A simulation of the second stage of the practical driving test
Privacy Policy
Last updated: 26 October 2026
This page says what personal data we process, why, who it is passed to, how long we keep it and what rights you have. We act in accordance with the Law of Georgia “On Personal Data Protection”.
1. Who processes the data
For any question or request about your data, contact us at the same email.
2. What we process and why
- Account: name, email, password hash or Google account identifier, registration and last login times. We use these to create and access your account and deliver the service, to perform our contract.
- Security and sessions: hashed session token, IP address, browser description, expiry and failed login attempts. We use these to maintain and protect sessions and accounts, to deliver the service and pursue our legitimate interest in security.
- Acceptance of terms: time and text version, to document the agreement governing your account.
- Progress and attempts: city, route, exam or practice mode, result, faults, their position on the game map, distance and time. These are saved to a signed-in account for its history and progress, to perform our contract.
- Access and gifts: city, recorded amount, source, date, access expiry and gift history. Needed to manage access, provide support and handle disputes, to deliver the service and pursue our legitimate interest in accurate records. A purchase record is not a bank receipt.
- Game visits: city, route, mode and time. Guests use a hash of a random browser ID; signed-in visits are linked to the account. The purpose is to understand use and improve the service, pursuing our legitimate interest with regard to user rights.
- Technical diagnostics: device, browser, graphics processor description, screen size, quality settings, FPS, frame times, stalls, technical error categories and game context. Ordinary technical summaries contain no name, email, account ID or real-world location. We use them to improve stability and performance, pursuing our legitimate interest.
- Reports and correspondence: text you provide, an optional photo, city, route, mode, position on the game map and technical browser information. An administrator sees a signed-in sender’s name and email from their current account. Used for support and fixing faults, to deliver the service and pursue our legitimate interest in a working service.
- Google Analytics: website pages, visit sources and website use events, only after separate consent. Declining does not restrict the game or your account.
Sign in with Google
Google provides your name, verified email and unique account identifier. We cannot see your Google password and do not store its access tokens. We do not automatically merge accounts with matching emails. One-time sign-in records last 10 minutes; deleting a Google-created account requires signing in with Google again.
Google describes its processing in its privacy policy.
We do not ask for or store card numbers on this site. Do not include passwords, bank details or unnecessary personal information in reports or photos. Guests do not receive personal attempt histories, but visits, diagnostics and submitted reports described below are stored.
3. Cookies and browser storage
- msim_session — essential httpOnly, SameSite=Lax session cookie; up to 30 days, or 7 days without activity.
- __Host-pd_google — essential cookie protecting Google sign-in; 10 minutes.
- pdLang — language choice: cookie up to 1 year, localStorage entry until removed.
- moedani.play, moedani.character, moedaniQuality and moedani.keys.* — game preferences in localStorage until removed.
- moedani.guest, moedani.nav and moedani.shell.* — temporary navigation in sessionStorage until the tab closes.
- pd.guest.v1 — random browser ID in localStorage until removed. It is sent to the server, which stores its hash. A different browser, device or cleared storage counts as a new guest; this is not an exact count of different people.
- pd.analytics.v1 — Google Analytics choice in localStorage for 180 days; pd.analytics.google.v1 — temporary sign-in event linking in sessionStorage.
- _ga and _ga_* — Google Analytics cookies only after consent; up to 90 days from the last visit.
- City files and models may remain on your device in the HTTP cache and the Service Worker Cache API to reduce repeat downloads. Retained until updated, site data is cleared or the browser removes them. This does not store your account password.
Optional website analytics
Google Analytics runs only after your consent. We measure page views, visit sources, price views, login and registration outcomes, guest starts and checkout attempts. Enabled automatic Google measurements may include scrolling, outbound links, site search, videos or downloads. Our manually managed events do not send names, emails, passwords, form contents or in-game actions. We do not use advertising personalization.
Change your choice using Analytics choice at the bottom of the page. Declining or withdrawing consent stops further GA4 measurements and removes its cookies. Previously sent data is not automatically erased; retention depends on Google Analytics settings.
The GA4 choice does not control game visits or technical diagnostics stored in our own database. These are processed for separate purposes and are not sent to Google Analytics. Contact our email with questions, objections or erasure requests about this processing.
4. Who it is passed to
- Vercel — website hosting and request forwarding; Render — API server; Neon — database.
- Cloudinary — advertising images and optional report photos. Photos are stored there after resizing; our database stores the address and report. Anyone who knows the HTTPS image link can view it; it is not a file protected by your account password.
- Google — to verify Google sign-in and, with separate consent, for Google Analytics.
- Authorized authorities — when provided by law. We do not sell data.
5. Transfer of data to another country
Hosting, database, image storage and Google services also process data outside Georgia. Storage and support locations depend on the service and its configuration. International transfers are subject to Georgian law; you may request information about recipients and safeguards using our contact email.
6. Retention and account deletion
- Account, sessions, progress and account attempts — while the account exists; erased with account deletion. Expired sessions are cleaned up periodically.
- Account deletion removes the direct account link on purchase records. City, amount, source, dates and access records remain for service records and possible disputes; any statutory retention obligations apply accordingly.
- Report and photo — 90 days after being marked resolved; new or under-review reports — up to 1 year from receipt. Reopening restores the deadline calculated from receipt. Periodic cleanup removes expired photos and reports; server or storage failures are retried on a later sweep.
- Ordinary technical summaries are removed periodically after 30 days. Separately enabled additional profiler diagnostics keep the latest 60 reports, replacing older ones as new reports arrive.
- Detailed game visits — 90 days. Summaries keyed by a guest browser hash remain for historical statistics; clearing browser storage does not itself erase server-side summaries.
- Account deletion does not automatically erase reports, photos, game visits or gift history. Their own retention rules apply; an old technical account ID may remain. The deleted account’s current name and email are no longer loaded for administrators. Send a separate erasure request to our contact email; we will review its scope and applicable legal exceptions.
- Correspondence is kept as needed to resolve the issue and handle possible claims. Provider log retention depends on their configuration and policies.
7. Security
- The password is stored only as a hash (argon2id) — we cannot see it either;
- The connection is encrypted (HTTPS); the session cookie is httpOnly, meaning a page script cannot read it;
- Sign-in attempts are limited and the account is locked temporarily;
- Only the service and the administrator have access to the database.
8. Your rights
By law you may request:
- Information on whether your data is processed and on what basis;
- Access to the data and a copy of it;
- Correction, updating or completion of incorrect data;
- An end to the processing, deletion or destruction of the data;
- Restriction of processing (blocking);
- Transfer of the data (portability) in a machine-readable format;
- Withdrawal of consent at any time — where the processing relies on consent.
Send your request to contact@kemsilab.com. We will answer within 10 working days; In exceptional cases the period may be extended by no more than a further 10 working days, of which we will inform you at once.
Delete your account under My page → Account → Delete account. Section 6 applies to records retained separately.
9. Automated decisions
We make no decisions about you based on automated processing and do no profiling. The simulation counts the exam result by the rules and it has no legal consequence.
10. Changes to the policy
When it changes, the new version is published on this page, with the date of the update. We will notify you of a material change on the site or by email.
11. Complaints
If you believe your data is processed in breach of the law, you may contact us or go directly to the supervisory body — the State Audit Office, to which the functions of the Personal Data Protection Service were transferred from 2 March 2026. You also have the right to go to court.
See also: Terms of Service · Payment and refunds · Contact.