Đỗ Lái Privacy Policy

DRAFT — pending review by the product owner and a qualified legal reviewer. This text is not legal advice. Every {{PO: ...}} placeholder must be filled in before publication. The Vietnamese version prevails if the two versions differ.

Version 0.1.0-draft · Effective {{PO: ngày hiệu lực (YYYY-MM-DD)}}

1. Who is responsible for your data

Đỗ Lái (the iOS and Android apps and the website dolaiapp.com) is developed and operated by the individual Hiep Nguyen. Hiep Nguyen is the controller and processor of the personal data described in this policy.

• Contact address: {{PO: địa chỉ liên hệ của bên kiểm soát dữ liệu}}
• Privacy email: {{PO: email liên hệ quyền riêng tư}}
• Zalo support channel: {{PO: link Zalo hỗ trợ}}

This policy covers learners using Đỗ Lái for free and driving instructors who register a referral code. When the service for driving schools (B2B) launches, we will update this policy and notify you in advance.

2. Data we collect

We only collect data needed for learning and for running the service.

When you use the app or website without signing up (guest account)

• A random device identifier generated by the app (not a hardware identifier), stored in the iOS Keychain, the Android Keystore or browser storage (IndexedDB) on the web.
• Your licence class, planned exam date, chosen question-bank mode and in-app settings.
• Learning data: questions answered, answers chosen, review schedule, practice-exam results, saved questions, and your "pass readiness" level.
• An instructor referral code, if you enter one.

When you create an account or sign in

• Phone number (when signing in with a one-time code). Phone numbers are encrypted at rest.
• Your Apple or Google account identifier and the email Apple/Google provides (including Apple's private relay email), if you choose those sign-in methods.
• Email (optional) and display name.
• The list of signed-in devices and sessions.

When you use certain features

• Question error reports: error type, your optional note, question ID, content pack version, platform.
• Push notifications: the device push token (APNs on iOS, FCM on Android; on the web, the browser notification subscription if you turn it on), notification types and the reminder time you choose.
• Consent choices: the groups you agreed to, the notice version (consent_version) and the time.

Technical data

• Product usage data (events such as opening a lesson or finishing a practice exam): only if you agree to the "Product analytics" group. Events never contain your phone number, email or name.
• Website session recording (session replay): on the web only and only if you agree to the "Product analytics" group; about 10% of sessions are randomly selected for recording. A recording contains your actions on the page (clicks, taps, scrolling, page changes) and the page content displayed during the session, and is used to find display bugs and usability problems. The iOS and Android apps do not record sessions.
• Minimal anonymous crash reports and content-pack download failures, even if you decline analytics, to keep the app working.
• Server logs (including IP address) used for security and abuse prevention, such as limiting how often one-time codes can be requested.

Driving instructors registering a referral code

• Full name, phone number (verified by one-time code), province, TikTok/Zalo channel, and the driving school they teach at (optional). We do not collect bank account numbers.

We do not collect: national ID numbers, location, contacts, or learner payment information. Đỗ Lái is free for learners and has no in-app purchases.

3. Cookies and browser storage

On the website dolaiapp.com we use:

• A sign-in cookie (HttpOnly, Secure, SameSite=Lax) holding the session refresh token when you sign in. It is needed to keep you signed in and is not used for tracking.
• The browser's IndexedDB to store the guest device identifier, learning progress, settings, downloaded question packs and changes waiting to sync, so the study pages work offline.
• localStorage for your consent choices and display preferences (light/dark theme, text size).
• The browser cache (service worker) to open pages and downloaded content offline.
• Cloudflare technical cookies may be set when needed for bot protection and site security (for example when a Turnstile check is shown).
• Storage used by the PostHog analytics tool: created only if you agree to the "Product analytics" group. If you do not agree, PostHog is not loaded on the site.

We do not use advertising cookies or third-party tracking cookies. You can clear site data in your browser settings; guest progress stored in that browser is then lost.

4. Why we use your data

• To provide learning and practice exams, compute your review schedule and "pass readiness".
• To sync progress between web and phone, and merge progress when a guest account is upgraded to a signed-in account.
• To authenticate sign-in, secure accounts, and detect and prevent abuse.
• To send sign-in one-time codes by Zalo ZNS or SMS when you request them. These are transactional messages needed to sign in and do not depend on the "Marketing" consent.
• To send the notifications you turned on (daily plan, reviews due, exam-date countdown, new question sets, fixes to questions you reported); to send Zalo ZNS reminder messages (not including sign-in one-time codes) only if you agree to the "Marketing" group.
• To handle question error reports and tell you when a question has been fixed.
• To show your learning progress to the instructor whose code you entered, if you agree to share (section 6).
• To improve the product using usage statistics and website session recordings, only if you agree to "Product analytics".
• To comply with legal obligations.

5. Consent groups

The first time you open the app or the website, you choose consent in three groups:

Push notifications about your studies (daily plan, reviews due, exam-date countdown, new question sets, fixed questions) are not part of the Marketing group; you turn each type on or off in Settings → Reminders. Sign-in one-time codes sent by Zalo ZNS or SMS are not part of the Marketing group either: a code is still sent whenever you ask to sign in, even if you declined or withdrew the Marketing consent.

You can change or withdraw consent at any time in Settings → Account & privacy → Privacy & data consent (on the web: the Settings page, Account & privacy group). Withdrawal does not affect processing carried out before it. Permission to send push notifications is also governed by your operating system settings.

6. Sharing

We do not sell your personal data. Data is shared only in the following cases.

The instructor whose referral code you entered. When you enter a code, you are asked whether to share your progress with that instructor. If you agree, the instructor sees: your abbreviated display name (for example "N. V. Minh"), licence class, exam date, "pass readiness" level, latest exam score and time of last activity. The instructor does not see your phone number. You can turn sharing off in Settings → Account & privacy → Account (Sharing & data); you then disappear from the instructor's dashboard.

Service providers processing data on our behalf:

These providers may process data only on our instructions and only for the role stated above, and must protect the data at a level equivalent to this policy. {{PO: xác nhận cam kết bảo vệ tương đương của bên thứ ba}}

Competent state authorities, when lawfully requested under Vietnamese law.

7. Storage location and cross-border transfer

Application servers and the database are currently located in Singapore. Some providers in section 6 may process data in other countries ({{PO: khu vực lưu trữ dữ liệu của PostHog và Sentry}}). Cross-border transfers of personal data are carried out in accordance with Decree 13/2023/ND-CP and the Law on Personal Data Protection, including the required impact assessment dossiers.

8. Retention

• Account and learning data: kept while your account exists.
• Guest accounts that never sign in: data stays on the device or in the browser; deleting the app or clearing site data deletes it.
• Server logs: 30 days. Encrypted database backups: 30 days.
• Instructor registration data: {{PO: thời gian lưu và cách xoá dữ liệu đăng ký của giáo viên}}
• One-time codes: 24 hours.
• Data export download links: expire after 24 hours.
• When an account is deleted (section 9): personal data is deleted from live systems; review history is anonymised and kept only for aggregate statistics, no longer linked to you. Deleted data may remain in encrypted backups for up to 30 days, until those backups expire and are deleted.

9. Your rights

You have the right to be informed, to consent, to access, correct and delete your data, to withdraw consent, to restrict or object to processing, to obtain a copy of your data, and to complain, as provided by law. How to do this:

• Download my data (Settings → Account & privacy → Account): creates a JSON file with your profile, progress, practice-exam results, saved questions and referral information; the download link is sent by push notification or email within 24 hours.
• Delete account (Settings → Account & privacy → Account): after confirming with a one-time code or by signing in again, the account immediately enters a pending-deletion state, you are signed out on all devices and hidden from the instructor dashboard. After 7 days the data is permanently deleted, including at PostHog and Sentry, and push tokens are revoked. Signing in again within those 7 days cancels the deletion.
• Delete your account without the app: if you have uninstalled the app or cannot use it, open dolaiapp.com/xoa-tai-khoan in a browser, sign in (one-time code, Apple or Google) and confirm the deletion; or email an account deletion request to {{PO: email liên hệ quyền riêng tư}} with the phone number or email of the account. We verify that you own the account before acting on it; the account is then deleted under the same 7-day process described above.
• Consent: change your consent groups at any time.
• Notifications: turn each notification type on or off in Settings → Reminders. To stop Zalo ZNS reminder messages, withdraw the "Marketing" consent in Settings or use the unsubscribe link in the ZNS message. This does not affect sign-in one-time codes.

For other requests, contact {{PO: email liên hệ quyền riêng tư}}. We respond within {{PO: thời hạn phản hồi yêu cầu về dữ liệu}}.

10. Security

Connections use TLS; phone number, email and display name are encrypted at rest; backups are encrypted; sessions use short-lived tokens with reuse detection; administrator access requires two-factor authentication. No measure is perfectly secure; if an incident affects your data, we will notify you as required by law.

11. Advertising

Đỗ Lái currently shows no ads, and the advertising library is not initialised, so no data is collected for advertising. If ads are enabled in the future, they will be non-personalised only, will not track you across apps, and will never appear while you are studying or taking an exam. We will update this policy before enabling them.

12. Children

Đỗ Lái serves people preparing for driving licence theory exams and is not directed at children. {{PO: chính sách độ tuổi tối thiểu và xử lý dữ liệu của người chưa thành niên}}

13. Changes to this policy

When we change this policy, we update the version number and effective date at the top. If a change affects the purposes or types of data you consented to, the app will ask for your consent again.

14. Contact

Hiep Nguyen — {{PO: email liên hệ quyền riêng tư}} — {{PO: địa chỉ liên hệ của bên kiểm soát dữ liệu}}

See also: Personal data processing notice · Terms of Use · Disclaimer