01 Data controller
- Determinds sp. z o.o. (a Polish limited liability company)
- Address: ul. Chłodna 51, 00-867 Warsaw, Poland
- National Court Register (KRS): 0001266415 · VAT ID (NIP): PL5273236595
- Contact: kontakt@determinds.com.pl
02 Subscription and payment data
Determinds is a paid app, offered as a monthly subscription. Payment is handled solely by the Apple App Store or Google Play, who are the controllers of the payment data. We neither receive nor store payment card numbers; the store only tells us whether the subscription linked to an account is active. We do not show ads, and we never sell or share personal data for advertising or marketing purposes.
03 Adults only
Determinds may only be used by people aged 18 or over. We do not knowingly collect data from minors. If we learn that an account belongs to someone under 18, we delete it along with the associated data.
04 What data we collect
4.1. Account data
You sign in with Google or Apple. From the sign-in provider we receive your email address, name and profile picture, if you share one. We never create or store app passwords.
4.2. Profile data
You provide this yourself and can change or remove it at any time:
- name and username,
- city and region,
- role and bio,
- profile picture,
- phone number,
- goals and the list of books you have read.
4.3. Content you create
- messages in direct and group conversations, together with attachments (photos, videos, documents),
- message reactions and poll votes,
- stories (photos visible for 24 hours), including which users viewed them and their reactions,
- calendar events: title, date, place and description,
- group membership, muted conversations and pinned chats.
4.4. Technical data
- Push notification token and platform (iOS or Android), used only to deliver notifications to your device. Signing out removes that device's token.
- Crash reports (Firebase Crashlytics): error type, stack trace, device model, OS and app version, plus a technical account identifier. Reports never contain your name, email, phone number or message content.
- Usage statistics (Firebase Analytics): app opens, screens viewed and a small number of events that show whether the app works correctly. This data is aggregated.
4.5. Location data (map)
The map works only after you grant the system "Location" permission on iOS or Android. Without that consent the map collects no location data at all.
- What data: your device's location (approximate and/or precise, depending on the permission you grant), read only while you are using the app, and places you save on the map.
- Why: to show your position on the map, to show other members of the community nearby, and to mark and find places.
- Legal basis: Art. 6(1)(a) GDPR — consent, given by granting the system permission.
- Visibility to others: if you turn location sharing on, your approximate location is visible to other users on the map. You can turn that visibility off at any time in the app's settings — you then stop being visible to others while the map keeps working for you.
- Retention: until you delete your account, withdraw consent, or delete the saved places yourself.
- Withdrawing consent: at any time in your device settings (iOS: Settings → Determinds → Location; Android: Settings → Apps → Determinds → Permissions). Withdrawal disables the map and does not affect the lawfulness of processing carried out beforehand.
4.6. Physical activity data (steps)
The step counter works only after you grant consent in Apple HealthKit (the Health app on iOS) or in Health Connect (Android). Without it we read no activity data.
- What data: your daily step count, read from Apple Health (iOS) or Health Connect (Android). We do not read any other health category (heart rate, sleep, weight, medical measurements and so on).
- Why: to show your statistics and daily goals and — if you enable it — your score in the community step ranking.
- Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR — explicit consent. We treat physical activity data as health data and protect it to a higher standard.
- Visibility to others: your score is visible to other members only while the step ranking is enabled. You can disable the ranking at any time in the app's settings — your statistics then stay visible to you alone.
- Retention: until you delete your account or withdraw consent.
- Withdrawing consent: at any time in the Health app (iOS: Settings → Health → Data Access & Devices → Determinds), in Health Connect (Android: Settings → Health Connect → App permissions → Determinds; the exact path depends on your Android version) or in the app's settings. Withdrawal disables the step counter and does not affect the lawfulness of processing carried out beforehand.
- What we never do: we do not use Apple Health or Health Connect data for advertising or marketing, we do not sell it, and we do not pass it to third parties for such purposes.
4.7. What we do not collect
Beyond the data described in 4.5 and 4.6, the app collects no other location or health data — in particular we do not record route history in the background and do not read medical measurements. We use no advertising tools and no advertising-related profiling. We make no decisions producing legal effects by automated means alone.
05 Purposes and legal bases
- Providing the service — sign-in, profile, conversations, stories, calendar: Art. 6(1)(b) GDPR, performance of a contract (the Terms of Service).
- Push notifications: Art. 6(1)(a) GDPR, consent granted in your device settings and withdrawable there at any time.
- Map — showing your position and other members nearby: Art. 6(1)(a) GDPR, consent (the system "Location" permission), withdrawable in your device settings.
- Step counter and ranking: Art. 6(1)(a) and Art. 9(2)(a) GDPR, explicit consent (Apple Health / Health Connect), withdrawable in the Health app or in Health Connect.
- Safety, content moderation and handling reports: Art. 6(1)(f) GDPR, our legitimate interest in protecting users from abuse.
- Crash diagnostics and app development: Art. 6(1)(f) GDPR, our legitimate interest in keeping the service working.
- Handling complaints and defending against claims: Art. 6(1)(f) GDPR and our legal obligations.
06 Who processes the data
We do not sell data. We use the following processors, who act only on our instructions:
- Supabase — database and authentication. Data stored in the European Union (Frankfurt, Germany).
- Cloudflare R2 — storage of photos, videos and documents sent in conversations and stories.
- Google Firebase — push notifications (Cloud Messaging), crash reports (Crashlytics) and usage statistics (Analytics).
- Apple and Google — as sign-in providers, for the authentication step only.
Data may be disclosed to authorities where required by law.
Transfers outside the EEA
The database and user accounts are located in the European Union. Google and Cloudflare services may process some data outside the EEA, including in the United States, on the basis of Standard Contractual Clauses approved by the European Commission and, for participating providers, the EU–U.S. Data Privacy Framework.
07 Retention
- Account, profile and content — until you delete your account.
- Stories — 24 hours after posting, then deleted automatically together with related records.
- Files with no associated record (e.g. an interrupted upload) — deleted automatically after one day.
- Location and saved places — until you delete your account or withdraw the location permission.
- Step data — until you delete your account or withdraw consent in Apple Health or Health Connect.
- Push token — until you sign out on that device or delete your account.
- Crash reports — up to 90 days, per Firebase Crashlytics rules.
- Usage statistics — per the retention setting in Firebase Analytics.
- Data needed to defend against claims — until the relevant limitation period expires.
Messages you have sent to a conversation remain visible to its participants after your account is deleted, unless you delete them first. This follows from how a messenger works: a sender cannot unilaterally withdraw content others have already received.
08 Your rights
You have the right to access your data and obtain a copy, to rectification, to erasure, to restriction of processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting the lawfulness of prior processing. You may also lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).
To exercise any of these rights, write to kontakt@determinds.com.pl. We respond without undue delay and within one month at the latest.
09 Deleting your account
You can delete your account in the app: Profile → Delete account. This removes your account, profile, goals, stories, reactions, poll votes, push token and the files you uploaded. The operation cannot be undone.
If you no longer have access to the app, send a deletion request to kontakt@determinds.com.pl from the address the account was created with.
10 Security
Connections to the server are encrypted (TLS). Access to database records is restricted by server-side authorization rules, so a user can only retrieve rows they are entitled to. File access is checked on every download. Error reports pass through a filter that strips tokens and credentials.
No method of transmission or storage is completely secure. If a data breach is likely to result in a high risk to your rights, we will notify you in line with Art. 34 GDPR.
11 Content visible to other users
Some data is visible to others by design: your profile, picture, phone number, goals, group messages, stories and story views, and — if you enable those features yourself — your position on the map and your score in the step ranking (both can be turned off in the app's settings). Before posting a photo or message, consider that recipients may copy it. We are not liable for how other users handle your content in breach of the Terms, but we act on reports as described there.
12 Changes to this policy
We will announce material changes in the app or by email at least 7 days in advance. The current version is always available at this address, with its effective date shown at the top.
13 Contact
Determinds sp. z o.o. (a Polish limited liability company)
ul. Chłodna 51, 00-867 Warsaw, Poland
kontakt@determinds.com.pl