Privacy Policy (Kilsat / mileage log — Android)

Last updated: 27 September 2026
Version: 2.0.0
Support: kilsat.tuki@gmail.com

The Finnish text is the original. This file is the same notice in English. If the versions differ, the language that matches the language selected in the app applies. Mandatory privacy rights in the user’s country of residence still apply.

0. No connection to any tax authority

Kilsat is not an app of the Finnish Tax Administration, any other tax authority, or any public body, and it has no official, commercial, or other connection, partnership, approval, or endorsement from any tax authority or public body. The app is a tool made independently by a private developer. The name, appearance, or features do not mean an authority has reviewed, approved, or recommended the app. The user is responsible for whether the records they keep, and the way they use them in tax or bookkeeping, meet the rules that apply.

1. Controller and roles

Role	Who
Trip and driving data	The user. The data is stored on the user’s device. The user decides deletion, editing, and export.
The app and privacy questions	The developer of Kilsat (a private developer). The developer does not run a cloud service and does not receive the user’s trip list on the developer’s servers.

Kilsat is a local tool for keeping a mileage log. The developer processes only information the user sends in a support message.

2. What data is processed

The app may store and show the following on the user’s device:

trip start and end time
distance in kilometres or miles, depending on the report country (GPS measurement or manual entry)
classification (work or personal), purpose, and an optional note
start and end coordinates (GPS trips)
manually entered start and destination addresses
favourite addresses (name, address, coordinates, optional home or workplace mark)
favourite vehicles (name, licence plate)
the rate locked to the trip — in Finland a rate the user chooses, in other countries the rate stored in that country’s template — and the reimbursement calculated from it
the licence plate locked to the trip when it is saved
report fields the user types (for example driver name, default plate, default purpose)
an odometer reading: in most countries an optional note on a manual trip that does not change the reimbursement; on the German and Swedish reports the distance comes from the reading at the start and at the end

The app also stores settings on the device (for example a default mileage rate, language, onboarding acceptance, Plus and automatic-trip settings, the Canada region as provinces or territories, Ireland engine size, New Zealand fuel, and France fiscal horsepower and whether the car is electric). These are not sent to the developer’s server.

Not used: cloud sync, user accounts, or a developer cloud database. Trips are not synced to a Google Drive backup.

Widget: The home-screen widget shows the local driving state (km / reimbursement). Data is shared between the app and the widget only on the device.

Kilsat Plus (optional subscription): An optional Kilsat Plus monthly subscription (Google Play). Plus includes automatic trip detection, a foreground notification while driving, and a 4-minute stop reminder. The subscription is handled by Google Play Billing. The developer does not receive card details.

Kilsat Plus and privacy:

Data	Handling
Payment and billing	Google Play. The developer does not see card, bank, or Google account password data.
Entitlement	The app checks locally with Play Billing whether Plus is active.
Purchases	Google processes payments. The developer does not keep a separate subscription register on the developer’s servers.
Restore purchases	Uses Google Play Billing.

Subscription terms (price, trial, renewal, cancellation): see Terms of Use section 8.2.

Motion and automation (Plus): Automatic trip detection may use the Google Play Activity Recognition signal to support GPS speed, if Google Play services are available. If Google Play services are missing, detection uses GPS speed only. Data is processed only on the device.

Car connection (Plus): The app may locally detect a Bluetooth audio route or Android Auto. That information does not leave the device. It is used together with motion detection for GPS warm-up decisions (see section 3).

Start and stop refinements (Plus): Start and stop logic is tuned for traffic. All of the reasoning happens on the device. None of it is sent to the developer.

Cumulative start: Short stops (for example red lights or a queue) do not reset accumulated motion time when a trip is starting.
A car connection starts sooner: When the phone is connected to a car (Bluetooth audio or Android Auto / USB), a trip may start sooner than without a connection.
Start without a car connection (clear driving): If Activity Recognition or Android Auto is unavailable (common on many Samsung and other OEM devices), the app can still start a trip from GPS when you are clearly driving — typically about 12 km/h for at least about 1.5 minutes, or immediately at about 25 km/h. Walking does not usually meet this threshold.
Quick save when the car connection drops: When an automatic trip is running and a strong car connection (for example Android Auto or the car’s Bluetooth) drops at low speed (for example parking and switching the car off), the app may save the trip sooner (about 45–90 seconds) instead of waiting for a full 5-minute stop. In traffic the car connection does not usually drop, so the normal 5-minute safety time remains.
Cancel on public transport: If detection starts a trip by mistake (for example a bus, train, tram, or taxi), the user can cancel it in the app or from the notification. The app asks whether you are a passenger, and the user chooses a pause of 1, 2, or 5 hours (for example a long train or bus ride). A cancel from the notification uses a 1 hour pause, because the notification has no choice. The pause can end sooner if the user leaves the vehicle and stops or walks for about a minute and a half. The pause applies only to starting a new automatic trip: the Plus standby notification (Kilsat is detecting driving) may stay visible, and the pause does not change how location is handled — nothing is sent to the developer. If the trip is correct, the user can continue without cancelling. The reasoning and the pause stay on the device. The choice is not stored in trip history and is not used to build a profile.

Start-address anchor (local): The app may store the last reliable stop (coordinates, accuracy, time — not an address string) in local storage on the device, so the start address of an automatic trip can be formed more accurately even when continuous GPS was not on just before the trip began. The anchor updates from sparse background location and stationary detection and expires automatically after 24 hours. It stays on the device.

Automatic work / personal classification (Plus): If the user has marked home and/or workplaces among favourite addresses, the app may classify an automatic trip as work or personal by comparing the start point with those addresses (about 150 m). If there is no match, the user’s default is used. The reasoning is done only on the device.

Notifications: A foreground notification is shown during an active trip. Plus standby can show a separate foreground notification (Kilsat is detecting driving). During an automatic trip a 4-minute stop reminder can be shown (functional, not advertising). The weekly summary is optional and off by default. It is calculated on the device from the user’s own trips. It is not marketing. Notifications are not sent from the developer’s server.

3. Use of location

The app uses the device GPS (Google Play Services / Fused Location Provider) to measure trips. Location is not used for advertising, profiling, sale, or marketing tracking.

Permissions

While in use (fine/coarse location): starting a trip and live measurement.
Background location (optional): only if the user grants a separate background-location permission, measurement can continue while the screen is locked or the app is in the background. A visible foreground notification is shown during background tracking, as Android requires.
Activity Recognition (optional, Plus): supplementary motion detection for automatic trips.
Bluetooth Connect (optional, Plus): local detection of the car audio route.
Notifications: the foreground notification and the stop reminder.
Battery-optimisation exemption (optional): more reliable automatic trips; manufacturer-specific guidance.

Accuracy and errors

GPS can weaken in tunnels, indoors, or in flight mode. Without a valid GPS fix, saving a trip can be blocked, or the user can enter the trip manually.

Automatic trips (Kilsat Plus)

An automatic trip is an optional Plus feature. It may require background location. The free manual trip still works with foreground location permission.

GPS warm-up, standby, and battery: When Kilsat Plus automation is on, the app may keep a visible foreground service (a location-type foreground service) running even without an active trip, so detection can wake on Samsung and other OEM devices in sleep. The user sees a notification (for example Kilsat is detecting driving). This is not hidden tracking: the notification stays visible, location is not used for advertising, and the data stays on the device. A denser GPS window starts when, for example, motion detection sees movement in a vehicle, a car connection appears, or sparse background location wakes the app. If driving is not confirmed, the dense window closes (typically after about 1.5–3 minutes). The standby notification can remain for as long as Plus automation is on. Manufacturer battery settings can still stop background work. The user is shown guidance (Xiaomi, Samsung, Huawei, and others).

Force stop: If the user force-stops the app (or closes it aggressively from recent apps), Activity Recognition and sparse background location usually do not wake the process until the user opens Kilsat. This differs from iOS App Switcher behaviour. The most reliable use is to leave the app in the background and turn off battery optimisation.

Manufacturer deep-sleep: Besides ordinary Android battery optimisation, some manufacturers have a separate background restriction that does not appear in the ordinary Android settings. On Samsung One UI this is Settings → Battery → Background usage limits → Sleeping apps / Unrestricted — different from the general “Battery optimisation”. On Xiaomi the equivalent is the Autostart permission (Security app), and on Huawei systems App launch / Protected apps. In the app settings (Kilsat Plus → Background access) a “Improve reliability” button opens the matching screen when it can be recognised; otherwise the general battery-optimisation screen is opened.

The phone is kept awake while measuring: While an automatic or manual trip is active (tracking is on), a separate foreground notification for trip tracking is shown and the app keeps the phone awake for the measurement. The screen may turn off normally. This reduces the chance that a device’s deep sleep cuts GPS samples during a drive. Staying awake always ends when the trip ends, and it also ends by itself as a safety net if the app does not stop it.

Automation health check: When automatic trips are on, the app runs an occasional background check (at most a few times a day): whether GPS samples have arrived within a reasonable time and whether battery optimisation is off. If not, a local notification with guidance is shown. This is not continuous background tracking, and nothing is sent to a server.

Automatic detection is based on GPS speed, motion detection (if available), and the app’s rules. It does not guarantee correct detection in every situation (for example public transport). The user can cancel a wrong trip; see section 2.

Notification while driving (Plus): During an active trip a foreground notification is shown (on newer Android phones a progress bar in the notification, otherwise an ordinary notification). The data stays on the device.

4. Storage, transfers, and third parties

Local storage

All trip, favourite, and settings data is stored locally on the user’s device in the phone’s own database. The developer does not receive it automatically.

No developer servers

Trip and report data is not sent to the developer’s own servers and is not shared by the developer with third parties.

CSV and PDF reports are built on the device. The user can share the files through the device share sheet. The user is responsible for that.

Third-party services

Service	Purpose
Google Play Services (location)	Measuring a GPS trip
Google Play Services (Activity Recognition)	Supplementary motion detection (Plus, if available)
Google Play Billing	Optional Kilsat Plus subscription; voluntary Buy a coffee one-time purchase (not a donation / not charity)
Android Geocoder	Forming addresses (when used)
Device share sheet	Sharing CSV/PDF files with apps the user chooses

Those services’ privacy practices are set by their own terms.

5. Tracking and analytics

The app does not use ad tracking and does not sell user data. The app contains no third-party analytics or advertising software.

6. Purpose of use

Data is used only in the user’s own mileage log:

recording and editing trips
calculating mileage reimbursement
CSV and PDF export for the user’s own bookkeeping
monthly statistics (work and personal trips, per-vehicle summaries)
storing and reporting the trip’s licence plate
showing driving state in the widget
an optional weekly summary notification (calculated on the device from the user’s trips)
classifying an automatic trip as work or personal from home and workplace favourites (Kilsat Plus)
start and stop decisions for an automatic trip, and the detection pause after the user cancels (see section 2)

7. Retention and deletion

Data stays on the device until the user:

deletes individual trips
deletes all trip data in settings (Delete all trips)
uninstalls the app

The user is responsible for backing up their own data. The developer cannot remotely restore data that has left the user’s device.

8. The user’s rights and what they can do

Because trip data is on the user’s device, the user can in practice:

view the data in the app
correct the data
delete the data (one trip or all trips in settings)
export the data to their own archive (CSV/PDF) before deletion

Under the EU General Data Protection Regulation (GDPR) the user may ask the developer for an explanation of processing by contacting the developer.

The developer cannot remotely delete trips that are on the user’s device.

9. Security

The app is designed to work primarily without a network. Security rests on the device (the lock, Android file protection). The user should keep the device updated and use the device lock.

The developer is not liable for loss of data if the user’s device is lost, stolen, broken, or reset.

9.1 Developer’s privacy disclaimer

Because trip and location data is processed on the user’s device and not on the developer’s servers, the developer:

cannot remotely view, correct, or restore trip data
is not liable for loss of data from a lost, stolen, broken, or reset device, or from the user’s own deletion
is not liable for how the user shares CSV/PDF reports with third parties
is not liable for the accuracy of data the user enters, or for whether a tax authority, an employer, or an accountant accepts that data
is not a representative, partner, or subcontractor of the Finnish Tax Administration or any other authority — see section 0

Mandatory GDPR rights remain. The user may ask for an explanation of processing at the support address.

10. Children

The app is intended for adults (18+).

11. Changes to this notice

This notice may be updated (for example when features are added). The current version is available offline in the app’s Settings.

11.1 A report profile is not a choice of privacy law

The app can use a calculation template for different countries. A report profile is only a calculation and print template on the user’s device. It does not transfer trip data to that country, it does not make that country’s tax authority a controller, and it does not change where the data is stored.

If the phone’s region is Finland, the report uses the Finnish template. The country list is not shown at the start, in settings, or in the report. Changing the app language to Finnish or English does not open that list. When the phone’s region is another country, the user chooses the report country at the start.

Profiles exist for Finland, Sweden, Norway, Denmark, Germany, the Netherlands, Austria, Ireland, France, the United Kingdom, the United States, Canada, Australia, New Zealand, and South Africa. Kilsat is not an app, partner, or approved product of any of those countries’ tax authorities, mileage-log rules, or public bodies. A mileage rate stored in a profile is a figure and a date in the profile. It is not an authority’s decision on the user’s tax.

11.2 Which privacy law applies

The controller is in Finland. The EU General Data Protection Regulation (GDPR) therefore applies to the developer’s activity, including when the user or the report profile is outside the EEA.

The user’s country of residence can add rights that cannot be waived by contract:

Finland, Sweden, Denmark, Germany, the Netherlands, Austria, Ireland, France: the GDPR and that country’s supplementing privacy statute. Norway: the corresponding protection through the EEA Agreement.
United Kingdom: the UK GDPR and the Data Protection Act 2018. The supervisory authority is the ICO.
United States: there is no single federal privacy regulation. State laws (for example California) typically apply to businesses that cross a revenue or user threshold or that sell personal information. Kilsat does not sell personal information and does not receive the trip list. If such a law still applies to an individual request, the request is handled at the support address.
Canada: PIPEDA applies to commercial handling of personal information. The trip list does not come to the developer. The developer handles only what the user sends to support.
Australia: the Privacy Act 1988. A small-business exemption may apply to a developer who does not trade in personal information and whose turnover stays under the statutory threshold. The Australian Consumer Law can still limit exclusion of liability for a paid subscription.
New Zealand: the Privacy Act 2020. The trip list does not come to the developer. If that law applies to a support request, it is handled at the support address. The supervisory authority is the Privacy Commissioner.
South Africa: the Protection of Personal Information Act (POPIA). The trip list does not come to the developer. If that law applies to a support request, it is handled at the support address. The supervisory authority is the Information Regulator.

Legal bases for the developer’s own processing: contract and the user’s request, when the user writes to support; legitimate interest, when the message is about a fault in the app or a privacy request. Trip, location, and report processing on the device serves the user’s own mileage log. The developer does not use it for the developer’s own purposes.

Google Play services and billing may process data under their own terms, including outside the EEA. The developer does not decide or control those transfers. The trip list is not sent to the developer’s server.

11.3 Complaint to an authority

The user has the right to lodge a complaint with a supervisory authority. In Finland that is the Office of the Data Protection Ombudsman. In the EEA a complaint can also be lodged with the supervisory authority of the user’s own country. In the United Kingdom the supervisory authority is the ICO. In New Zealand it is the Privacy Commissioner. In South Africa it is the Information Regulator. This right remains even if the user has accepted the terms of use.

11.4 Languages

The app languages are Finnish and English. The Finnish text is the original. This file is the same notice in English. If the versions differ, the language that matches the language selected in the app applies. A language choice cannot override mandatory privacy law in the user’s country of residence.

12. Contact

Developer: Kilsat
Email: kilsat.tuki@gmail.com

The user can also use the developer contact details on the Google Play listing.

Privacy and support requests are answered within 30 days. Do not email the trip list. Handle trip data only in the app or in your own exports.