Privacy Policy

This Privacy Policy defines the rules for processing and protecting personal data of users using the Co Czytam mobile application (hereinafter referred to as the "Application") and related web services.

We respect the privacy of our users and make every effort to ensure that their data is processed in accordance with applicable laws, in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as GDPR).

1. Data Controller

The controller of personal data collected through the Application is Jakub Sojka, contact e-mail: developer@insightapps.eu (hereinafter referred to as the "Controller").

2. Scope, Purpose, and Legal Bases for Data Processing

Personal data is collected to ensure the proper functioning of the Application. Depending on how you use the Application, the scope and purposes of data processing are as follows:

2.1. Registration and Login (Google Sign-In)

In order to create a cloud account and allow unique user identification, the Application retrieves the user's email address, user identifier (UID), and profile name from their Google profile.

• Legal basis: Art. 6(1)(b) GDPR (necessity for the performance of a contract for providing electronic services).
• Voluntariness: Providing this data is voluntary but necessary to use account features, cloud synchronization, and Premium options. Without providing this data, the Application can only operate locally without cloud sync features.

2.2. Local database and cloud synchronization (Room Database & Firestore)

To enable book cataloging, book metadata (titles, authors, formats, reading status, start/end dates, notes, ratings) and reading goals are first saved locally on the device in a Room database. If the user is logged in, this data is transferred to and stored in the Google Cloud Firestore database.

• Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
• Data minimization: The collected reading data is used solely to ensure service continuity and synchronization across your devices. It is not used by the Controller for analytical or marketing purposes.

2.3. Barcode Scanning (Camera)

The Application requires permission to use the device's camera solely to operate the barcode scanner (reading the ISBN from the book cover). This processing takes place entirely locally on the device using the Google ML Kit library.

• Important: No camera images, video frames, or photos are sent to the Controller's servers or third parties, nor are they permanently saved anywhere.

2.4. Advertising (Google AdMob)

The free version of the Application displays ads served by the Google AdMob network. Consequently, device advertising identifiers (e.g. Google Ad ID for Android devices) and technical data (device type, system version, language) may be processed.

• Legal basis: Art. 6(1)(a) GDPR (user consent).
• Consent management: Users in the EEA can express voluntary consent for ad personalization upon first launch. This consent can be withdrawn at any time in the device's system settings (Google Ad settings) or within the Application menu.
• No consent: If consent is not given or is withdrawn, only non-personalized (contextual) ads will be displayed. Not consenting does not block access to the Application.
• Google's role: Regarding advertising identifier processing, Google Ireland Limited acts as an independent data controller under the terms described in the Google Privacy Policy.

2.5. Technical logs, security, and abuse prevention

For diagnostic purposes, detecting crashes, and preventing abuse (e.g., violating Firestore security rules), systems associated with the Application may log basic technical information (e.g., login times, critical error logs, IP addresses, account IDs).

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller consisting in protecting the Application against abuse and defending against potential claims).

3. Data Recipients and Transfer outside the EEA (European Economic Area)

Your personal data may be shared with third parties only for purposes related to providing and maintaining the Application's technical infrastructure:

• Google Ireland Limited (based in Ireland) – provider of cloud infrastructure services (Firebase Authentication, Cloud Firestore, Firebase Hosting) and the AdMob ad network.

In connection with using Google services, your data may in some situations be transferred to third countries, in particular to the United States (USA). Google bases such transfers on Standard Contractual Clauses (SCCs) approved by the European Commission and applies additional security mechanisms to guarantee an adequate level of privacy protection.

4. Data Retention Period

User data is stored for different periods depending on its nature:

• Account and library data: Stored for the duration of the account's activity in the Application. In the event of account deletion by the user, the data is immediately and permanently deleted from production databases. For system security reasons, this data may remain in encrypted backup copies for a period of up to 30 days (backup retention period) before being completely overwritten.
• Billing data (if applicable): In the event of any financial transactions (e.g., Premium purchases in the future), associated financial data will be stored for the period required by tax and accounting laws (usually 5 years from the end of the tax year).

5. User Rights (GDPR)

Users have the right to access their data, rectify it, restrict its processing, request its transfer, withdraw consent, and lodge a complaint with the supervisory authority (President of the Personal Data Protection Office - UODO in Warsaw, Poland).

Response time: In accordance with Art. 12 GDPR, the Controller responds to all requests regarding the exercise of user rights without undue delay and at the latest within one month of receipt. In particularly complex cases, this period may be extended by two additional months, of which the user will be informed.

6. Account and Data Deletion Procedure

The Application fully complies with Google Play guidelines regarding enabling easy account deletion directly by users:

1. In-app deletion: Users can independently and immediately delete their account along with all saved books and data directly in the Application by going to Settings → Delete Account and confirming this choice.
2. By email contact: Users can send a written request to delete their account and all associated data by email to: help@insightapss.eu. It will be processed within a maximum of 48 hours.

7. Data Security

Only the Controller (app owner) has access to the Firestore cloud database. All communication is encrypted with SSL/TLS protocols, and access to the Firebase account is secured with a strong password and two-factor authentication (2FA).

8. Changes to the Privacy Policy

The Privacy Policy in its new wording takes effect upon publication on this website. For registered users, changes take effect upon notification within the Application.

9. Contact

For questions regarding data processing, please contact us by email at: developer@insightapps.eu.