Privacy policy
Last updated: 2026-09-24
Who we are. POLappka is an advertising board for the Polish community in the United Kingdom, operated by Monika Pawłowska trading as Long Neck Family Labs, 2 Brookside Close, Stratford-upon-Avon CV37 9PL, United Kingdom ("we", "us"). Contact for privacy matters: info@polappka.com.
This policy explains what personal data the POLappka app (Android, iOS and the web app at app.polappka.com) collects, why, how long we keep it and what your rights are. It applies together with our Terms of Use.
1. Data we collect and why
| What | Where it comes from | Why we use it (legal basis) |
|---|---|---|
| Account data — e-mail address, password (never stored by us in plain text — Firebase Authentication handles it), display name, language, sign-in provider (Google / Apple) | You, when you register or sign in | To create and secure your account, to send verification and password-reset e-mails (contract) |
| Profile and alert settings — your chosen location (postcode, address or a map pin), alert distance, which ad categories you want alerts for | You, in Edit profile / Notification settings | To show ads near you and to send the alerts you asked for (contract / your consent for notifications) |
| Device location (GPS) | Your device, only while you use the map or "use my location" and only after you allow it in the system prompt | To centre the map and suggest your location. We do not track you in the background (consent) |
| Ads you post — title, description, category, photos, contact details you choose to publish (phone, e-mail, website, social links), the ad's location, validity dates | You, in the ad creator | To publish the ad. Contact details and the location you put in an ad are shown to other users — that is the purpose of an ad board. (contract) |
| Purchases — the plan or notification package you bought, amount, date, currency, the payment provider's transaction id, invoice details you enter (business name, address, VAT number) | You and our payment providers (Stripe on the web, Apple App Store / Google Play through RevenueCat on mobile) | To deliver what you bought, to issue invoices and keep accounting records (contract / legal obligation). We never see or store your card number. |
| Favourites, reports, feedback, promo-code redemptions, sticker-reward claims | You, when you use those features | To provide the feature; reports and feedback are read by our moderators (contract / legitimate interest in a safe service) |
| Ad content sent to AI moderation — the text of your ad and its photos | Your ad, when you submit or edit it | Every submission is checked automatically by an AI model (Google Gemini via Firebase / Vertex AI) for illegal, offensive or misleading content, and may then be reviewed by a human moderator (legitimate interest / legal obligation) |
| "Fill in with AI" — the text, photos, documents or web address you give it | You, only when you use that feature | To draft your ad with the AI model; the inputs are processed for that request only (contract) |
| Push notification token | Your device, when you allow notifications | To deliver the alerts you set up and messages about your own ads (consent — you can switch it off in the system settings or in the app) |
| Usage and attribution data — app installs, opens, in-app events, device identifiers (including the advertising identifier on iOS only after you allow tracking), IP-derived country | Your device, via AppsFlyer and Firebase | To measure where users come from and how the app is used, and to fix crashes (legitimate interest; tracking on iOS only with your ATT consent) |
| Crash and performance data | Your device, via Firebase Crashlytics / Performance | To find and fix errors (legitimate interest) |
| Deleted-account record — your e-mail address and the number of unused free tokens at the moment you delete your account | Your account, at deletion | So that free tokens are not granted twice to the same person and are restored if you come back (legitimate interest in preventing abuse) |
We do not sell personal data. We do not use it for third-party advertising.
2. Who can see what
- Other users see the content of your published ads, including the contact details and the location you chose to publish. They do not see your account e-mail unless you put it in the ad, and they do not see your alert settings, favourites or purchases.
- Ad owners see statistics about their ads (number of views, contact taps, approximate area) — never who viewed them.
- Our moderators see submitted ads, reports and feedback.
- Service providers that process data for us (see section 3).
3. Service providers (processors)
| Provider | Purpose | Location of processing |
|---|---|---|
| Google Firebase (Authentication, Firestore database, Storage, Cloud Functions, Cloud Messaging, Crashlytics, Remote Config) | Accounts, data storage, photos, notifications, error reporting | EU (europe-west2, London) for the database and functions; Google's global infrastructure for authentication and messaging |
| Google Vertex AI / Gemini | AI moderation of ads, "Fill in with AI" | Google Cloud |
| Algolia | Search index of published ads | EU |
| Stripe | Card payments on the web, receipts, refunds | Stripe (EU/UK entities) |
| Apple App Store / Google Play, RevenueCat | In-app purchases on mobile | Apple / Google / RevenueCat (US) |
| Maileroo | Sending transactional e-mails (verification, password reset, invoices) | EU |
| AppsFlyer | Install attribution and usage analytics | EU/US under standard contractual clauses |
| Google Maps, Ideal Postcodes | Maps and UK postcode lookup | Google / UK |
Where a provider processes data outside the UK/EEA, transfers are covered by the UK International Data Transfer Agreement or EU Standard Contractual Clauses.
4. How long we keep data
- Account and profile: until you delete the account (Edit profile → Delete account) or ask us to.
- Ads: published ads are visible until they expire; expired ads are kept for 180 days so you can revive them, then deleted together with their photos. Draft ads untouched for 90 days are deleted.
- Purchase records and invoices: 6 years (UK tax law).
- Deleted-account record (e-mail + unused tokens): kept until the tokens are restored or 3 years, whichever is sooner.
- Reports, moderation decisions, admin log: 2 years, for the safety of the service.
- Crash and analytics data: per the provider's default (Firebase 90 days for event data, AppsFlyer 24 months).
- Short-lived security records (limits on sign-in e-mails, promo-code attempts, contact-detail views, alert counters, event reminders): 7 to 60 days, deleted automatically.
- A copy of your data you asked for (a data-export file): deleted 30 days after we create it.
- Contact details in a published ad are shown only to signed-in users, and each user can open at most 40 different ads' contact details a day.
5. Your rights
Under UK GDPR you can ask us to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent (notifications, location, tracking) at any time. Most of this you can do yourself in the app: Edit profile (data), Notification settings (alerts), Delete account (everything). For anything else write to info@polappka.com; we answer within one month. You can complain to the Information Commissioner's Office (ico.org.uk).
6. Children
POLappka is for users aged 18 and over. We do not knowingly collect data from children; if you believe a child has registered, contact us and we will delete the account.
7. Security
Data is stored on Google Cloud with encryption in transit and at rest, access rules limit each user to their own data, and payment card data never touches our systems. No system is perfectly secure; tell us at info@polappka.com if you suspect a problem.
8. Changes
We will announce material changes in the app and update the date below. Continued use after the change means you accept the new policy.
Version 1 — 24 September 2026