Privacy notice

Draft of 2026 09 17. Read by counsel, who returned no blockers. Still a draft, and not in force.

A review is not the same thing as a signature. This text stops being a draft when somebody says the final words are final, and nobody has.

This draft was written from Camito's own Processing Inventory, which lists every data flow the product is specified to have, and from the Legal Surface Specification, which says what shape these documents take and why. Where the inventory records that something is not yet known, this draft says so in the same place rather than filling it with a number that sounds right.

---

In short

• Camito is a study app. It teaches road rules and tests you on them.
• We collect what it takes to run that: your account, which course you picked, your progress and your scores, and the technical data that tells us whether the app is working.
• We never see your card. Apple and Google take the payment and tell us only whether you are subscribed.
• We do not sell your personal information and we do not share it for cross-context behavioural advertising.
• You can delete your account, and everything in it, from inside the app.
• If something here is unclear, write to us at [email protected].

Who is responsible for your data

Camito is operated by Mimi Studio d.o.o., a company registered in Slovenia and based in Ljubljana. Mimi Studio d.o.o. decides what is collected and why, so in the language of European data protection law it is the controller of everything described on this page.

OpenThe exact registered address and the company and tax identifiers are held once in the Portfolio Publisher Profile and are not reproduced here from memory. Copy them from that profile rather than from anywhere else, so that the address in this notice, in the App Store listing, in the Google Play listing and in the Terms is one address rather than four.

Because Mimi Studio d.o.o. is established in the European Union, it does not need a separate representative in the Union.

OpenWhether a United Kingdom representative is required under Article 27 of the UK GDPR, and who it would be, is a live question rather than a formality: the company is established in the EU and not in the UK, and the UK is a Launch Territory. Counsel, before the first UK visitor is offered the app.

You can reach us about anything on this page at [email protected].

Who Camito is for, and how old you have to be

You must be at least 13 years old to use Camito. If you are under 18, you must have your parent or guardian's permission to use it. The Terms say the same two numbers in the same words, and the app's store rating is 4+.

We do not knowingly collect personal information from anyone under 13. If you tell Camito you are under 13, it stops there: no account is created, no profile is stored, and nothing about that moment is sent to any analytics or advertising service. If we learn that we hold information about a child under 13, we delete it.

OpenHow a parent or guardian gives that permission, and what Camito records about it, has not been designed or built. In parts of the European Economic Area the age at which a young person can consent on their own is 14, 15 or 16 rather than 13, which means that in those countries a parent has to consent for some of what is described below and not for the rest. The per-country analysis is partly done and partly not: Spain and Italy are 14, France is 15, the Netherlands and Germany are 16, and Poland, Czechia, Austria and every other member state are not yet established. Counsel decides what this notice must say, and the product has to build the mechanism before any of those countries is opened.

What we collect, why, and what happens to it

Your account

Authentication email

The messages that carry a sign-in code or a password reset are sent for you, addressed to you, and cannot be switched off, because turning them off would lock you out of your own account. Unsubscribing from anything else never stops them. They are sent through Supabase and Resend, from auth.camitoapp.com.

OpenHow long Resend keeps its sending logs is a setting on an account that has not been created, and a term of a data processing agreement that has not been signed.

Before you have an account

Camito works before you create an account, so it gives your device an identifier of its own and keeps your progress against that. These identifiers are not your name and are not your email address. They last as long as the app is installed and are gone when you uninstall it.

One honest limitation. If you never create an account, we have no way to find your data if you later ask us to delete it, because we would have nothing to match you to. We have not solved that, and we would rather say so than pretend otherwise.

Your subscription

Payment details

We never receive them. Apple and Google are the merchants for anything you buy inside the app. Your card number, your billing address and your payment history with the store are between you and the store. We are told whether you are subscribed. We are not told what you paid with.

What you do in the course

Which course you picked

Your jurisdiction and vehicle class. Camito needs these to show you the right road law and not somebody else's, and it keeps your progress separately for each course rather than merging them.

The questions we ask when you start

If Camito asks you anything about yourself when you set up, such as where you are in your preparation, those questions are optional, you can skip them with nothing taken away, and your answers are never sent to an advertising service.

OpenWhich of these questions Camito actually asks is not settled, and how long the answers are kept is not settled either.

How the app is used

We record how the app is used so we can tell whether it works: which screens are opened, which lessons are finished, where people stop. This goes to Mixpanel, along with your app version, platform, device model, language and country.

In the United States this does not need a consent banner, because it is our own measurement of our own app and carries no advertising identifiers. In the European Economic Area and the United Kingdom the rules are different and stricter.

OpenThe exact requirement in the European Economic Area depends on how each member state has written the ePrivacy rules into its own law, and those laws have not been read. Until they have, this notice cannot describe an opt out in a way that is true in a particular country, and Camito should not open a European country. Counsel, per country, before the first one opens.

OpenMixpanel's region and its retention setting are both chosen when the project is created, and no project exists.

Advertising measurement

If Camito ever runs paid advertising, it would use an advertising identifier to work out which advertisement brought someone to the app, through Singular and Meta.

This only happens with your permission. On an iPhone that is the tracking permission iOS asks for, and if you say no, it does not happen. In the European Economic Area, for a young person below their country's age of digital consent, a parent has to give that permission and the user cannot give it alone, so for that group these services are simply off. None of this affects the course, your progress or your subscription, which work on a different legal basis entirely and are never conditioned on permission to advertise.

Crashes and errors

When Camito crashes or misbehaves it sends us a technical report: what the code was doing, which version, which device and operating system. It carries your account identifier so we can tell one person's crash from another's. It does not carry your email address.

OpenSentry's region and how long it keeps this are both set on an organization that has not been created.

Email about your own progress

If we send you a report about your own progress, it goes through Klaviyo from mail.camitoapp.com, and every one of them carries a link that stops future progress reports without affecting anything else.

Creating an account does not sign you up for marketing. Newsletters and offers are a separate, clearly labelled choice that starts switched off and only happens if you positively ask for it. Unsubscribing from marketing does not stop progress reports, unsubscribing from progress reports does not withdraw marketing consent, and neither one stops the sign-in and password emails.

OpenKlaviyo's region and its retention are not established.

When you write to support

What you write to [email protected], your email address, and anything you choose to paste into the message reaches a support system called Help Scout, which holds the conversation.

Please do not send us health information. You do not need to explain a medical condition or a disability to get help with a study app, and if you mention one we will not ask for details.

Two things worth knowing, because most companies do not say them. The first is that a support conversation is filed under your email address, not under your Camito account, so deleting your account does not delete an old support conversation. Ask us and we will delete it. The second is that we have not yet fixed that, and we are recording it here rather than hoping nobody notices.

OpenWhich service carries the message from camitoapp.com into Help Scout is not decided for Camito: the portfolio runs two different inbound paths. It changes who handles the message on the way and therefore who has to appear in the list of processors below.

OpenHow long Help Scout keeps a conversation is a setting nobody has chosen. It should be chosen deliberately rather than left at a default, precisely because this is the one place people write things about themselves that we never asked for.

Study reminders

If you set a reminder to study, the schedule lives on your device and nowhere else. Camito sends no push notifications from a server, holds no push token, and receives no report of whether a reminder was shown. Uninstalling the app removes it.

Your age

Camito needs to know whether you are at least 13 and whether you are under 18. It stores the answers to those two questions, not your date of birth, unless a particular country's law requires more. Your age is never sent to any analytics or advertising service.

Backups, and how long deletion really takes

Camito's database is backed up once a week, encrypted, to private storage. The twelve most recent weekly archives are kept and older ones are deleted automatically.

This means that when you delete your account, a copy of your data can remain in our backups for up to about twelve weeks. It is not in the live service, nobody is using it, and it is deleted when the archive that holds it rolls off. We would rather tell you the real number than say "deleted immediately" and be wrong.

OpenSupabase may also run its own provider backups on its own schedule. What that schedule and its retention are has not been checked, and it is a different thing from the weekly archive above.

Server logs

Running a service produces logs: which requests arrived, when, from which internet address. DigitalOcean and Supabase hold these and they rotate in the ordinary way.

OpenHow long each of them keeps a log is not established.

This website

The website you are reading now is deliberately simple, and here is exactly what it does.

• It is a set of static pages. It has no database, no account system and no connection to Camito's servers.
• It sets no cookies and runs no analytics. Nothing on it counts you, follows you or reports you to anybody.
• It loads nothing from anybody else. The fonts are served from this site, not from a font service, so no third party learns that you visited.
• The one thing stored in your browser is the language you chose, if you chose one, so the site does not ask again. It identifies nobody and it never leaves your browser.
• Our hosting provider keeps ordinary web server logs, which include your internet address, as described above.

If a part of this site ever does more than that, this section changes first.

OpenCamito's account, cancellation and recovery pages are a separate application at app.camitoapp.com and have not been built. When they are, they handle signed in journeys and this notice will need a section for them. There is also a decision nobody has taken about whether Camito ever sells subscriptions through the web, which would add a payment processor and a lead capture to this notice. It is deliberately not described here as though it existed.

Who else processes your data

OpenEach of these needs a signed data processing agreement, a recorded region and a recorded retention period before this list is complete. None of the accounts exists yet, so none of those three facts exists yet either. This list names who we intend to use and what for, and that is as far as it can honestly go today.

Mimi Studio d.o.o. is in Slovenia, and several of the companies above are in the United States, so some of the data described on this page leaves the European Economic Area.

OpenWhich mechanism makes each of those transfers lawful, vendor by vendor, is still unanswered, and it is now blocked on one thing rather than two. The operating entity is settled. The vendor regions are not, because no account exists at any of them, and the mechanism is a term of a data processing agreement that nobody has signed. Counsel names it per vendor once those agreements are executed.

What you can do

Wherever you are, you can:

• See and export what Camito holds about you, from inside the app.
• Correct it, from inside the app.
• Delete your account, from inside the app, which erases your data from the live service, subject to the backup period described above.
• Stop marketing email, from any marketing email.
• Stop progress reports, from any progress report.
• Withdraw permission for advertising measurement, in your device settings.
• Write to us at [email protected] about any of it.

If you are in the European Economic Area or the United Kingdom

You have the rights the General Data Protection Regulation gives you: access, correction, erasure, restriction, portability, objection to processing based on our legitimate interests, and withdrawal of any consent you gave. Withdrawing consent does not undo what was lawfully done before you withdrew it. You can also complain to your national data protection authority, and you do not have to come to us first.

If you are in California, Virginia, Colorado or Connecticut

You have the rights your state gives you: to know what is collected and why, to get a copy, to correct it, to delete it, and not to be treated worse for asking.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing for you to opt out of on that front. If that ever changes, this page changes first and the opt out appears with it.

To use any of these rights, write to [email protected]. We may need to check that the account is yours before we act, which usually means answering from the address the account uses. If we ever say no to a request we will tell you why, and you may appeal by replying to that answer.

OpenCamito's Launch Territories are wider than these four states and wider than the European Economic Area. Which other state and national privacy regimes apply, and what each of them requires this section to say, is counsel's call territory by territory. Four states are named because those four regimes are in force and were checked. Naming fifty would be a claim nobody verified.

Things we have not solved, listed rather than hidden

1. Deleting your account does not delete an old support conversation. It is filed under your email address, not your account. Ask us and we will delete it.
2. Backups keep a copy for up to about twelve weeks after you delete your account.
3. If you never made an account, we cannot find your data to delete it, because there is nothing to match you to.
4. We have not yet confirmed exactly what RevenueCat keeps after we ask it to delete a subscriber. We ask, and we have not read the answer back against their own documentation and the signed agreement, so we will not tell you it is complete until we have.

OpenItem 4 is settled by reading RevenueCat's deletion API documentation and the executed data processing agreement, not by asking anybody's opinion. It is listed as a limitation rather than left out, because the Processing Inventory records it as not established and a notice that quietly implied otherwise would be claiming something nobody checked.

Changes

If this notice changes in a way that matters, we will say so in the app rather than quietly changing the date at the top.

Contact

[email protected]

---

Notes for counsel, to be removed before publication

Review status, 2026 09 17. Counsel has read this draft and the Terms and returned no blockers, alongside three other questions that were queued at the same time: whether a thirteen year old may lawfully be charged for a monthly subscription, New York provider licensing, and whether the California disclaimer belongs on the second paywall as well as the first. None of those came back with a blocker either. The controller is now named, which was the one thing still owed and was never a legal question. What remains is everything marked open above, and every one of those is waiting on an account being created or a decision being taken, not on a lawyer.

This draft deliberately does not do several things the category usually does, and each omission is a decision rather than an oversight.

1. No retention period is invented anywhere. Every one that is not actually known is marked open. The Processing Inventory records these as unverified because the accounts that would fix them have not been created, and a period written here would be repeated into an Apple privacy declaration and a Google Data Safety form and become a representation to a regulator that nobody checked.
2. No vendor region is stated. Same reason. This is what still blocks the international transfer section: the controller's own country is now known, and the other end of each transfer is not.
3. The twelve week backup latency is stated in plain words because the Processing Inventory requires it in those words, and because it is the honest end to end deletion time.
4. The age floor is stated once, identically here and in the Terms: at least 13, and under 18 with a parent or guardian's permission. The Legal Surface Specification records that the reference product states its floor in two documents that never cross reference each other, and that Camito does not repeat that.
5. The under 13 branch blocks rather than records. A user who says they are under 13 hands us actual knowledge under the Children's Online Privacy Protection Rule, so writing a record about that moment would be the specific thing the rule forbids.
6. The state rights section covers four states, not one. The reference covers California alone. Virginia, Colorado and Connecticut are in force. Which further states apply is an open item above.