Privacy Policy

1. LOCATION

Device location is processed only while you actively use the app (system permission “while using”) and is used to: show your position on the map, indicate distance and direction to statues, and enable check-in of the statue you are next to. The app does not track your location in the background and does not build a history of your routes.

When you check in a statue or a mission, the coordinates of that single event are sent to the server. We do this to verify that the check-in happened on site — this underpins fair play and the reliability of the ranking (the controller’s legitimate interest, Article 6(1)(f) GDPR). Check-in coordinates are linked to your account or to an anonymous technical identifier and are not shared with other users.

You can turn off location access at any time in your device settings — the app will continue to work in browse mode, without the ability to check in statues.

2. ACCOUNT AND DATA

Without an account: your collection is stored locally on your device. To verify check-ins, the server may assign them to an anonymous technical installation identifier that is not linked to your identity.

With an (optional) account we process: email address (code-based login) or the identifier and email provided by Apple or Google (when you sign in with those methods), nickname, avatar (if you set one), selected language, the list of checked-in statues and missions with dates and check-in coordinates, and your photos (section 3). The legal basis is performance of a contract for the provision of services (Article 6(1)(b) GDPR) and, for check-in verification and abuse prevention, the controller’s legitimate interest (Article 6(1)(f) GDPR).

In the ranking, only the following are publicly visible: nickname, avatar and score. We do not publish your email address or other data.

Data recipients (processors acting on our behalf): Supabase (database and authentication) — data stored in a data centre in the European Union (Frankfurt, Germany); Cloudflare (file infrastructure and content delivery network); Mapbox (map display — the provider receives technical data needed to fetch map tiles, including the device IP address); Apple / Google (only when you sign in with their methods); email provider (sending login codes).

Some providers are established outside the European Economic Area (USA); transfers take place on the basis of a European Commission adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.

Retention periods: account and collection data — until the account is deleted; login codes — for a short time, until used or expired; technical server logs — up to 12 months. After account deletion, data are permanently removed from the servers; you remove local copies on your device by uninstalling the app.

We do not display ads, sell data or carry out marketing. We do not make automated decisions that produce legal effects, nor do we carry out profiling.

3. PHOTOS

The camera and gallery are used only with your consent given through system permissions and only when you yourself add a photo. Photos of statues and missions that you take are PRIVATE — you alone can see them; they are not published or shared with other users.

Photos are transmitted over an encrypted connection and stored in the European Union; access is protected by short-lived, signed links available only to the account owner. An avatar, if you set one, is publicly visible next to your nickname in the ranking.

You can delete any photo manually in the app. Deleting the account also deletes all your photos from the servers.

4. YOUR RIGHTS

You have the right to: access your data and obtain a copy, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. The fastest way to exercise the most important rights is built into the app: profile editing (rectification) and account deletion in the Profile section (erasure, without contacting us).

For other matters write to kontakt@lowcakrasnali.pl — we respond without undue delay and at the latest within one month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).

The app is not directed at children under 13 with respect to account features; an account may be created by a person who is at least 16 years old, and by a younger person — with the consent of a legal guardian. If you are a guardian and believe a child has provided us with data without consent, contact us — we will delete it without delay.

5. CONTROLLER, SECURITY AND CHANGES

The controller of your personal data is Karol Kotowicz, conducting business under the name Devops Enginnering Karol Kotowicz, Tax Identification Number (NIP): 8971793705. Contact for all matters, including personal data: kontakt@lowcakrasnali.pl.

We apply security measures appropriate to the risk: encryption in transit (TLS), database-level access rules (each user can access only their own data), server-side verification of operations, and separation of public and private data.

We will inform you in the app of changes to this policy before they take effect, indicating the update date. Material changes (e.g. new processing purposes) will be communicated clearly and, where required by law, preceded by a request for consent.

6. LANGUAGE VERSION

This English text is a translation of the Polish Privacy Policy. In the event of any discrepancy between language versions, the Polish version available at https://lowcakrasnali.pl/polityka-prywatnosci/ shall prevail.