«Hai pagato?» privacy policy

Last updated: 5 October 2026

«Hai pagato?» ("Did you pay?") is an iPhone and Android app that reminds you to pay for Milan's Area C and for the free-flow tolls of Autostrada Pedemontana Lombarda (A36, A59, A60), Autostrada Asti-Cuneo (A33) and Autovia Padana (Corda Molle) before the deadline.

In short

• Transits are detected on your phone. The location detected by the phone is not sent to us or to anyone else.
• There is no account, no server of ours and no usage analytics of ours.
• To stay free, the app shows one small Google advertising banner at the bottom of the Home screen, with non-personalised ads only. The Google code that shows it connects to Google's servers and collects some data on its own, described in the "Advertising" section. The app gives it neither your location, nor your transits, nor your car's data.
• Apart from advertising, the only internet connection the app makes is downloading a public file with the rules (hours, fares, deadlines), which is the same for everyone.
• We receive no data about you.

Who is responsible

The app is developed and published by Ivo Junior Bettini, an independent developer. Contact: haipagato.privacy@protonmail.com

«Hai pagato?» is not an official app: it does not belong to the City of Milan, ATM, Autostrada Pedemontana Lombarda, Autostrada Asti-Cuneo or Autovia Padana, and is not affiliated with any of them. Payments are made on their official websites.

What the app uses, and why

Location, also when the app is closed ("Always" on iPhone, "Allow all the time" on Android). You cross into Area C or onto the motorway while driving, with the app closed. The phone watches a few large circular areas around the toll zones; only when you enter one of them does the app receive your precise location, for as long as it takes to tell whether you actually passed through, and it stops when you leave. Near motorways without toll booths the app uses GPS while you drive, so it doesn't miss the passage: within about 10 km of one of these sections, and only when the phone says you are in a car, GPS turns on before you get there and turns off when you move away. To know when to turn it on, the phone wakes the app now and then while you move ("significant location changes" on iPhone; a wider area around the motorways and "in vehicle" recognition on Android). These locations are not saved: the app uses them to decide and forgets them. On Android it only remembers, for each section, whether you are near it right now and whether you are in a car, and forgets it when you move away. In town GPS turns on only near Area C.

Motion & Fitness (iPhone) / Physical activity (Android). Used to tell whether you are in a car: on foot or by bike nothing is owed and the app stays silent. The information is used on the spot. On iPhone, to decide whether to turn GPS on near a motorway, the app also reads the last few minutes of history that the phone keeps by itself. On Android the app only remembers the last "in a car" or "not in a car" indication (yes or no, with no time or place), until the phone sends a new one.

Notifications. Used to remind you to pay before the deadline. They are local notifications scheduled by the phone: they do not go through any server.

The app does not ask for access to contacts, photos, camera, microphone, calendar or advertising identifiers (see "Advertising").

What stays on your phone

The app stores some information in its own storage on the phone, which other apps cannot access. It is not sent to anyone, except your advertising consent choice (the last item below).

• The transit log: for each zone and day, the times of the transits, the name of the entry gate if known (for example «Porta Venezia»), whether the transit is certain or still to be confirmed, whether you added it by hand, whether and when you marked it as paid, and whether you said you did not pass. A transit is recognised by its zone and time: if the app finds it a second time (for example after the system closed it mid-trip) it does not record it again. The log contains no coordinates.
• The state of the current trip, one file per zone. It contains a few points with coordinates and time (the last point seen, the last point outside the zone, the point where the car stopped), the time of the transit if it has already been recorded, and is used to resume detection if the system closes the app during the trip.
• Settings: three switches (Telepass or similar on free-flow motorways, Area C paid automatically, car exempt from Area C) and whether you completed the introduction.
• Your car's fuel and Euro class, if you enter them (optional): they are only used to tell you whether it can enter Area B and Area C according to the City of Milan's ban calendar, and to remind you of a new ban 30 and 7 days before with a local notification. They stay on your phone with the other settings: we send them to no one, and we neither ask for nor store the number plate.
• On iPhone, for the widget: the list of payments due (zone, deadline, amount), which the widget reads to show it on the Home Screen.
• A copy of the downloaded rules.
• On Android, for the approach to motorways without toll booths: for each section, whether you are near it right now (yes or no), and the last "in a car" indication (P8). No coordinates; a section is forgotten when you move away from it.
• Your advertising consent choice, which Google's code saves in the app's storage so as not to ask you at every launch, and sends to Google with ad requests so that Google knows what you agreed to; and whatever Google's code keeps for itself to show the banner.

How long

• Transits that are already paid or whose deadline has passed are deleted once they are older than 90 days.
• A transit that is still to be paid, with its deadline not yet passed, is never deleted automatically: it is not up to the app to decide that a payment due no longer exists.
• The state of a trip is deleted when you leave the zone, or when you move away from a motorway without toll booths after GPS had turned on for the approach. If the system closes the app mid-trip, it stays until the app learns that you entered or left that zone again, and in any case no longer than 90 days after its last point.
• The 90-day clean-up happens when the app starts detection.
• Uninstalling the app deletes everything the app stored on the phone.

Internet connections

At most once a day the app downloads the public file https://ivemberg.github.io/haipagato-rules/rules.json, hosted on GitHub Pages. The request contains neither your location, nor your transits, nor any identifier of the app or the phone.

As with any internet connection, GitHub (which hosts the file) sees the IP address the request comes from. The app identifies itself only by its name, version and platform ("HaiPagato/1.0 (iOS)" or "(Android)"), without the phone model or the operating system version; on iPhone the system adds the phone's language by itself. GitHub states that it logs the IP addresses of GitHub Pages visitors for security purposes; this is governed by GitHub's privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

When you tap «Paga ora» ("Pay now") or a link to a source, the app opens the official website in your browser. From then on you are on the website of the City of Milan, ATM, Pedemontana, Asti-Cuneo or Autovia Padana, under their privacy rules. The app neither sees nor handles payments or card details.

If advertising is on, the Google code inside the app connects to Google's servers (for example googleads.g.doubleclick.net and fundingchoicesmessages.google.com): at every launch of the app, after the introduction, to find out whether your consent must be asked, even before you choose; and, if consent allows it, to download the banner. What these requests carry is described in the section below.

Advertising

To stay free, the app shows a single small banner (at most 60 points high) at the bottom of the Home screen, and nowhere else: not in the introduction, the details of a transit, the permission notices, About, the settings, the widget, the Live Activity or the notifications. No full-screen, video or rewarded ads.

Who provides the ads. Google AdMob; for people living in the European Economic Area the provider is Google Ireland Limited. Google's code (Google Mobile Ads SDK and User Messaging Platform) is inside the app, kept apart from the rest in a separate module.

Non-personalised ads only. The app asks Google only for non-personalised ads: ads chosen from the context (for example the app they appear in and an approximate location), not from a profile of you or your past activity.

What the app gives Google: nothing of its own. No location, no transits, no car data, no keywords or app content. An ad request only says that the ad must be non-personalised.

What Google collects on its own. Like any server, Google's servers see the IP address, from which an approximate location can be estimated (the city, not the street). According to what Google states for its code, it also collects: non-advertising device or installation identifiers (for example the app set ID on Android, or an identifier valid only for apps from the same developer on iPhone) and, on iPhone, the advertising identifier only if you allow it (below); interactions with ads and with the app (for example views, taps, app launch); diagnostic information (app and Google code performance, launch times, hangs, errors). It uses them to show and measure ads, for analytics and to prevent fraud and abuse. The data is encrypted in transit.

The advertising identifier. On iPhone, after Google's consent message (where required) and before starting the advertising code, iOS asks whether to allow tracking (App Tracking Transparency). If you allow it, Google can use the phone's advertising identifier (IDFA) to show and measure ads, which stay non-personalised anyway; if you don't, the IDFA is available neither to the app nor to Google, and ads stay. You can change your choice at any time in Settings → Privacy & Security → Tracking. If you do not give Google's consent, the question does not appear. The app never uses the IDFA itself. On Android the app gives up the permission to read the advertising ID and the Privacy Sandbox advertising APIs (topics of interest, attribution): instead of the advertising ID the system returns only zeros.

Consent. Where the law requires it, as in Italy and the rest of the European Economic Area, after the introduction the app shows Google's consent message. The legal basis is your consent (Article 6(1)(a) GDPR). If you do not give it, the app requests no ads and does not start Google's advertising code: only the consent check that Google's form makes at every launch remains. You can change or withdraw your consent at any time from About → Ad preferences.

Google's rules. Google processes this data under its own privacy policy: https://policies.google.com/privacy and, on how it uses data from apps that use its services, https://policies.google.com/technologies/partner-sites. For the data Google keeps, contact Google. From AdMob we only see totals (ads shown, taps, revenue), with no data about individuals.

Advertising off. We can turn advertising off for everyone from the rules file. From the first launch after the app has downloaded the new rules, it does not ask for consent, does not start Google's code, does not create the banner and does not connect to Google.

Backup

• iPhone: the app's data is part of your device backup (iCloud or computer), if you have turned it on. You control the backup through Apple's settings.
• Android: the app excludes its data from Google Drive backup. During a direct transfer from one phone to another, Android may still copy it.

Operating system services

Detection uses the phone's location services: Core Location and Core Motion on iPhone, Google Play services (Geofencing, activity recognition, location) on Android. They are components by Apple and Google, which work under their own rules and your phone's settings. The app does not send them data on its own behalf. On Android the app does not work without Google Play services.

Your rights

We receive no personal data, so we have no data to hand over, correct or delete: everything the app knows is on your phone, and you delete it by uninstalling the app. Permissions can be withdrawn at any time in the phone's settings. Advertising consent is changed or withdrawn from About → Ad preferences; for the data collected by Google, the rights and tools described in Google's privacy policy apply ("Advertising" section). For any question you can write to the address above. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Children

The app is not intended for children. We collect no data from anyone; the data Google collects for the banner is described in the "Advertising" section.

Changes

If the app changes the way it handles data, this page will be updated first, with the new date at the top.