Privacy Policy (iOS)
Privacy Policy (Kilsat / mileage log — iOS)
Last updated: 27 September 2026
Version: 2.0.0
Support: kilsat.tuki@gmail.com
The Finnish text is the original. This file is the same notice in English. If the versions differ, the language that matches the language selected in the app applies. Mandatory privacy rights in the user’s country of residence still apply.
0. No connection to any tax authority
Kilsat is not an app of the Finnish Tax Administration, any other tax authority, or any public body, and it has no official, commercial, or other connection, partnership, approval, or endorsement from any tax authority or public body. The app is a tool made independently by a private developer. The name, appearance, or features do not mean an authority has reviewed, approved, or recommended the app. The user is responsible for whether the records they keep, and the way they use them in tax or bookkeeping, meet the rules that apply.
1. Controller and roles
| Role | Who |
|---|---|
| Trip and driving data | The user. The data is stored on the user’s device. The user decides deletion, editing, and export. |
| The app and privacy questions | The developer of Kilsat (a private developer). The developer does not run a cloud service and does not receive the user’s trip list on the developer’s servers. |
Kilsat is a local tool for keeping a mileage log. The developer processes only information the user sends in a support message. Apple handles payment under its own terms.
2. What data is processed
The app may store and show the following on the user’s device:
- trip start and end time
- distance in kilometres or miles, depending on the report country (GPS measurement or manual entry)
- classification (work or personal), purpose, and an optional note
- start and end coordinates (GPS trips)
- start and end address (Apple geocoding, when used)
- manually entered start and destination addresses
- favourite addresses (name, address, coordinates, optional home or workplace mark)
- favourite vehicles (name, licence plate)
- the rate locked to the trip: in Finland a rate the user chooses, and the reimbursement calculated from it. In Germany the report is an odometer log: the reimbursement amount is 0, and the template has no euro-per-kilometre rate. In the other countries the amount is calculated from the rate stored in that country’s template
- the licence plate locked to the trip when it is saved
- report fields the user types (for example driver name, default plate, default purpose)
- an odometer reading: on the German and Swedish reports the distance comes from the reading at the start and at the end. Austria requires a start and end reading on every trip, but the reimbursement is calculated from the GPS or hand-entered distance. The United States and Canada ask for the reading at the start and end of the tax year. In the other countries the reading is an optional note that does not change the reimbursement
The app also stores settings on the device (for example a default mileage rate, language, onboarding acceptance, Plus settings, the default for Siri shortcuts, the Canada region as provinces or territories, Ireland engine size, New Zealand fuel, and France fiscal horsepower and whether the car is electric). These are not sent to the developer’s server.
Not used: iCloud sync, user accounts, or a developer cloud database. iCloud is not part of Kilsat Plus.
Widget: The Lock Screen and Home Screen widget shows the local driving state. Data is shared between the app and the widget only on the device.
Kilsat Plus (optional subscription): An optional Kilsat Plus monthly subscription (App Store). Plus includes automatic trip detection, a Live Activity while driving, and a 4-minute stop reminder. The subscription is handled by Apple. The developer does not receive card details.
Kilsat Plus and privacy:
| Data | Handling |
|---|---|
| Payment and billing | Apple. The developer does not see card, bank, or Apple Account password data. |
| Entitlement | The app checks locally with StoreKit whether Plus is active. |
| Purchases | Apple processes payments. The developer does not keep a separate subscription register on the developer’s servers. |
| Restore purchases | Uses Apple’s purchase restoration. |
Subscription terms (price, trial, renewal, cancellation): see Terms of Use section 8.2.
Motion and car connection (Plus): Automatic detection may use the device’s motion detection and a CarPlay or Bluetooth audio route to support GPS. That information stays on the device. CarPlay is not required.
Start and stop refinements (Plus): The reasoning happens on the device. None of it is sent to the developer.
- Short stops (for example traffic lights) do not reset accumulated motion time when a trip is starting.
- A CarPlay or car audio route may start a trip sooner than without a connection.
- When the car connection drops and the car has already been stationary (for example parking), the trip can be saved in about 12 seconds. If the stop is not yet confirmed, saving takes about 45 seconds, or about 90 seconds if the motion sensor has not confirmed that the device is stationary. In traffic the connection does not usually drop, so the 5-minute safety time remains.
- Cancel on public transport: If detection starts a trip by mistake, the user can cancel it and choose a pause of 1, 2, or 5 hours. A cancel from the notification uses a 1 hour pause. The pause can end sooner if the user leaves the vehicle and stops briefly. The choice is not stored in trip history and is not sent to the developer.
Automatic work / personal classification (Plus): If the user has marked home and/or workplaces among favourite addresses, the app may classify a trip by comparing the start point with those addresses. If there is no match, the user’s default is used. The reasoning is done only on the device.
Notifications: A Live Activity can be shown while driving. The weekly summary is optional and off by default. It is calculated on the device from the user’s own trips. It is not marketing. Notifications are not sent from the developer’s server.
3. Use of location
The app uses the device location to measure trips. Location is not used for advertising, profiling, sale, or marketing tracking.
Permissions
- While in use: starting a trip and live measurement.
- Always (optional): only if the user grants background location, measurement and automatic detection can continue while the app is in the background. iOS shows the location-in-use indicator.
- Motion (optional, Plus): a supplementary signal for automatic trips.
- Notifications: Live Activity and the stop reminder.
Accuracy and errors
GPS can weaken in tunnels, indoors, or in flight mode. Without a valid GPS fix, the user can enter the trip manually.
Automatic trips (Kilsat Plus)
An automatic trip is an optional Plus feature. The free manual trip still works with foreground location permission.
An automatic trip does not keep continuous GPS on when you are not driving. Sparse monitoring of significant location changes can wake the app. A short GPS window starts from a location wake, motion detection, or a CarPlay or Bluetooth audio route. If driving is not confirmed, the dense window closes.
App Switcher: If the user closes Kilsat completely from the App Switcher, a significant location change can still briefly start the app in the background. Motion detection and the CarPlay or Bluetooth signal are not active until the user opens the app. The most reliable detection requires that Kilsat is not closed from the App Switcher during a drive or just before one.
Automatic detection does not guarantee correct detection (for example public transport). The user can cancel a wrong trip; see section 2.
4. Storage, transfers, and third parties
Local storage
All trip, favourite, and settings data is stored locally on the user’s device in the phone’s own database. The developer does not receive it automatically.
No developer servers
Trip and report data is not sent to the developer’s own servers and is not shared by the developer with third parties.
Sharing by the user
CSV and PDF reports are built on the device. The user can share the files through the share sheet. The user is responsible for that.
Third-party services
| Service | Purpose |
|---|---|
| Apple location services | Measuring a GPS trip |
| Apple motion detection | Supplementary signal (Plus, if available) |
| App Store / StoreKit | Optional Kilsat Plus subscription; voluntary Buy a coffee one-time purchase (not a donation / not charity) |
| Apple geocoding | Forming addresses (when used) |
| Share sheet | Sharing CSV/PDF files with apps the user chooses |
Those services’ privacy practices are set by their own terms. Apple may process location and payment outside the EEA under its own terms. The developer does not control those transfers. The trip list is not sent to the developer’s server.
5. Tracking and analytics
The app does not use ad tracking and does not sell user data. The app contains no third-party analytics or advertising software.
6. Purpose of use
Data is used only in the user’s own mileage log:
- recording and editing trips
- calculating mileage reimbursement
- CSV and PDF export for the user’s own bookkeeping
- monthly statistics (work and personal trips, per-vehicle summaries)
- storing and reporting the trip’s licence plate
- showing driving state in the widget and in a Live Activity
- an optional weekly summary notification (calculated on the device from the user’s trips)
- classifying an automatic trip as work or personal from home and workplace favourites (Kilsat Plus)
- start and stop decisions for an automatic trip, and the detection pause after the user cancels (see section 2)
7. Retention and deletion
Data stays on the device until the user:
- deletes individual trips
- deletes all trip data in settings
- uninstalls the app
The user is responsible for backing up their own data. The developer cannot remotely restore data that has left the user’s device.
8. The user’s rights and what they can do
Because trip data is on the user’s device, the user can in practice:
- view the data in the app
- correct the data
- delete the data (one trip or all trips in settings)
- export the data to their own archive (CSV/PDF) before deletion
Under the EU General Data Protection Regulation (GDPR) the user may ask the developer for an explanation of processing by contacting the developer.
The developer cannot remotely delete trips that are on the user’s device.
9. Security
The app is designed to work primarily without a network. Security rests on the device (the lock, iOS file protection). The user should keep the device updated and use the device lock.
The developer is not liable for loss of data if the user’s device is lost, stolen, broken, or reset.
9.1 Developer’s privacy disclaimer
Because trip and location data is processed on the user’s device and not on the developer’s servers, the developer:
- cannot remotely view, correct, or restore trip data
- is not liable for loss of data from a lost, stolen, broken, or reset device, or from the user’s own deletion
- is not liable for how the user shares CSV/PDF reports with third parties
- is not liable for the accuracy of data the user enters, or for whether a tax authority, an employer, or an accountant accepts that data
- is not a representative, partner, or subcontractor of the Finnish Tax Administration or any other authority — see section 0
Mandatory GDPR rights remain. The user may ask for an explanation of processing at the support address.
10. Children
The app is intended for adults (18+). The App Store age rating may follow the platform’s own rating.
11. Changes to this notice
This notice may be updated (for example when features are added). The current version is opened from the app’s Settings.
11.1 A report profile is not a choice of privacy law
The app can use a calculation template for different countries. A report profile is only a calculation and print template on the user’s device. It does not transfer trip data to that country, it does not make that country’s tax authority a controller, and it does not change where the data is stored.
If the phone’s region is Finland, the report uses the Finnish template. The country list is not shown at the start, in settings, or in the report. Changing the app language to Finnish or English does not open that list. When the phone’s region is another country, the user chooses the report country at the start.
Profiles exist for Finland, Sweden, Norway, Denmark, Germany, the Netherlands, Austria, Ireland, France, the United Kingdom, the United States, Canada, Australia, New Zealand, and South Africa. Kilsat is not an app, partner, or approved product of any of those countries’ tax authorities, mileage-log rules, or public bodies. A mileage rate stored in a profile is a figure and a date in the profile. It is not an authority’s decision on the user’s tax. The German template has no per-kilometre rate: the reimbursement amount is 0.
11.2 Which privacy law applies
The controller is in Finland. The EU General Data Protection Regulation (GDPR) therefore applies to the developer’s activity, including when the user or the report profile is outside the EEA.
The user’s country of residence can add rights that cannot be waived by contract:
- Finland, Sweden, Denmark, Germany, the Netherlands, Austria, Ireland, France: the GDPR and that country’s supplementing privacy statute. Norway: the corresponding protection through the EEA Agreement.
- United Kingdom: the UK GDPR and the Data Protection Act 2018. The supervisory authority is the ICO.
- United States: there is no single federal privacy regulation. State laws (for example California) typically apply to businesses that cross a revenue or user threshold or that sell personal information. Kilsat does not sell personal information and does not receive the trip list. If such a law still applies to an individual request, the request is handled at the support address.
- Canada: PIPEDA applies to commercial handling of personal information. The trip list does not come to the developer. The developer handles only what the user sends to support.
- Australia: the Privacy Act 1988. A small-business exemption may apply to a developer who does not trade in personal information and whose turnover stays under the statutory threshold. The Australian Consumer Law can still limit exclusion of liability for a paid subscription.
Legal bases for the developer’s own processing: contract and the user’s request, when the user writes to support; legitimate interest, when the message is about a fault in the app or a privacy request. Trip, location, and report processing on the device serves the user’s own mileage log. The developer does not use it for the developer’s own purposes.
11.3 Complaint to an authority
The user has the right to lodge a complaint with a supervisory authority. In Finland that is the Office of the Data Protection Ombudsman. In the EEA a complaint can also be lodged with the supervisory authority of the user’s own country. In the United Kingdom the supervisory authority is the ICO. This right remains even if the user has accepted the terms of use.
11.4 Languages
The app languages are Finnish and English. The Finnish text is the original. This file is the same notice in English. If the versions differ, the language that matches the language selected in the app applies. A language choice cannot override mandatory privacy law in the user’s country of residence.
12. Contact
Developer: Kilsat
Email: kilsat.tuki@gmail.com
The user can also use the developer contact details on the App Store listing.
Privacy and support requests are answered within 30 days. Do not email the trip list. Handle trip data only in the app or in your own exports.