Privacy Policy — Kilunavo

1. Controller

The controller responsible for data processing in the Kilunavo app and on this website is:

Dennis Donner
Eduard-v-Winterstein-Straße 11
14480 Potsdam
Germany

I have not appointed a data protection officer, as I am not legally required to.

2. Scope and summary

This policy covers the Kilunavo app for iPhone and the website kilunavo.donner.io.

In short: Kilunavo has no user accounts and no server of mine that stores your logbook. Your trips, vehicles, routes and saved addresses stay on your iPhone. Location is only used for automatic tracking and stays on the device. The app uses analytics and crash reporting to understand usage and fix errors, without advertising IDs and without the contents of your logbook.

3. Your logbook on the device

Everything you enter in Kilunavo is stored locally on your iPhone in the app’s database:

Trips: vehicle, start and end time, origin and destination address, distance, classification (business, private, commute or unclassified), purpose and, if available, the recorded or calculated route.
Vehicles: name and licence plate.
Saved addresses that you store for quick selection.
Correction history: when you change or delete a trip or vehicle, the app stores your reason and the values before and after the change, so the logbook stays traceable.

I do not receive this data. There is no Kilunavo account and no copy on a server of mine. The database is excluded from iCloud and computer backups and is protected by iOS file protection, so it is encrypted while your iPhone is locked after a restart until you unlock it for the first time. Because it is not part of a backup, a new or reset device does not get your logbook back; please export reports regularly.

Legal basis: Art. 6(1)(b) GDPR (providing the app you use).

4. Location and motion for automatic tracking

Entering trips by hand needs no location or motion access. Kilunavo only asks for these permissions when you turn on automatic tracking:

Location (“While Using” and then “Always”): to notice that a journey starts even when the app is closed, the app uses the significant location change service of iOS. While a trip is being recorded, it receives precise positions in the background (latitude, longitude, time, accuracy and speed; at most 10,000 points per trip). These positions are stored only on your device as the route of the trip.
Motion & Fitness (optional): if you allow it, the app reads the motion activity of iOS (for example “automotive”) to recognise driving more reliably. This is evaluated on the device and not stored with your trips.
Tracking diagnostics: the app keeps a short local log of tracking events (for example that recording was started or stopped and why), limited to about 64 KB, to help analyse detection problems. It contains no coordinates, has no screen in the app and stays on the device.

Positions and routes are never sent to me or to the analytics services named below.

Legal basis: your consent through the iOS permission prompt (Art. 6(1)(a) GDPR) and providing the feature you turned on (Art. 6(1)(b) GDPR). You can withdraw location or motion access at any time in the iOS settings; manual entry keeps working.

5. Address search, routes and maps

Address search, route calculation and maps use Apple MapKit. When you search for an address, the text you type goes to Apple; when the app suggests a distance, the start and destination are sent to Apple to calculate a route. The calculated route is reduced to at most 300 points and stored locally with the trip. To show the map, Apple receives the technical data needed to load it, such as your IP address and the visible map area.

Apple processes this data as an independent controller under its own privacy policy.

6. Reports and sharing

You can create a report for a trip or a date range as a PDF or CSV file. It contains, per trip: trip ID, start and end time, vehicle name, origin, destination, distance, classification and purpose. Reports contain no GPS points and no licence plates. The PDF footer states that the report is not a certified tax logbook.

The file is created on your device and goes only where you send it with the iOS share sheet, for example to Files or Mail. The target you choose processes it under its own terms.

7. Analytics and crash reports

To understand which features are used and to fix errors, the app uses the following services. They never receive the contents of your logbook: no coordinates, addresses, routes, licence plates, vehicle names or purposes.

Amplitude (data stored in the EU): app sessions and app start and lifecycle events, plus events from a fixed list: tracking turned on, off or blocked; a trip detected, started, completed, added or deleted; a vehicle added; a purchase screen was opened or a plan selected; a purchase started, completed, failed or cancelled; a restore started, completed or failed. Events carry predefined properties such as the source or trigger of an action, a reason or error code, whether it was the first time, the duration, distance and number of route points of a trip, whether driving activity was recognised and how long detection took, and for purchases the offering, package, period, product, amount and currency, and whether a purchase was restored. Every event includes the app version, platform, language and region, and whether the in-app purchase is active. Amplitude assigns a random device ID. Screen views and taps are not recorded; IP address, city, mobile carrier and the vendor identifier (IDFV) are not collected. Provider: Amplitude, Inc. (privacy policy).
Google Firebase Analytics: only the automatic events of the SDK, such as first launch, app sessions, app updates and in-app purchases, with an app instance ID and device and app information. The app sends no events of its own to Firebase. Provider: Google Ireland Ltd. (Firebase privacy information, Google privacy policy).
Google Firebase Crashlytics and Performance Monitoring: crash reports and performance data (stack trace, device model, operating system, app version, app state at the time of the crash, load times and network timings) with an installation ID. Provider: Google Ireland Ltd. (Firebase privacy information, Google privacy policy).
Install source: the app requests an attribution token from Apple (AdServices) once and asks Apple whether the installation came from an Apple Search Ads campaign. The result (source, campaign, country and whether it was a paid campaign) is stored on the device and added to Amplitude as user properties. Provider: Apple (privacy policy).

Kilunavo does not use the advertising identifier (IDFA), does not show the iOS tracking prompt and contains no advertising SDK. Crashlytics only collects crash reports in TestFlight and App Store builds.

Legal basis: my legitimate interest in a stable app and in improving it (Art. 6(1)(f) GDPR). There is currently no switch for this in the app. You can object at any time by email to app-support@donner.io; I then exclude your data.

8. In-app purchases

Some features of Kilunavo, such as automatic tracking, additional vehicles and reports, are unlocked with an in-app purchase. Purchases are processed by Apple; I do not receive your payment details. To check which features you have unlocked, I use RevenueCat (RevenueCat, Inc., privacy policy). RevenueCat receives an anonymous app user ID, the purchase receipt from Apple, the products and purchase status, device and app information and the Amplitude device ID, so that purchase events can be matched in the analytics.

Legal basis: Art. 6(1)(b) GDPR.

9. Rating prompt

After you have saved your first trip, the app may ask iOS once to show the system rating prompt. Whether it appears and what you enter there is handled by Apple; I receive no personal data from it.

10. Contact and support

If you write to me at app-support@donner.io, I process your email address, your message and anything you choose to include, to answer your request. The app does not send support data on its own.

Legal basis: Art. 6(1)(b) GDPR for questions about the app or a purchase, otherwise Art. 6(1)(f) GDPR (answering your enquiry).

11. This website

Hosting: this website is hosted by WebhostOne (privacy policy). When you visit it, WebhostOne processes technical access data (IP address, time, page, browser) in server logs to deliver the site and keep it secure (Art. 6(1)(f) GDPR).
No cookies, no analytics, no tracking. The website loads no fonts, scripts or images from other providers.
Language choice: if you switch between English and German, your choice is saved in your browser’s local storage under the key kilunavo-lang, so that the start page opens in your language next time. It is not sent to me. You can delete it at any time via your browser settings.

12. Recipients

I use these service providers as processors on my behalf (Art. 28 GDPR):

Provider	Purpose
Google Ireland Ltd., Dublin, Ireland (with Google LLC, USA)	Firebase Analytics, Crashlytics and Performance Monitoring
Amplitude, Inc., San Francisco, USA (EU data centre)	Usage analytics
RevenueCat, Inc., San Francisco, USA	Managing in-app purchases
WebhostOne	Hosting this website, server logs
My email provider	Receiving and storing support emails

Apple processes data as an independent controller under its own privacy policy (App Store, purchases, MapKit, AdServices attribution).

I do not sell personal data.

13. Transfers outside the EU

Where data is transferred to a country without an EU adequacy decision, the transfer is based on the provider’s certification under the EU-U.S. Data Privacy Framework where available, or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

14. Retention

Logbook: on your device until you delete it. Deleting a trip requires a reason; the earlier version stays in the local correction history. “Delete all local app data” in the settings stops recording and deletes trips, vehicles, saved addresses, the automatic-tracking choice and the correction history on this device. The distance-unit choice and the tracking diagnostics log stay until you delete the app; deleting the app removes all data stored by it on the device.
Analytics and crash data: as long as needed for the purposes above and within the retention settings of the providers; Google keeps Crashlytics crash reports for 90 days.
Purchase data: as long as the purchase is active and as required by commercial and tax law.
Support emails: as long as needed to answer your request and as required by law.
Website server logs: for a short period only, as set by WebhostOne.

Reports you shared elsewhere and purchase records at Apple and RevenueCat are not affected by deleting data in the app. If you want me to delete analytics or purchase data, write to app-support@donner.io.

15. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Just write to app-support@donner.io.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the EU country where you live. The authority responsible for me is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (Brandenburg data protection authority)
Stahnsdorfer Damm 77
14532 Kleinmachnow, Germany

16. Children

Kilunavo is not directed at children under 16. I do not knowingly collect data from children.

17. Permissions

The app asks for these permissions only when you turn on automatic tracking. You can grant or withdraw them at any time:

Location (“While Using” or “Always”): to detect and record journeys, see section “Location and motion for automatic tracking”.
Motion & Fitness (optional): to recognise driving activity more reliably.

Kilunavo does not request access to your camera, photos, contacts, microphone or health data.

To change a permission, go to Settings → Privacy & Security → Location Services → Kilunavo, or Settings → Kilunavo.

18. Security

Your logbook is protected by the security of iOS, which isolates app data from other apps and encrypts the database with file protection. All connections of the app to the services named here use encrypted HTTPS. Please protect your iPhone with a passcode.

19. Changes

I update this policy when the app or the law changes. The current version is always available on this page; the date at the top shows when it was last changed.