (database backups, hosting logs, email delivery logs) are deleted on their own schedules.

The iOS app cannot delete an account. A student account cannot be deleted on its own; it is deleted with the parent account it belongs to.

Questions

For privacy-related questions or requests, email support@studentdriver.site or open an issue on GitHub (issues are public, so please do not post personal information in one). This app is governed by the laws of the State of Illinois, USA.