English
Paralazy

Privacy policy

Privacy policy of the Paralazy app and the paralazy.com website

Effective from: 1 October 2026

§ 1. General provisions

  1. The Policy describes the rules for processing personal data in connection with the use of the Paralazy mobile application for devices running iOS (hereinafter: the “App”) and of the website at paralazy.com (hereinafter: the “Website”). The Policy applies to Users in all countries in which the App is available.
  2. The controller of the personal data is Bartłomiej Wojdan (hereinafter: the “Controller”).
  3. In all matters concerning personal data, the Controller can be contacted at support@paralazy.com.
  4. The Controller has not designated a data protection officer.
  5. The Controller is established in Poland and processes data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: the “GDPR”), the Act of 10 May 2018 on the Protection of Personal Data (ustawa o ochronie danych osobowych) and the Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej). The Controller applies the principles arising from the GDPR and the rights described in § 9 to all Users, regardless of the country in which they are located. Additional information required by the laws of certain countries is set out in § 14.
  6. “User” means a person who uses the App or visits the Website.

§ 2. Data that remains on the User’s device

  1. Use of the App does not require creating an account, registering or logging in. The App works without an internet connection.
  2. Everything the User enters in the App and does in it, in particular the names of routines and rooms, notes, reminder times, periods of absence, the history of completed tasks and the settings, is stored solely in the memory of the User’s device. The Controller does not receive this data, has no access to it and does not process it.
  3. This data is deleted when the App is uninstalled or when the “Reset all data” command is selected in it.
  4. If the User uses a backup of the device, for example in the iCloud service, the App’s data may become part of that backup on the terms set by Apple. The Controller has no access to such a backup.
  5. The App makes it possible to prepare the configuration of a home with the help of an external AI chat service chosen by the User. In that case the App creates the text of the instructions, which the User copies into that service themselves, and the User then pastes the reply received into the App themselves. The App does not send any data to such a service. Data that the User provides in it is processed by its provider as a separate controller, under the provider’s own privacy policy.
  6. Reminders are local notifications scheduled on the User’s device. Handling them does not require sending data to the Controller or to third parties.
  7. The App does not use the device’s location, contacts, photos, camera or microphone. It reads the contents of the clipboard only when the User selects the paste command.

§ 3. Data sent from the App with the User’s consent

  1. On first launch, the App asks whether it may send data on how it is used and crash reports. Until consent is given, the App sends nothing. The answer “Not now” does not restrict any function of the App. This rule is the same in all countries.
  2. Once consent has been given, the App sends:
    1. data on the use of the App: which screens are opened and which buttons and options are selected, as well as information on the first launch, sessions and time of use. This data takes the form of technical names, types, numbers (for example the number of minutes or rooms) and random identifiers of routines, which do not contain their names;
    2. crash and error reports: the place in the code where the error occurred, the types of operations performed immediately before it, the name of the current screen, the version of the data format, the number of entries in the App’s log, the number of scheduled reminders and the time zone of the device;
    3. technical data: the device model, the operating system version, the App version, the language and the approximate location at the level of country and region, determined by the service provider on the basis of the IP address. The IP address is used to transmit the data and is not retained in the analytics data;
    4. installation identifiers: a random App instance identifier assigned by the Firebase service, an installation identifier used in crash reports and the identifier for vendor assigned by the iOS system to apps of the same publisher (IDFV).
  3. The App never sends content entered by the User: neither the names of routines and rooms nor notes. It does not collect a full name, an email address or a telephone number.
  4. The App does not use the advertising identifier (IDFA), does not display advertisements and does not track the User across apps and websites of other entities.
  5. The data listed in paragraph 2 does not allow the Controller to establish the User’s identity. Because of the identifiers it contains, the Controller treats it as personal data.

§ 4. Purposes and legal bases of processing

Data is processed solely for the purposes indicated below. Where the law requires the basis for processing to be indicated, it is the basis given in the last column.

PurposeDataLegal basis
Analysis of how the App is used, in order to develop and improve it§ 3(2)(1), (3) and (4)the User’s consent: Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law
Detecting and fixing crashes and errors in the App§ 3(2)(2), (3) and (4)the User’s consent: Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law
Replying to a message and handling the matter reportedemail address, full name (if provided), content of the correspondencethe Controller’s legitimate interest, consisting in conducting correspondence with Users: Article 6(1)(f) GDPR
Handling requests concerning personal datadata provided in the requesta legal obligation to which the Controller is subject: Article 6(1)(c) GDPR in conjunction with Article 12 and Articles 15–22 GDPR
Establishment, exercise or defense of legal claimsdata necessary in the given casethe Controller’s legitimate interest: Article 6(1)(f) GDPR
Ensuring the operation and security of the WebsiteIP address, browser type, date and time of the request, address of the page requestedthe Controller’s legitimate interest: Article 6(1)(f) GDPR

§ 5. Voluntary nature and withdrawal of consent

  1. Giving consent is voluntary. Its absence or withdrawal does not affect the operation of the App.
  2. Consent may be withdrawn at any time using the “Data sharing” switch at the end of the “Routines” screen. From that moment, the App sends nothing. Consent may be given again in the same way.
  3. The withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
  4. Providing data in correspondence with the Controller is voluntary, but necessary for a reply to be given.

§ 6. Recipients of data

  1. The Controller uses the services of entities that process data on the Controller’s behalf, on the basis of data processing agreements:
    1. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), the provider of the Firebase services: Google Analytics for Firebase (data on the use of the App) and Firebase Crashlytics (crash and error reports);
    2. Cloudflare, Inc.: hosting of the Website and email forwarding;
    3. Google Ireland Limited: the Controller’s mailbox in the Gmail service.
  2. The App is made available by the App Store, operated by Apple. Apple processes data related to the downloading and updating of the App as a separate controller, under its own privacy policy. If the User has agreed to this in the device settings, Apple makes available to the Controller aggregated statistics and crash reports that do not allow the User to be identified.
  3. The Controller does not sell data and does not disclose it for advertising purposes. Data may be disclosed to public authorities only where a provision of law so requires.

§ 7. Transfers of data to other countries

  1. The Controller is established in Poland. The providers listed in § 6(1) process data on servers in various countries, in particular in countries of the European Economic Area and in the United States. The User’s data may therefore be processed outside the country in which the User is located, including in countries whose law ensures a level of data protection different from that of the law of the User’s country.
  2. To the extent that the GDPR applies to the transfer, its basis is Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU–US Data Privacy Framework, as regards the entities participating in that framework, and otherwise the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914.
  3. Information on the safeguards applied and a copy of the standard contractual clauses may be obtained by writing to the address given in § 1(3).

§ 8. Data retention period

  1. Data on the use of the App that is assigned to an installation identifier is stored for no longer than 14 months. Aggregated statistics that contain no identifiers may be stored for longer.
  2. Crash and error reports are stored for 90 days.
  3. Correspondence is stored for the time needed to deal with the matter, and thereafter for no longer than 12 months, unless longer storage is necessary for the establishment, exercise or defense of legal claims.
  4. Records of requests concerning personal data are stored for 12 months from the time the requests are dealt with.
  5. The server logs of the Website are stored for the period applied by the hosting provider.

§ 9. Rights of the User

  1. Every User, regardless of the country in which they are located, has the following rights:
    1. the right of access to their data and the right to receive a copy of it,
    2. the right to rectification of data,
    3. the right to erasure of data,
    4. the right to restriction of processing,
    5. the right to data portability with respect to data processed on the basis of consent,
    6. the right to object to processing based on the Controller’s legitimate interest,
    7. the right to withdraw consent at any time, in the manner described in § 5.
  2. A request may be sent to the address given in § 1(3). The Controller replies without undue delay, and no later than one month after receipt of the request.
  3. Data sent from the App is not linked to a full name, an email address or an account, and the Controller is therefore unable to determine which of that data concerns the person making the request. In accordance with Article 11 GDPR, the rights referred to in paragraph 1(1)–(5) apply with respect to that data where the User provides additional information enabling the User to be identified. Irrespective of this, the User may at any time stop the sending of data using the switch described in § 5, and data sent earlier will be deleted once the periods indicated in § 8 have expired.
  4. The User has the right to lodge a complaint with the data protection authority competent for the place where the User is located. In Poland, that authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa). The authorities in selected other countries are indicated in § 14.
  5. Exercising the rights described in this section is free of charge and entails no adverse consequences. The App works in the same way regardless of whether the User exercises them.

§ 10. Automated decision-making and profiling

  1. The Controller does not take, with regard to Users, decisions based solely on automated processing, including profiling, as referred to in Article 22 GDPR.
  2. The App selects the tasks it suggests and their dates on the basis of data stored on the User’s device. This takes place solely on that device, without the involvement of the Controller.

§ 11. Children

  1. The App and the Website are not directed to children.
  2. A person who has not reached the age from which the law of their country allows consent to the processing of data to be given independently (from 13 to 16 years, depending on the country; 16 years in Poland) may give the consent described in § 3 only with the consent or authorization of a parent or legal guardian. Otherwise, that person should select the answer “Not now”.
  3. The Controller does not knowingly collect children’s data. The App does not ask for the User’s age.

§ 12. The paralazy.com Website

  1. The Website does not use cookies or similar technologies, contains no analytics or advertising tools and does not load any resources from the servers of other entities.
  2. The server that makes the Website available records in its technical logs the data indicated in the last row of the table in § 4. That data serves solely to ensure the operation and security of the Website.
  3. The Website contains a link to the App Store. On selecting it, the User is taken to an Apple website, to which Apple’s privacy policy applies.

§ 13. Data security

  1. Data sent from the App and from the Website is encrypted in transit.
  2. Only the Controller has access to the data collected in the services listed in § 6(1); access is secured by two-factor authentication.
  3. The App has been designed to send as little data as possible: no content entered by the User leaves the device.

§ 14. Additional information for selected countries and regions

  1. The provisions of this section supplement the Policy with regard to Users located in the countries indicated, to the extent that the laws of those countries apply to the Controller. They do not limit the rights described in § 9.
  2. United Kingdom and Switzerland. With regard to Users from the United Kingdom, the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 apply, and with regard to Users from Switzerland, the Federal Act on Data Protection (FADP) applies; references to the GDPR are to be read accordingly. The transfer of data to the United States is based on the UK Extension to the EU–US Data Privacy Framework and on the Swiss–US Data Privacy Framework, and otherwise on contractual clauses approved in those countries. The supervisory authorities are the Information Commissioner’s Office (ICO) and the Federal Data Protection and Information Commissioner (FDPIC).
  3. United States. Within the meaning of state privacy laws, including the California Consumer Privacy Act (CCPA):
    1. the Controller collects the following categories of personal information: identifiers (§ 3(2)(4)), information on activity in the App (§ 3(2)(1) and (2)), approximate location (§ 3(2)(3)) and information provided in correspondence. The source of the personal information is the User’s device or the User, the purposes are described in § 4, and the recipients, acting as service providers, in § 6;
    2. the Controller does not sell personal information and does not share it for behavioral advertising, and has not done so in the preceding 12 months either. The Controller does not process sensitive personal information;
    3. the User has the right to know what personal information is collected, to access it, to have it corrected and deleted, and the right not to be discriminated against for exercising those rights. A request may be submitted by the User personally or through an authorized agent, to the address given in § 1(3);
    4. the App and the Website do not track Users across websites and apps, and therefore do not change the way they operate in response to “Do Not Track” or “Global Privacy Control” signals;
    5. the App is not directed to children under 13, and the Controller does not knowingly collect their personal information.
  4. Brazil. With regard to Users from Brazil, Law No. 13.709/2018 (Lei Geral de Proteção de Dados, LGPD) applies. The basis for the processing of data sent from the App is consent (Article 7(I) LGPD). The User has the rights set out in Article 18 LGPD, including the right to information on the entities with which data is shared, and the right to lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). The function of contact person for data matters (encarregado) is performed by the Controller, at the address given in § 1(3).
  5. Turkey. With regard to Users from Turkey, Law No. 6698 on the Protection of Personal Data (KVKK) applies. The User has the rights set out in Article 11 of that law and the right to lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
  6. Japan. With regard to Users from Japan, the Act on the Protection of Personal Information (APPI) applies. The purposes of use of the data are set out in § 4. Data is entrusted to the providers indicated in § 6, established in Ireland and in the United States; the Controller provides, on request, information on the data protection system in those countries and on the safeguards applied. The User has the right to request the disclosure, correction, cessation of use and deletion of data, as well as the right to contact the Personal Information Protection Commission (PPC).
  7. Republic of Korea. With regard to Users from the Republic of Korea, the Personal Information Protection Act (PIPA) applies:
    1. the scope of the data collected is set out in § 3(2), the purposes in § 4 and the retention periods in § 8; once those periods have expired, the data is irreversibly deleted;
    2. data is entrusted and transferred abroad to the following recipient: Google Ireland Limited and Google LLC (Ireland, the United States and other countries in which Google maintains data centers); the transfer takes place over the network, in the course of using the App after consent has been given; scope of data: § 3(2); purpose: analysis of the use of the App and handling of crash reports; period: § 8. The User may refuse the transfer by selecting “Not now”, or stop it using the switch described in § 5;
    3. a person who has not reached the age of 14 may give consent only with the consent of a legal representative;
    4. the Controller is responsible for data protection, at the address given in § 1(3). The User may also contact the Personal Information Protection Commission (PIPC).
  8. Other countries. With regard to Users from countries not listed above, the Controller applies the rules described in the Policy. If mandatory provisions of the law of the User’s country grant the User more extensive rights or require additional information, the Controller respects those rights and provides that information upon a request sent to the address given in § 1(3). The rights known in some countries as the rights of access, rectification, cancellation and objection (ARCO) correspond to the rights described in § 9.

§ 15. Changes to the Privacy Policy

  1. The Policy may be changed, in particular where the scope of data sent by the App, the services used or the provisions of law change. The current version is always available on the Website, together with the date from which it applies.
  2. An extension of the scope of data sent from the App that requires the User’s consent takes place only after that consent has been obtained in the App.
  3. The Policy is available in several language versions. In the event of discrepancies, the Polish version prevails.