The "Saobraćaj" app is a trainer for the theory part of the driving licence exam in the Republic of Serbia (a mobile app for Android and iOS and a web version at https://saobracaj.gleb.at; hereinafter the App or the Service).
This Privacy Policy explains which personal data we collect, why we process it, whom we entrust it to, how long we keep it and what rights you have. It is drawn up in accordance with the Serbian Personal Data Protection Act (Zakon o zaštiti podataka o ličnosti, "Službeni glasnik RS", No. 87/2018; hereinafter the PDPA) and, to the extent it applies to users from the European Economic Area, with the General Data Protection Regulation (GDPR).
The Serbian version is the legally binding one. This English translation is provided for convenience; a Russian translation is also available.
The controller of personal data is:
Gleb Klimov, independent developer and publisher of the App
Address: [address and registration details of the controller — to be completed by the operator before publication]
E-mail for data-protection matters: info@gleb.at
Telegram: @GlebKl
No data protection officer has been appointed, as the controller is under no legal obligation to appoint one. For all questions please use the e-mail address above.
The App is designed to collect as little data as possible. The questions, correct answers, the law text and most learning material ship with the App and do not require an account. Without an account, all your progress is stored only on your device and is not accessible to us.
An account is needed only for features that inherently require identification: syncing progress between devices, question lists, groups, public comments, the support chat, the AI assistant and the subscription.
We do not sell personal data and do not use it for third-party advertising.
On registration we process:
When you are signed in, the following data is synced to our server so you can continue on another device:
From aggregated, de-identified answer data of all users we compute question-difficulty statistics ("how many users get this question wrong"). These statistics contain no data identifying you.
The "Ask AI" feature runs on services of Anthropic, PBC (USA). When you send a question to the assistant, the following is transmitted to Anthropic's servers: the text of your message, the text of the exam question the conversation is attached to and — when you ask for an analysis of a test result — your answers in that test. Not transmitted are your e-mail, name or other account identifiers: Anthropic receives only the conversation content. Under our agreement with Anthropic this data is not used to train models.
The AI conversation history is stored with your account so you can return to it; it is deleted together with the account.
Our server (API) records standard technical data about requests: IP address, time, requested address, App and OS version (User-Agent), server response. This data serves security, abuse detection and troubleshooting and is kept for a limited time (section 6).
To understand which features are used and where users run into difficulties, the App sends usage events to PostHog (PostHog Cloud EU); this data is stored on servers in the European Union (Frankfurt, Germany). Collected are: screen views, selected events (e.g. test started and finished, a question being shown and whether the answer was correct, sign-in, opening a summary), a pseudonymous installation identifier (the same one the App sends to our server), a launch identifier, the operating system and its version, the App version, the interface language and whether Russian-language content is enabled. From the IP address of the request PostHog derives an approximate location at country/city level; we do not use the IP address from analytics for anything else.
Text you type does not go into analytics: for search only the query length and the number of results are recorded, for messages only the kind of conversation, for a promo code only whether it was accepted.
While you are signed in, analytics events are linked to your account (user identifier and e-mail address) so that we can also look at usage per account; without signing in, events are tied to the installation only. Analytics uses no cookies (section 12).
Where installs come from. Some of our links to the App go through an address like saobracaj.gleb.at/go/… (a social media post, a driving school, a flyer), so that we know which place brings users. When such a link is followed, our server records which link it was, the platform (Android, iOS, web), the browser's User-Agent and the IP address (for IPv6, only the network part of the address) and redirects you to Google Play, the App Store or the web version. When the App is then launched for the first time, the server ties the click to the installation: on Android through the click identifier Google Play hands back to the App (the install referrer); on iOS, and when an already installed App is opened, by comparing the network (IP address) and the time of the click and of the launch. The IP addresses of launches are compared, never stored; the IP address and User-Agent of a click are deleted after 48 hours. If you later sign in, the link you came through is recorded for your account, so that sign-ups and purchases can be counted per source. This data serves aggregate statistics per link only; we do not use it for advertising and do not pass it to third parties (other than the analytics events in PostHog described above).
If you order a subscription (available only in the web version):
| Purpose | Data | Legal basis (Art. 12 PDPA / Art. 6 GDPR) |
|---|---|---|
| Providing the Service: account, sync, lists, groups, comments, AI assistant | 3.2–3.5 | performance of the contract with you (terms of use) |
| Subscription, billing, bookkeeping | 3.8 | performance of the contract; compliance with legal obligations (accounting and tax rules) |
| Account and order notifications (e-mail) | e-mail address | performance of the contract |
| Push notifications about group events and replies | device token | consent (the permission you grant in the operating system; revocable in device settings) |
| Subscription-expiry reminders | e-mail address | legitimate interest; can be switched off in settings |
| Security, abuse prevention, error diagnostics | 3.6 | legitimate interest of the controller |
| Usage analytics | 3.7 | legitimate interest in understanding usage and improving the App |
| Statistics per source link (where installs, sign-ups and purchases come from) | section 3.7, «Where installs come from» | legitimate interest in knowing which channels bring users |
| Question-difficulty statistics | aggregated de-identified data | legitimate interest; the result contains no personal data |
| Answering your requests | request content, contact | legitimate interest / performance of the contract |
We do not disclose data to third parties for their own purposes. Processing on our behalf (processors) is carried out by:
| Processor | What it does | Data location |
|---|---|---|
| EDIS GmbH (Austria) | rented server running our API and database | data centre in Belgrade, Serbia |
| Google Ireland Ltd. / Google LLC | Firebase Authentication (Google/Apple sign-in), Firebase Cloud Messaging (push), Google Cloud Storage (support attachments) | EU (region europe-west1, Belgium) for storage; EU/USA for the other services under Google's terms |
| Apple Inc. | "Sign in with Apple" | under Apple's terms |
| PostHog, Inc. | usage analytics (section 3.7) | EU (Frankfurt, Germany) |
| Anthropic, PBC | processing of AI-assistant requests (3.5) | USA |
| Resend, Inc. | transactional e-mail (confirmations, codes, orders) | USA / EU |
| GitHub, Inc. | hosting of these documents and of the web version | USA |
| Banks | receiving subscription payments | Serbia |
Data is disclosed to public authorities only where a legal obligation exists (e.g. a court order).
Our database and server are located in Serbia. Some processors (section 5) process data in the European Union — states which the Government of the Republic of Serbia has determined to ensure an adequate level of protection — or in the United States. For transfers to states without an adequacy determination we rely on standard contractual clauses and data-processing agreements in accordance with Art. 65 PDPA (Art. 46 GDPR).
| Data | Period |
|---|---|
| Account and data tied to it (progress, lists, settings, AI conversations, sessions, device tokens) | until account deletion |
| Public comments | until the comment or the account is deleted (the text is then replaced by a "deleted" marker) |
| Support messages and attachments | until account deletion; on your request at deletion time they are removed as well |
| Orders and subscription periods | 10 years from the end of the business year — the retention period for accounting records under Serbian law; this data is not deleted with the account but is detached from your identity (see section 8) |
| Server technical logs | up to 12 months |
| Analytics data (PostHog) | for as long as needed to analyse usage; data linked to your account is deleted on your request (sections 8 and 9) |
| IP address and User-Agent of a click on a source link | 48 hours; the click itself and its link to an installation remain as aggregate statistics, and the link between an account and a device is deleted with the account |
| Local data on the device | until you delete it yourself |
You can delete your account yourself: Settings → Profile → Delete account (confirmed with a code sent by e-mail), or by sending a request to info@gleb.at from the account's e-mail address. Detailed instructions: https://docs.saobracaj.gleb.at/delete_account.html.
On deletion: e-mail, password, name and access rights are irreversibly anonymised; progress, lists, AI conversations, sessions, grants and device data are deleted; group memberships end (a group you founded passes to its longest-standing member or is closed); comments are replaced by a "deleted" marker; support messages remain anonymous unless you also request their removal at deletion time. Analytics data (section 3.7) is not deleted automatically — on your request we will delete it as well. Order records remain in the accounting records without any link to your identity.
Local data on the device can be kept at deletion (as guest progress) or deleted — your choice.
Under the PDPA (Art. 21–38) and the GDPR you have the right:
Send requests to info@gleb.at. We will respond without undue delay and at the latest within 30 days of receipt (the period may be extended in complex cases, of which we will inform you). To protect your data we may ask you to send the request from the account's e-mail address.
If you believe the processing of your data is unlawful, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti): Bulevar kralja Aleksandra 15, 11120 Belgrade, https://www.poverenik.rs, office@poverenik.rs. Persons in the EU may also contact the supervisory authority of their own state.
We apply technical and organisational measures proportionate to the risk: encrypted connection (HTTPS/TLS) between the App and the server, password hashing (Argon2), restricted access to the server and database, regular backups, data minimisation in integrations (e.g. the AI assistant does not receive your identity), access logging. No system is absolutely secure; we will notify you and the Commissioner of a data breach likely to result in a high risk to your rights, as required by the PDPA.
The App is intended for people preparing for the driving exam and is not directed at children under 15. We do not knowingly collect data of children under 15; if we learn of such a case, we will delete the account. Parents and guardians can contact us at info@gleb.at.
The web version at https://saobracaj.gleb.at uses the browser's local storage (localStorage, IndexedDB) for essential functions: keeping your session, settings, local progress and the installation identifier — the App cannot work without it, and no consent is required for that. We do not use cookies — neither for analytics nor for advertising: analytics events (section 3.7) are sent directly to PostHog, without cookies and without third-party tracking tools.
We may change this Policy from time to time. The current version is always published at https://docs.saobracaj.gleb.at/privacy_policy.html, and the complete change history — with the date and content of every change — is publicly available in the repository history: https://github.com/Saobracaj/public_documents/commits/main/privacy_policy.md. We will notify you of material changes in the App or by e-mail.
Gleb Klimov — info@gleb.at — Telegram @GlebKl
Last updated: 29 September 2026.