Privacy Policy

This is a translation. The Dutch privacy policy is the legally binding version.

Verkeersvragen — Dutch car theory for a category B driving licence · last updated on 25 October 2026

What data is stored

The app stores your progress exclusively locally, in the app's storage on your phone:

• which questions you have answered correctly;
• which questions you have answered incorrectly and wish to repeat;
• how many free practice tests you have used;
• whether you have unlocked unlimited practice.

This data is not transmitted. It disappears when you uninstall the app or clear the app data.

Purchases

The one-time unlocking of unlimited practice is handled through Google Play Billing. The payment itself is processed by Google; the app is only told whether you own the unlock. The developer sees no payment details, no name and no address. The Google Play privacy policy applies to that payment.

Internet connection

The theory, the questions and the images are contained in the app itself; you can practise entirely without a connection. A connection is used only by Google Play Billing and when you yourself tap a source link. Such a link opens in your browser, after which the privacy policy of that website applies.

Practice tests on the website: account and telephone number

The practice questions are not in the page but on our server. Each test is issued and marked there. In this way nobody can bypass the paid tests by changing something in their browser, and that is why we need an account to keep track of who holds a pass. Without an account you can only take the fixed trial test of fifteen questions; nothing is stored for that.

• E-mail address and password: processed by Supabase, the service that handles logging in and the database. The password is stored only in encrypted (hashed) form. The confirmation e-mail is sent via Resend on behalf of nariman.nl.
• Telephone number: after you purchase a pass you receive a one-time code via WhatsApp or SMS, sent by Bird (a European messaging service) on our behalf. We do not store the number itself: on our server there is only an encrypted code of the number (an HMAC with a secret key) and the last three digits, so that you can recognise the number. Bird stores the number in its own verification log in accordance with Bird's privacy policy. One number belongs to one account, so that a pass belongs to one person.
• Robot check: the form for your telephone number contains Cloudflare Turnstile, an "I am not a robot" check without puzzles. For this purpose Cloudflare processes technical data from your browser and connection, such as your IP address, solely to automatically detect abuse of the code button. We are told only whether the check was successful. Cloudflare's Turnstile privacy policy applies to this.
• Devices and session: your browser receives a random device identifier (a number without meaning, not characteristics of your device). For each account we store which devices have been used, with a short description such as "Chrome on Windows" and the time of last use, and which session is currently active. You can practise on at most three devices and be logged in on one at a time. You can remove devices in your account.
• Tests: for each test started we store which questions you received, your answers, the score, the time, the device and a pseudonymised code of your IP address (a hash with a secret key; the address itself is not stored). We use that code only to detect abuse, such as a single account being used from many different places at the same time.
• Payments: paying for a pass (one week, one month or two months of unlimited practice) is handled by a payment service: Mollie or Stripe (including iDEAL and card); on the payment page you can see which one. That service processes the payment details in accordance with its own privacy policy; we receive only the payment reference, the amount and the status. We do not see any bank account number.
• Source and discount code: how you found us (for example via TikTok, a driving school or a friend) and any discount code; see below.
• Log: events that matter for security (logging in on another device, a refused start, a confirmed number, a licence) are stored with the time and the pseudonymised IP code.

This data is held by Supabase in a data centre in London (United Kingdom, with an adequacy decision of the European Commission) and is not shared with anyone other than the processors named. We use it solely to deliver the tests, to keep track of the free tests and licences, to prevent abuse and (only the source and the code) to see which channels work; not for advertising or profiling. We keep tests and log entries for at most two years; an account and its linked data until you have it deleted.

How you found us: source and discount code

We want to know which channels work, without tracking you. For that reason we do not use Google Analytics and no other measurement software that follows you; only the Google tag, the TikTok pixel and the Meta pixel for advertising, and only after your consent, and a count without cookies (all four below). We look only at what is contained in the link itself with which you open the site.

• Source: a short label in the link, such as ?bron=tiktok or utm_source=…, or "google-ads" or "tiktok-ads" if you arrive via a Google or TikTok advertisement, or "meta" if you arrive via a link on Facebook or Instagram (we see that from an identifier in the link; we do not store that identifier itself). Your browser stores the label together with the date of your first visit in the local storage of this site. The first source counts; after 90 days a new source may replace it. As long as you do not create an account, the label only goes along in the anonymous count below, separate from who you are.
• Discount code: a code from the link (?code=…) or a code that you type in yourself. This too remains in your browser until you create an account or buy a pass.
• With your account and your payment: if you create an account, we store the source, the code and the date of your first visit with it. If you buy a pass, we store the package, the amount, the discount, the code used and the source with the payment.
• Share code: anyone who buys a pass receives a personal code to share with friends; a friend receives a discount on their first pass with it. We store which code belongs to your account and with which payments it has been used. Anyone who uses your code cannot see who you are; you can see only how often it has been used, not by whom.
• Driving schools: a driving school with its own code receives from us only the number of sales made with that code and the commission that goes with it; no names, e-mail addresses or other data of students.

Why: to see what a channel yields (how many accounts and sales per source and per code), to give the discount and to pay driving schools their commission. Legal basis: the performance of your purchase (the discount and the commission) and our legitimate interest in measuring our own sales in a way that says as little as possible about you. We look at this data in aggregate per source and per code, do not build a profile of you with it and share it with no one. It disappears with your account. After the page has loaded, we remove the source and the code from the address bar, so that a link you share does not pass on your source or code. If you do not want your source to be stored, open the site without those additions in the link, or clear the site data in your browser before you create an account.

Counting visits, without cookies

To see how many people use the site and where they drop off, we count visits and a few steps, such as: prices viewed, account created, test started, payment started. For this we do not place any cookies, store nothing in your browser and do not give you an identifier. A count therefore cannot be linked to you, nor to your other counts.

• Cloudflare Web Analytics counts visits and pages viewed, with technical data such as your browser, your country and the site you came from. Cloudflare already delivers the site and does this as our processor, without recognising you or following you across sites.
• Our own count receives per step only the step, the screen or the package, the language of the site, the source label from the link (see above) and, with your first step, the site you came from. Cloudflare adds the country and the type of device (mobile, tablet, computer). No account, no e-mail address, no IP address.

We only look at totals per day, step, language and source. Legal basis: our legitimate interest in improving the site and measuring our own sales. The counts are deleted after 90 days. Nothing is counted in the Android app.

Advertising by Google (only with consent)

We advertise through Google Ads. To measure whether an ad leads to a visit or a purchase, we load the Google tag, but only if you click Allow all or Marketing in the cookie notice. If you decline or make no choice, nothing from Google is loaded and nothing is stored.

• What happens: Google places a cookie (for example _gcl_au, for up to 90 days) and receives technical data such as your IP address, your browser, the page visited and, if you came through an ad, the click ID from the link. If you buy a pass, Google learns that too, with the amount, the package and the time you started the payment (so that a purchase counts once).
• What does not: personalised ads and Google Analytics are switched off, and we do not send Google your name, e-mail address (not even hashed), phone number or payment details.
• Changing your choice: via Cookies at the bottom of the site. If you withdraw your consent, we remove the tag's cookies from your browser.

Legal basis: your consent. Google's privacy policy applies to what Google does with this data; Google may also process data outside the EU.

Advertising by TikTok (only with consent)

We also advertise on TikTok. To measure whether an ad leads to a visit or a purchase, we load the TikTok pixel, but only if you click Allow all or Marketing in the cookie notice. If you decline or make no choice, nothing from TikTok is loaded and nothing is stored.

• What happens: TikTok places cookies (for example _ttp, for up to 13 months) and receives technical data such as your IP address, your browser, the page visited and, if you came through an ad, the click ID from the link. TikTok also learns when you view the passes, choose a pass, start a payment or buy a pass, with the package and the amount.
• What does not: we do not send TikTok your name, e-mail address, phone number or payment details, and the pixel does not read the text of the pages or your clicks.
• Changing your choice: via Cookies at the bottom of the site. If you withdraw your consent, we remove the pixel's cookies from your browser.

Legal basis: your consent. TikTok may also use this data to get our ads in front of the right people more effectively; TikTok's privacy policy applies to that, and TikTok may also process data outside the EU.

Advertising by Meta (only with consent)

We also advertise on Facebook and Instagram (Meta). To measure whether an ad leads to a visit or a purchase, we load the Meta pixel, but only if you click Allow all or Marketing in the cookie notice. If you decline or make no choice, nothing from Meta is loaded and nothing is stored.

• What happens: Meta places cookies (for example _fbp and _fbc, for up to 90 days) and receives technical data such as your IP address, your browser, the page visited and, if you came via Facebook or Instagram, the click ID from the link. Meta also learns when you view the passes, choose a pass, start a payment or buy a pass, with the package and the amount.
• What does not: we do not send Meta your name, e-mail address, phone number or payment details, and the pixel does not read the text of the pages or your clicks.
• Changing your choice: via Cookies at the bottom of the site. If you withdraw your consent, we remove the pixel's cookies from your browser.

Legal basis: your consent. Meta may also use this data to get our ads in front of the right people more effectively; Meta's privacy policy applies to that, and Meta may also process data outside the EU.

Trial test and passes on the website

Without an account you take a trial test of fifteen questions. With an account you buy a pass: one day for € 3.50, one week for € 7, one month for € 20 or two months for € 30. It is not a subscription: the pass stops automatically. The server keeps track of the status; your browser holds only a copy for display purposes.

Third parties

The app contains no advertisements, no advertising ID and no third-party software that collects data.

Children

The app is aimed at people preparing for the theory exam for a category B driving licence and collects data from nobody, regardless of age.

Your rights

Anyone who practises without an account (the app, or the trial test on the website) leaves no personal data behind. If you wish to erase your local progress, delete the app data via your device's settings or clear the site data in your browser.

If you have an account on the website, you can use the contact address below to ask which data has been stored about you, to have it corrected or to have your account deleted. On deletion, your tests, devices, your share code, the source and the log are deleted with it; the encrypted code of your telephone number is retained, so that the same number cannot repeatedly be linked to a new account. The number cannot be recovered from it.

Changes

In the event of a change, the date at the top of this page is updated. Changes that affect the handling of data are also announced in the app.

Contact

Questions about this privacy policy: [email protected]
Controller: nariman.nl, Oder 20, Box G6168
2491DC Den Haag
Nederland