Security and data at Drivings
This page explains how Drivings handles your account, your payments and your personal data. It is written to be checked, not skimmed: every claim here describes how the product actually works today, and where a claim needs more detail, we link to the document that carries it.
How accounts work
Authentication and our database are provided by Supabase. You can start practising without creating an account at all: when you open the study panel, we create an anonymous learner session on your device, so your progress and streaks are tracked before you ever hand over an email address. If you later sign up, that history comes with you.
Access to data is enforced at the database layer with row-level security policies. In practice that means the rules deciding who can read which rows live in the database itself, not just in application code: a signed-in learner's session can only read that learner's own records. Staff access to internal tools runs on a separate role-based permission system, and the internal staff schemas are protected by database-level grants and row-level security. A customer session cannot read staff data.
Payments
Payments on the website are processed by Stripe. Purchases made inside the iOS and Android apps go through Apple's App Store and Google Play billing. In every case, your card details go to the payment provider directly: they never pass through or get stored on Drivings' systems. We never see your card number, and we could not store it if we wanted to.
The keys our servers use to talk to Stripe are never written into the application code or committed to our codebase. They are held in encrypted secret stores and a managed vault, kept separate from the code.
Where your data lives and how it travels
The site and apps are served exclusively over HTTPS, so everything between your device and our servers is encrypted in transit with TLS. The website is hosted on Vercel, and your data is stored in our Supabase-managed database.
Our native iOS and Android apps talk to the same backend over the same encrypted connections: there is no separate, weaker path for mobile.
Your data rights
You can delete your account yourself, from inside the app, without emailing anyone. What happens next depends on whether you have ever paid us. If you have never made a payment, your records are deleted outright. If you have paid, we cancel any subscription, close the account and anonymise your personal details; the financial records, and some de-identified usage records, are retained because tax and accounting rules require the former, but none of it is linked to you as an identifiable person any more.
You also have the rights you would expect over your personal data. To ask what we hold, to have it corrected, and to have it deleted. To exercise any of them, or to ask a question the privacy policy does not answer, contact us via /contact. The full policy, including what we collect and why, is at /privacy.
What we do not claim
Trust pages in this industry tend to accumulate badges. Ours will not, unless they are real. As of August 2026, Drivings holds no compliance certifications, no SOC 2 report, no ISO certification, no completed third-party audit. We are not going to imply otherwise with vague wording. If that changes, this page will say so plainly, with dates.
What we can honestly offer instead is the architecture described above: authentication and row-level security enforced in the database, card details that never touch our servers, encrypted transport everywhere, secrets kept out of code, and a deletion flow that deletes or anonymises, exactly as described above.
If you believe you have found a security problem in Drivings, please tell us via /contact.