Privacy policy
The essentials
- Activity names, photos and settings never reach CzasNaTo infrastructure. They stay on the device and are processed only by the person using it.
- Only an adult creates an account - a teacher, therapist, parent or carer.
- We use no analytics, advertising pixels or tracking tools.
- We neither sell nor share data for marketing purposes.
- Account data (the email address) is kept in Frankfurt (Niemcy) - within the European Union. Details in section 7.
- You can delete the account yourself, in the app or on the Delete your account page.
1. Data controller
The controller of personal data of users of the site and of the "CzasNaTo" app is Dawid Kharel, a private individual running the "CzasNaTo" project.
The controller can be reached by email: [email protected].
For matters relating to personal data protection, write to: [email protected].
Email is the fastest route - we answer every message, including requests concerning personal data. If you need postal correspondence or the controller's full registration details for your organisation's records, write to the data protection address above and we will send them directly.
No data protection officer has been appointed - at the current scale and scope of processing this is not required by Article 37 GDPR.
2. What CzasNaTo is
CzasNaTo is a tool that supports education and the organisation of time. It is not a medical device and is not intended for diagnosis, therapy or treatment.
We do not ask for information about diagnoses, official assessments, degree of disability or health, and we provide no dedicated fields for collecting any. The activity name is a free text field - it is there to name an activity ("Reading", "Tidying up"), not to describe children. Whatever you type into it stays on the device.
3. Children's data - what is not here
This is the most important part of this document, so we will say it plainly: we do not transmit activity names, photos or settings to ourselves. They are not on our servers, because they never get there.
On the device - and only there - the following are stored:
- activity names given by the carer,
- photos or symbols assigned to activities,
- timer settings (number of dots, time per dot, sound),
- a history of runs - only if the carer turns it on themselves; see section 3.1.
Our server has no table where such data could land. Deleting it means uninstalling the app or removing the activity - you do not need to contact us about it, because we do not have it.
A note about system backups. Android and iOS may include app data in their own backups - on Google Drive and in iCloud respectively. This happens outside CzasNaTo, on the basis of device settings and a Google or Apple account; we have no access to those backups and no influence over them. An organisation that does not want anything from the device reaching the system maker's cloud should switch backups off in the device settings.
Children do not create accounts and give no first name, surname, address, phone number, email address or national identification number.
3.1. History of activity runs
By default the app does not record a history of activities. An adult user can turn History on themselves, on that device. Once turned on, information about runs and activity times is stored locally and is not sent to CzasNaTo.
What is recorded: the date it took place (without the time of day), the activity name as it was at that moment, the time counted, the time planned, and whether the activity reached its end. We do not record the time of day - none of the available summary ranges needs it, and recorded it would build a picture of children's daily routines.
The history serves only the carer using that device. It is not collected for evaluating the pilot programme or for any research - we have no access to it and there is no channel through which it could reach us. The carer can clear it at any time in the app settings, without deleting activities and without uninstalling.
4. What data we process
4.1. The app account
- email address,
- password - stored only as a cryptographic hash; we do not know it and cannot read it,
- the account identifier assigned by the system,
- the date the account was created and the date the address was confirmed,
- information about granted access (licence key or pilot entitlement, membership of an organisation).
4.2. Correspondence and the contact form
When you write to us about the pilot or for support: name, email address, optionally a phone number, the chosen subject and the message itself.
The form on the Contact page passes these details to our server, which composes a message from them and sends it to our address through Resend. We do not store them in any database - they exist only as a message in our mailbox and in delivery logs at the email provider.
Sending is protected by Cloudflare Turnstile. When checking whether a human filled the form in, Cloudflare receives an IP address and a one-time token generated in the browser. Turnstile does no cross-site tracking and builds no visitor profile - that is the only reason we chose it.
4.3. Technical server data
Hosting providers record standard logs: IP address, date and time of the request, page address, browser type. They serve only to keep the site working and secure. We do not link them to an account and build no profiles from them.
4.4. What we do not collect
- location data,
- advertising identifiers,
- contacts, calendar, browsing history,
- photos from the gallery - the app asks for access only when you pick an activity picture yourself, and stores it locally.
5. Purposes and legal bases
| Purpose | Legal basis | Data |
|---|---|---|
| Creating and running an account, providing the app as part of the pilot | Article 6(1)(b) GDPR - performance of a contract for services provided electronically | email, password, identifier, access data |
| Confirming the email address and password recovery | Article 6(1)(b) GDPR | |
| Replying to a message and handling an organisation's enquiry | Article 6(1)(f) GDPR - legitimate interest in communicating with someone who has contacted us | email, message content |
| Site security, preventing abuse, limiting the number of attempts | Article 6(1)(f) GDPR - legitimate interest in protecting the service | account identifier, logs, timestamps |
| Handling a request concerning personal data | Article 6(1)(c) GDPR - legal obligation | email, request content |
| Sending information about how CzasNaTo is developing, new features, product availability and offers | Article 6(1)(a) GDPR - consent, voluntary and revocable | email and a record of the consent itself: date, version of the wording and where it was given |
Public licence sales have not started, so we process no billing or payment data. When that changes, this policy will be updated before sales begin.
5.1. Consent to messages about product development
Creating an account is not in itself consent to marketing. The address given at sign-up serves to run the account - address confirmation, password reset and security matters. We send those messages regardless of consent, because without them the service does not work.
A separate, voluntary box at sign-up lets you consent to messages about how CzasNaTo is developing. Leaving it unticked does not block account creation and does not limit use of the app in any way.
We record the date consent was given, the version of the wording consented to, and where it was given - without that it would be impossible to show what exactly somebody agreed to, and when.
Consent can be withdrawn at any time, by you, in the "Email communication" section on the Your account page - with no need to contact us, no reason required and without deleting the account. Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out beforehand.
6. Data recipients
We do not sell data and do not share it for marketing purposes. We use providers acting on our instructions:
| Provider | Role | Scope |
|---|---|---|
| Supabase | Authentication, database of accounts and entitlements, sending system messages | email, password hash, identifier, access data |
| Resend | Delivering system messages (address confirmation, password reset) and messages from the contact form | recipient's email address, content of the system message |
| Cloudflare | Site hosting, content delivery network, email forwarding | server logs, IP address, email correspondence |
The account database runs in the eu-central-1 region (Frankfurt, Niemcy). Each of the providers listed processes data solely on our instructions and only to the extent needed to provide the service.
7. Transfers outside the European Economic Area
Your account database sits in Niemcy (Frankfurt), that is within the European Economic Area. That is where we keep your email address, your password hash and information about granted access.
Some data does leave the EEA, however, and we do not want to pass over it:
| Provider | Where it processes | What goes there | Basis for the transfer |
|---|---|---|---|
| Supabase | Frankfurt, Niemcy - within the EEA | account, email address, access data | no transfer outside the EEA |
| Resend | United States | the recipient's email address and the message content at the moment of sending - whether a system message or one sent through the contact form, together with the name, phone number and subject if given - and delivery logs | standard contractual clauses approved by the European Commission and the EU–US Data Privacy Framework |
| Cloudflare | nodes worldwide | IP address and request logs - technical connection data | standard contractual clauses |
In practice this means: your email address leaves the EEA every time we send you a system message - an address confirmation or a password reset link. The account database itself stays in Niemcy.
This does not apply to activity names or photos - we do not transmit them to ourselves, so there is nothing to pass on: neither to Niemcy nor anywhere else.
8. Retention periods
- The account - until it is deleted. Deletion removes the account, the email address and server-side sessions.
- Correspondence and messages from the form - in our mailbox for as long as needed to deal with the matter and for the limitation period of any claims. Delivery logs at the email provider are subject to that provider's own retention settings.
- Marketing consent - until it is withdrawn. After withdrawal we keep only the record of the event itself (date given, date withdrawn, version of the wording), because without it there would be no way to show that consent ever existed and when it was revoked.
- Server logs and technical data - for the period set by the infrastructure providers, usually counted in days. We do not extend it, do not copy this data to ourselves and do not use it for any other purpose.
- Data on the device - until the app is uninstalled. The history can also be cleared in settings at any time, without deleting activities. We have no access to this data.
After an account is deleted the licence key is detached, not erased - so after signing up again the same key still works. The key itself contains no personal data.
9. Your rights
You have the right to:
- access your data and obtain a copy of it (Article 15 GDPR),
- rectification of inaccurate data (Article 16 GDPR),
- erasure of data (Article 17 GDPR) - you can delete the account yourself, without contacting us,
- restriction of processing (Article 18 GDPR),
- data portability for data processed on the basis of a contract, in a machine-readable format (Article 20 GDPR),
- object to processing based on legitimate interest (Article 21 GDPR),
- withdraw consent at any time where processing is based on consent - withdrawal does not affect the lawfulness of processing before it.
Send requests to [email protected]. We reply without undue delay, at the latest within one month.
10. Complaint to a supervisory authority
If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. You may also lodge a complaint with the supervisory authority in your own country of residence.
11. Is providing data mandatory
Providing data is voluntary, but necessary to create an account and use the app. Without an email address it is impossible to create an account or recover a password. The app can be run in demo mode without an account.
12. Automated decisions and profiling
We take no decisions based solely on automated processing, including profiling, that would produce legal effects concerning you.
13. Security
- All communication with the site goes over HTTPS.
- Passwords are stored only as cryptographic hashes.
- Access to data in the database is restricted by row-level security - one account cannot read another account's data.
- In the mobile app the session token goes into the system key store (Keychain on iOS, Keystore on Android), not into an ordinary file.
- The number of key activation and organisation join attempts is rate limited.
Please report security vulnerabilities according to the rules described on the Reporting vulnerabilities page.
14. Cookies and browser storage
The site uses no cookies for tracking or analytics. The details - including the full list of stored values - are in the cookie policy.
15. Changes to this policy
We may change this policy when the scope of the services or the applicable law changes. Every version has a number and an effective date shown at the top of the page. We will inform account holders by email about significant changes.