Effective date: 28 August 2026
Last updated: 28 August 2026
Dromora is an electric-vehicle route planner for iPhone. It works out where to charge on a long drive and how long each stop takes. It is not a navigation app — turn-by-turn guidance is handed to the Tesla app.
This policy explains exactly what data the app and its server handle, why, and what you can do about it. It describes the app as it is actually built. Where a behaviour is not obvious from using the app, we say so plainly rather than hiding it behind a general clause.
BIS, CVR no. 45318672, Horsens, Denmark ("we", "us") is the data controller for the processing described here.
Contact for any privacy question, request, or complaint: [email protected].
If you are in the EU/EEA or the UK, you also have the right to complain to your local data protection authority. Our lead supervisory authority is Datatilsynet (Carl Jacobsens Vej 35, 2500 Valby, Denmark — datatilsynet.dk); you can complain to them or to the authority in your own country. Datatilsynet's online complaint form requires a Danish MitID login; if you live elsewhere, use the contact channels listed on datatilsynet.dk instead.
We have assessed that a Data Protection Officer is not required under Art. 37 GDPR at the current scale of our processing; all privacy enquiries go to [email protected].
The rest of this policy is the detail behind those five points.
| Data | Where it comes from | Why |
|---|---|---|
| Apple user identifier | Sign in with Apple | Identifies your account. It is specific to Dromora and cannot be used to identify you in other apps. |
| Email address (optional) | Sign in with Apple | Only if you choose to share it. It may be an Apple private-relay address, in which case we never see your real one. We use it to contact you about your account. |
| Sign-in tokens | Created when you sign in | Keeps you signed in. Stored encrypted. |
| Account creation date | Created when you sign in | Account administration. |
Legal basis (GDPR): performance of our contract with you — you cannot have an account without it.
Connecting a Tesla is optional. Without it, you enter your battery percentage by hand and everything else still works.
If you connect one, we store the Tesla access and refresh tokens encrypted on our server, together with the vehicle identifier Tesla gives us and the Tesla region endpoint for your account. We use them to read, from Tesla's Fleet API:
We do not request or store your vehicle's location from Tesla.
The Tesla permissions we request are vehicle_device_data (read the data above) and vehicle_cmds (send a destination to the car) — you will see both named on Tesla's own consent screen. vehicle_cmds sounds broader than it is: sending a destination is the only command we use.
When you send a plan to your car, the destination is passed to Tesla so the car can navigate to it. Tesla's own privacy policy governs what Tesla then does with it — we are not affiliated with Tesla, Inc.
You can disconnect the car at any time in the app; the stored tokens are deleted.
Legal basis: performance of the contract (the live-battery feature you asked for).
When you plan a trip, the app sends your start point, destination, any stops, and your vehicle state to our server so it can compute the plan. The server also looks up chargers along the corridor.
We do not keep your routes. There is no table of your trips on our server. Computed plans are returned to your phone and live there.
Your trips, your saved places, and your garage are stored on your device and, if you have iCloud enabled, synced through your own iCloud private database. We cannot read your iCloud data.
Legal basis: performance of the contract.
This is the part people are usually surprised by, so we are being explicit.
While you drive with the app, it records how each stretch of driving actually went and uploads it to our server, linked to your account. There is no switch to turn this off, because it is the mechanism that makes your predictions accurate. Each record contains:
Your car's brand and model are sent along with the upload — they are used to derive the fleet model key described in §3.5 and are not stored in your drive-history record itself.
The drive record itself contains no coordinates and no route. We cannot reconstruct where you went from it.
What we do with it: compare predicted against actual energy use for your car, and correct your future predictions. Nothing else.
Apple privacy label: because these records are stored against your account, they are declared as data linked to you, not as anonymous data.
You can download every one of these records from inside the app (Me → your account → export), and deleting your account destroys all of them.
Legal basis: performance of the contract. Accurate arrival predictions are the product; this is how they are produced. Providing this data is therefore a condition of using Dromora — the predictions cannot be produced without it, and there is no version of the app that works without it.
In Me → Privacy & Data there is one switch: Contribute anonymized data. It is off unless you turn it on. It is the only sharing in the app that is optional, and it is the only one you can withdraw.
When it is on, the same drives are additionally written to a separate, identifier-stripped store that improves predictions for everyone driving the same model. Those records are stripped at the moment they arrive:
tesla.model3.lr).Aggregated figures are only published back into the planner once a group contains at least five separate contributors, so no single drive of yours can visibly move what another driver sees. Where fewer than five people drive your exact model, statistics may instead be published at the brand level — under the same five-person floor.
The same switch also covers, in app versions that offer them:
Both are tied to the charger and the network, not to you and not to your route. They carry the same treatment as everything else in this section: contributed only with the switch on, and never linked to your account.
One transmission detail, for completeness: a charging-stop outcome is reported with the charger's location, so we can tell which country's pricing applies. It is converted to a country code the moment it arrives, and the coordinates are not stored.
Legal basis: your consent. You can withdraw it at any time by turning the switch off, and the contribution stops; withdrawal does not affect the lawfulness of the processing that happened while the switch was on. It does not affect anything else in the app.
One honest caveat about withdrawal: turning the switch off stops all future contribution, but it does not retract past contributions. Those remain in the store in identifier-stripped form and continue to appear only inside aggregated statistics — never individually.
What account deletion does here: deleting your account also deletes the record that you were among a group's contributors. That can take a group back below the five-contributor floor, and its statistics then stop being published until five separate contributors exist again. Numbers already merged into an aggregate cannot be subtracted back out — but they never appear anywhere except inside such group statistics, and only while the group clears the floor.
The app sends crash and error reports to Sentry, hosted in the European Union, so we can find and fix defects. A report contains the error itself, a stack trace, your device model, iOS version, app version, and recent in-app events. We do not enable Sentry's personally-identifiable-data collection. Sentry's SDK also assigns an identifier to your installation of the app, used solely to group crash reports from the same install; it is not tied to your account. As with any network request, Sentry's servers see the IP address the report arrives from.
Our server reports its own errors to Sentry too, so a backend defect is found the same way an app crash is. Those reports describe the error and the request that triggered it — not your route.
Legal basis: our legitimate interest in a stable, secure app.
Like any online service, our server keeps technical request logs so we can operate and debug it: a request identifier, the endpoint called, the result status, how long it took, the app version, and your account identifier for authenticated requests. We deliberately do not log your IP address — the server has no store of IP addresses at all.
When you plan a route, the log line also records your origin and destination coarsened to roughly 11 km before they are written — precise enough to tell which corridor had a problem, and deliberately too coarse to identify an address. Logs live in a small rolling buffer on our own server that overwrites the oldest entries automatically; they are not exported or archived.
Legal basis: our legitimate interest in operating, securing, and debugging the service.
You can revoke either permission in iOS Settings at any time.
| Who | What they handle | Where |
|---|---|---|
| Apple | Sign in with Apple, App Store, iCloud sync of your own data, TestFlight | Apple's terms apply |
| Tesla | Vehicle data you authorise, and destinations you send to the car | Tesla's terms apply; we are not affiliated with Tesla |
| Sentry | Crash and error reports, from the app and from our server | EU data region |
| Cloudflare | Protects and routes traffic to our API and website; sees request metadata including your IP address in transit | Global network |
There is no third-party hosting provider: the API and database run on server infrastructure we operate ourselves, located in the EU/EEA. No one else has access to the production database.
The dromora.com website sets no cookies, runs no analytics, and loads nothing from third parties. Cloudflare carries the request in transit (and, like any network carrier, sees your IP address while doing so); our own server keeps no access logs for the website at all.
We will update this table before adding any new processor, not after.
We use OpenStreetMap data (© OpenStreetMap contributors, ODbL) for routing and Open Charge Map data (CC BY 4.0) for charger information. These are data sources — we send them no personal data about you.
Our server and database are located in the EU/EEA. Some of the providers above operate globally. For Apple, Sentry, and Cloudflare, we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which each of them is certified, with the Commission's standard contractual clauses in their agreements as the fallback safeguard. Tesla is not our processor — you authorise it directly, and Tesla's own privacy policy governs its transfers. Write to [email protected] for a copy of the safeguards we rely on.
| Data | Retention |
|---|---|
| Account, sign-in tokens | Until you delete your account |
| Tesla tokens | Until you disconnect the car or delete your account |
| Drive-history records | Until you delete your account |
| Fleet contributions (identifier-stripped) | Kept indefinitely in identifier-stripped form; published only as aggregates (see §3.5) |
| Crash reports | Per Sentry's retention, currently 90 days |
| Server logs (§3.7) | Small rolling buffer; oldest entries overwritten automatically |
| Database backups | Up to 14 days, then overwritten |
About backups. We take a daily backup of the database so a failure cannot lose your data. Deleting your account removes your data from the live database immediately; a copy can persist in those backups until they rotate out, at most 14 days. We do not use backups for anything except restoring the service after a failure, and we do not re-import deleted accounts from them.
Inside the app, without contacting anyone:
You also have the right to data portability — the export above is how we deliver it, and you can ask us for the same machine-readable copy by email — and the rights to rectification, to restriction, and to object to processing based on our legitimate interests. Write to [email protected] and we will answer within one month, or longer where the law allows for complex requests, in which case we will tell you.
Deleting the app alone does not delete your account — use Delete account first, or email us.
Dromora is not directed at children. Our Terms of Use require users to be at least 16 — that is our own minimum, set above the Danish statutory consent age of 13 for information-society services. We do not knowingly collect data from anyone under 16, and we do not verify age. If you believe a child has an account, contact us and we will delete it.
Sign-in and vehicle tokens are stored encrypted. All traffic between the app and our API is over TLS. Your VIN is hashed on your device before any upload. Access to the production database is limited to the operator of the service.
No system is perfectly secure. If a breach affects your personal data and poses a risk to you, we will notify you and the relevant supervisory authority as required by law.
If we change how we handle your data, we will update this page and change the effective date. For a change that materially reduces your privacy, we will tell you in the app before it takes effect.
Version history: 28 August 2026 — first published version. Prior versions will be listed here as this page changes, so you can see what changed and when.
BIS, CVR no. 45318672, Horsens, Denmark