Privacy Policy

Effective: 27 June 2026

1. Data Controller

The controller of personal data is Paweł Kobylak, ul. Olkuska 11/1, 81-501 Gdynia, Poland, Tax ID (NIP): 5862419062 (the "Controller").

Data protection contact: [email protected].

A Data Protection Officer has not been appointed — the Controller does not fall within the categories for which the GDPR mandates such an appointment.

2. Scope

This policy covers the libaroo.app website (marketing site and newsletter sign-up). It also covers the core data-security practices, data-processing principles applicable to the Application, and the account-deletion procedure required by the app stores (App Store, Google Play). The Libaroo mobile and web application has a separate privacy policy provided in-app, which supplements these provisions with Application-specific detail.

3. Purposes, Legal Bases and Retention

Libaroo Application account data: details and retention periods are set out in §13 below (immediate deactivation → permanent purge 30 days after the request).

Legitimate interests pursued (Art. 6(1)(f) GDPR): (i) demonstrating proper consent collection for accountability and possible proceedings; (ii) protecting the site from attacks, spam and abuse; (iii) establishing, exercising and defending civil-law claims.

4. Data Processed

• Newsletter: email address, language, IP address, browser User-Agent, sign-up and confirmation timestamps, confirmation token (double opt-in).
• Analytics / cookies: device identifier, anonymised IP, browser and page-view data — only after consent.

5. Voluntary Provision

Providing data is voluntary but necessary to deliver the requested service (e.g. newsletter sign-up requires an email address and consent).

6. Recipients

Data may be shared with the following processors acting on behalf of the Controller:

• Amazon Web Services EMEA SARL (Luxembourg) — newsletter database hosting and email delivery via Amazon SES (region eu-central-1, Frankfurt);
• Google Ireland Ltd. (Ireland) — Google Analytics 4 and Google Fonts;
• the server infrastructure provider hosting the site;
• competent public authorities — where required by law.

7. International Transfers

Use of Google services may involve transfers of data to the United States. Such transfers rely on the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework and on Standard Contractual Clauses (SCCs).

Data processed by Amazon Web Services in the eu-central-1 region (Frankfurt) is kept within the EEA by default. To the extent any transfer outside the EEA may occur (e.g. global AWS account operations), it relies on the EU-U.S. Data Privacy Framework (Amazon Web Services, Inc. is DPF-certified) and Standard Contractual Clauses.

8. Cookies and Google Consent Mode v2

The site uses cookies. By default all analytics and marketing cookies are blocked (Google Consent Mode v2 — "denied"). Analytics cookies are activated only after consent in the cookie banner. Cookies strictly necessary for the site to function (e.g. remembering the consent choice) are always processed under Art. 6(1)(f) GDPR.

Cookie consent can be changed at any time by clearing browser data for libaroo.app.

9. Your Rights

You have the right to:

• access your data (Art. 15 GDPR);
• rectification (Art. 16);
• erasure — "right to be forgotten" (Art. 17);
• restriction (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw consent at any time, without affecting the lawfulness of prior processing (Art. 7(3));
• lodge a complaint with the Polish Data Protection Authority (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or your local supervisory authority.

To exercise your rights, email [email protected].

10. Newsletter Unsubscribe

You may unsubscribe at any time using the unsubscribe link at the bottom of every newsletter email. Unsubscribing constitutes withdrawal of consent and removal of your address from the list.

11. Automated Decision-Making

The Controller does not make decisions about you in a fully automated manner, nor does it engage in profiling that produces legal effects.

12. Changes

This policy may be updated. The current version is always available at libaroo.app/en/privacy. Material changes will be communicated by email to newsletter subscribers.

13. Data Security and Google Play Compliance

Target audience

The Libaroo mobile and web application is intended exclusively for adult users. It is not enrolled in the Google Play “Designed for Families” programme or any equivalent children-directed programme. The Controller does not knowingly process personal data of persons under 16 years of age (the threshold under Art. 8 GDPR; in the United States: 13 years under COPPA). If a minor has registered an account without parental or guardian consent, notification to [email protected] will result in prompt deletion of their data.

Technical safeguards

• Data in transit: all communication between the mobile application and the API server uses HTTPS (TLS 1.2/1.3) exclusively. No unencrypted channel is used.
• Data on device: authentication tokens are stored in the operating system's secure storage — Keychain on iOS and EncryptedSharedPreferences (Android Keystore) on Android, via the flutter_secure_storage package.
• Server and database: user data is stored on a server in Germany (EEA) in a PostgreSQL database on access-controlled infrastructure. Internal communication between server components takes place within an isolated Docker network.

Third-party SDKs collecting data

The Libaroo mobile and web application uses the following third-party tools that may collect diagnostic or statistical data:

Data transferred to the United States (Sentry) is governed by Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.

The application does not display advertisements. No advertising SDK (AdMob, Meta Audience Network, or any other) is installed in the application.

Account and data deletion

Users may delete their account and all associated data at any time directly from within the Application (self-service, with no need to contact support), or alternatively by emailing [email protected]. A personal data export (DSAR) is available before deletion. The deletion lifecycle is as follows: the account is deactivated immediately upon the request; a 30-day grace period follows. During the grace period, the account and the user's data remain inaccessible — to the user and to other users of the Application — and are not processed for their original purposes; logging back in during this time automatically restores the account. Logging back in during the grace period constitutes the user's withdrawal of the deletion request. After 30 days, the erasure becomes permanent and irreversible — the account and associated personal data are purged by a scheduled process. Data processed on the basis of Art. 6(1)(c) GDPR (accountability) may be retained for the period required by applicable law.

Pseudonymised deletion record

When you delete your account, Libaroo retains a one-way cryptographic fingerprint (HMAC-SHA256) of your email address — not the email address itself. This record cannot be reversed to your email address without access to a separate secret key held only in our server configuration.

Why we keep it. We process this pseudonymised fingerprint on the basis of our legitimate interests (GDPR Art. 6(1)(f)) to: (1) prevent abuse of the service by users who have had their account terminated; (2) avoid re-sending a welcome email to an address that already had an account; and (3) defend against legal claims arising from prior account activity.

How long we keep it. The fingerprint is subject to mandatory criteria-based review every three years. At each review, we assess whether the original grounds for retention still apply. If they do not, the record is deleted. The three-year period runs from the date your account was permanently removed from our systems (typically 30 days after you requested deletion).

Your rights. You may object to this processing at any time by contacting us at [email protected] (GDPR Art. 21). We will reassess the grounds for retention and delete the record if no overriding legitimate interest remains. You also have the right to lodge a complaint with the Polish data protection authority (UODO, www.uodo.gov.pl). Note: we cannot erase the fingerprint on request under Art. 17 where our legitimate interest in retaining it outweighs your erasure right — we will explain our assessment in writing if this applies.

Data breach procedure

In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, the Controller commits to:

• notifying the Polish Data Protection Authority (Prezes UODO) within 72 hours of becoming aware of the breach (Art. 33 GDPR);
• communicating the breach without undue delay to affected individuals where it is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR).