homdu app Privacy Policy.

01Data controller

The controller of personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR") is:

(the "Controller", "we").

For all matters relating to the processing of personal data and the exercise of rights under the GDPR, you can contact the Controller at the email address indicated above.

The Controller has not appointed a data protection officer. Contact functions in the area of data protection are performed directly by the Controller.

02Definitions

For the purposes of this Policy, the following meanings are adopted:

• App – the homdu mobile app for iOS devices (and, in the future, for other mobile platforms).
• User – a natural person using the App.
• Personal data – any information about an identified or identifiable natural person.
• Processing – any operation performed on personal data, e.g. collection, storage, modification, sharing, deletion.
• Project – a building or renovation project run by the User in the App, together with its assigned stages, tasks, costs, documents, photos, contacts and notes.
• Project Owner – a User who shares a Project with another User.
• Collaborator – a User who has accepted an invitation to a shared Project.
• Shared Project – a Project shared between Users through Apple's CloudKit / CKShare mechanisms.
• Device – the mobile device on which the App is installed.
• Processor – an entity processing personal data on behalf of and on the instructions of the Controller.
• EEA – the European Economic Area.

03General processing principles

3.1. We process personal data in accordance with the GDPR, the Polish Act of 10 May 2018 on the protection of personal data and other applicable laws.

3.2. We apply the principle of data minimisation – we collect only the data necessary to achieve specific, clearly defined purposes.

3.3. An important feature of the App is that a significant part of the User's data (e.g. project content, photos, notes, documents) is stored locally on the device and – if the User uses synchronisation – in the User's private iCloud space. In many cases the Controller has no technical access to this content. Details are described in section 7.

3.4. Some App features (e.g. analytics, telemetry, certain personalisations) work only after the User gives consent and can be turned off at any time.

04Categories of data processed

Below we present the categories of data that may be processed in connection with using the App. For each category we indicate its nature:

4.1. Account and authentication data

• RUser identifier linked to the Sign in with Apple service (e.g. a persistent, anonymous identifier assigned by Apple) — if the User uses sign-in.
• Oemail address – only if the User decides to share it when signing in with Apple (Apple allows the email address to be hidden via the "Hide My Email" feature).
• Ofirst name or display name, if provided.

4.2. Project data (content created by the User)

• Onames and descriptions of projects, stages and tasks.
• Ocost, budget, deadline and status data.
• Olinks, text notes and other content added by the User.

4.3. Contact and contractor data

• Ocontact details of contractors, suppliers or other people that the User adds to the App themselves (e.g. name, phone number, email address, company name, notes).
• OScontact data imported from the iOS system address book, if the User grants the relevant system permission.

4.4. Photos, documents and files

• OSphotos and albums added to projects.
• Onotes and descriptions assigned to photos.
• Odocuments and files attached by the User.
• OSfile metadata (e.g. date and, in some cases, location data saved in photos by the device), where the User adds such files themselves.

4.5. Technical and diagnostic data

• Rdevice model, operating system version, App version, language and regional settings.
• Cdata on crashes, errors and App stability (diagnostic reports) – within the scope of crash reporting in the Crashlytics service.

4.6. Analytics and telemetry data

• Cevents relating to App usage (e.g. opening a screen, using a feature), analytics identifiers assigned by analytics tools, approximate information about how the App is used.

4.7. In-app activity data

• RCinformation about the status and progress of projects, recently used features and interface preferences – to the extent necessary for the App to work and, where covered by consent, for analytics.

4.8. Notification-related data

• CSthe push notification token assigned to the device (an identifier enabling notification delivery) – depending on system consent for notifications.
• Oinformation about subscription to selected notification categories.

4.9. Referral programme data

• Othe referrer's identifier and information about the referred User to the extent necessary for the referral programme to work (e.g. the fact that a referral code was used).

4.10. Data provided via contact forms

• Othe content of the message and the contact details provided by the User when contacting the Controller (e.g. by email).

05Sources of data

We obtain personal data:

5.1. directly from the User – when the User creates projects, adds content, contacts, photos, documents, uses the referral programme or contacts us;

5.2. from the User's device and operating system – within the scope of technical and diagnostic data and system permissions (e.g. access to photos, contacts, calendar, notifications) that the User grants themselves in the iOS settings;

5.3. from the service providers we use – e.g. the User identifier provided by the Sign in with Apple service, analytics and diagnostic data generated by Apple and Google/Firebase tools, within the scope described in this Policy.

06Purposes and legal bases of processing

We process personal data for the following purposes and on the following legal bases:

To the extent that processing is based on consent (art. 6(1)(a) GDPR), consent is voluntary and may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

07Local data, iCloud synchronisation and data sent to external services

For transparency, we explain where the User's data is actually located.

7.1. Data stored locally on the device

Most content created by the User (projects, stages, tasks, costs, notes, photos, documents, contacts) is first stored locally on the User's device, in the app's data area. To store local data and settings, the App uses standard iOS mechanisms, including:

• app memory and files (local database, files, local cache and working copies of data),
• AppStorage / UserDefaults mechanisms (App settings and preferences),
• Keychain (secure storage of sensitive technical data, e.g. tokens and authentication identifiers).

Data stored solely locally is not transferred to the Controller.

7.2. Synchronisation via iCloud / CloudKit

If the User uses synchronisation based on iCloud / CloudKit, their data may be synchronised between their devices signed in to the same Apple account. In this model:

• data is stored in the User's private iCloud space, managed by Apple,
• access to this data is, as a rule, available only to the User within their Apple account,
• the Controller has no technical access to content stored in the User's private CloudKit database and does not read it,
• the rules for processing data within iCloud are set by Apple as the provider of that service.

7.3. Project sharing via iCloud / CloudKit

The App allows a Project Owner to share a selected Project with another user through Apple's CloudKit and CKShare mechanisms.

Sharing is initiated deliberately by the Project Owner. The Collaborator must accept the invitation using an Apple account before gaining access.

Depending on the type of data and the current version of the App, a Shared Project may include project metadata, stages, tasks, expenses, budgets, events, journal entries, contacts, links, documents, attachments and other content assigned to the Project.

Each participant keeps a local working copy of the Shared Project on their device. Changes made by authorised participants may be synchronised through the shared CloudKit database.

The following personal or device-specific information is not shared as part of a Shared Project: financial profiles, financing or insurance enquiries, lead submissions, notification preferences, the selected-project preference, local storage settings and identifiers of events created in the user's personal iOS Calendar.

Some files or photo collections may remain stored only on the device on which they were added. The App may inform participants when a file is not available on their device.

The Project Owner may revoke access or delete the Shared Project. A Collaborator may leave the Shared Project or delete their local copy. After access is revoked, some data may remain temporarily in a local copy until it is removed by the user or cleaned up by the App.

The Controller does not use Shared Project content for advertising or profiling and does not routinely access or inspect content stored in users' CloudKit databases. Apple processes this data under the terms applicable to iCloud and CloudKit.

The User is responsible for having a legal basis to share the content of a Project. This applies in particular to contractor data, phone numbers and email addresses, photographs of individuals, and invoices, contracts and other documents containing personal data. The User should share a Project only with people entitled to access it and should only include content they are authorised to disclose.

7.4. Data sent to the backend and external services

Some data is sent off the device to external services or to our backend, to the extent necessary for a given feature to work, in particular:

• the push notification token and technical data necessary to deliver notifications,
• analytics and diagnostic data (only after consent is given – see section 9),
• editorial, guide and partner-section content fetched from the content management system (CMS),
• data provided when contacting the Controller.

The App's backend and supporting services may be hosted with cloud infrastructure providers (see section 10). We limit the scope of data sent to the backend to what is necessary to perform a given feature.

08User account and authentication

8.1. Signing in and authentication in the App may take place using the Sign in with Apple service. Within this service, Apple provides us with a persistent User identifier and, optionally – if the User consents – an email address (the User may use the "Hide My Email" feature, which results in a relay address being provided instead of the real address).

8.2. With respect to the Sign in with Apple feature, Apple Inc. acts as an independent controller of the data processed within its own services and as the provider of the authentication mechanism. The rules for Apple's processing of data are set out in Apple's privacy policy.

8.3. Authentication data (e.g. session tokens) is stored securely, including using the iOS Keychain mechanism.

8.4. Some App features may be available without creating an account, in local mode. The range of features available without signing in may be limited (e.g. no synchronisation or sharing).

09Analytics, telemetry, diagnostics and consent

9.1. The App may use analytics and diagnostic tools provided by Google (Firebase), in particular:

• Firebase Analytics (and, where applicable, GA4-compliant event measurement) – analytics of App usage,
• Firebase Crashlytics – crash reporting and diagnostics,
• Firebase Cloud Messaging (FCM) – delivery of push notifications.

9.2. Analytics and telemetry work only after the User gives consent. The App has a consent screen on which the User can grant or refuse consent for individual processing categories (e.g. analytics, crash reporting, personalisation). Consent settings can be changed at any time in the App settings.

9.3. Until consent is given, we do not collect analytics data nor – within the scope covered by consent – diagnostic data in a way that links it to a specific User beyond what is necessary for the App to work.

9.4. Analytics data is aggregated and statistical in nature and serves to improve the quality and usability of the App. We do not use it for automated decision-making producing legal effects concerning the User (see section 13).

9.5. With respect to Firebase services, Google Ireland Limited / Google LLC acts, as a rule, as a processor on our instructions, on the basis of a concluded data processing agreement and the Firebase/Google data processing terms. The detailed rules for Google's processing of data are described in Google's privacy policy.

10Data recipients and categories of recipients

Depending on the features used, data may be shared with the following categories of recipients:

10.1. Apple service providers

Apple Inc. / Apple Distribution International Ltd. – in relation to the Sign in with Apple, iCloud/CloudKit, App Store distribution and system notification services. With respect to its own services, Apple acts as an independent controller and, where applicable, as a service provider processing data for the purpose of providing them.

10.2. Google / Firebase service providers

Google Ireland Limited / Google LLC – in relation to Firebase Analytics, Crashlytics and Firebase Cloud Messaging, acting as a rule as a processor on our instructions.

10.3. Infrastructure and hosting providers

Providers of cloud infrastructure and hosting for the App's backend and supporting services. To the extent necessary to provide the services, we may use providers such as hosting and cloud platforms (e.g. services like Vercel, cloud-computing providers and the Firebase/Google Cloud infrastructure). These providers act as processors on the basis of concluded data processing agreements.

10.4. Content management system (CMS) provider

Sanity – the provider of the content management system used to publish editorial and guide content as well as partner and recommendation sections. Content delivered to Users is, as a rule, editorial in nature; to the extent that personal data is processed within the CMS, the provider acts as a processor.

10.5. Partners and sponsored sections

Partners presented in sponsored sections and within recommendations (including financial recommendations and contractor recommendations). This content is, as a rule, presented in a way that is not individually profiled. If the User decides to proceed to a partner's offer or contact them, the partner's further processing of their data takes place under the rules set by that partner as a separate controller.

10.6. Other participants in a Shared Project

When the Project Owner enables sharing, the content of the selected Project is made available to the Collaborator or Collaborators invited by the Owner. The scope of access depends on the App's current sharing functionality and the permissions configured through Apple CloudKit.

10.7. Other recipients

• entities providing supporting services to us (e.g. email handling, tools for communicating with Users),
• public authorities and authorised entities – solely to the extent required by law.

With each entity processing data on our behalf we conclude a data processing agreement meeting the requirements of art. 28 GDPR.

11Transfers of data outside the European Economic Area (EEA)

11.1. Some of our providers (in particular Apple and Google) are based in, or process data, outside the EEA, including in the United States. This means that data may be transferred outside the EEA.

11.2. Transfers of data outside the EEA take place only with the appropriate safeguards required by the GDPR, in particular:

• on the basis of a European Commission adequacy decision (e.g. with respect to entities participating in the EU-U.S. Data Privacy Framework), or
• on the basis of standard contractual clauses approved by the European Commission, supplemented where necessary with additional protective measures.

11.3. The User has the right to obtain information about the safeguards applied and, where appropriate, a copy of those safeguards by contacting the Controller.

12Data retention period

12.1. Local data and data synchronised via iCloud – stored for as long as the User uses the App and does not delete the data themselves. Deleting the App or deleting data in its settings results in the deletion of local data; data in iCloud remains under the User's control and may be deleted by them via the Apple account settings.

12.2. Account and authentication data – stored for the period of account use; after the account is deleted it is removed or anonymised, except for data we must retain on the basis of the law or for establishing, exercising or defending claims.

12.3. Analytics and diagnostic data – stored for the period defined in the settings of the tools used (e.g. Firebase) and no longer than necessary for analytics purposes; until consent is withdrawn, where consent is the basis for processing.

12.4. Referral programme data – stored for the period necessary to settle and operate the referral programme.

12.5. Correspondence and requests – stored for the period necessary to handle the query and, where necessary, for evidentiary purposes for the limitation period of any claims.

12.6. Shared Project data – retained in CloudKit until the Project Owner deletes the Project, ends sharing or otherwise removes the data. Revoking a Collaborator's access prevents further access through CloudKit, but a local copy may remain on the Collaborator's device until it is removed by the user or the App.

12.7. After the retention periods expire, data is deleted or anonymised.

13Profiling and automated decision-making

13.1. We do not make decisions concerning Users based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect the User.

13.2. Analytics data is used for statistical purposes and to improve the operation of the App. Partner content and recommendations are presented, as a rule, contextually, without individual profiling, unless the User gives separate consent.

14Cookies and similar technologies

14.1. The mobile App itself does not use cookies in the browser sense; instead it uses the local storage mechanisms described in section 7 and – within the scope covered by consent – analytics technical identifiers.

14.2. Websites associated with the App (e.g. the information site, landing page, contact forms, admin panels or CMS) may use cookies and similar technologies, including cookies necessary for the site to work and – after consent is given – analytics cookies. Detailed information about the cookies used on the websites is provided within those websites.

14.3. By opening external links in the App (e.g. in the SFSafariViewController component), the User goes to third-party sites that may use their own cookies and their own privacy policies. We are not responsible for the processing of data by these entities.

15Integrations with iOS system features

The App may use iOS system features only after the User grants the relevant system permissions. These permissions can be changed at any time in the iOS system settings. This applies in particular to:

• Photos (PhotosPicker / photo library access) – to add photos to projects and albums; it is possible to select individual photos without sharing the entire library;
• Contacts – to add contractor or contact data, if the User decides to import it;
• Share Sheet / Share Extension – to share content into and from the App;
• Notifications – to deliver push notifications, after system consent is given;
• iOS Calendar – where a given feature is available, the App may locally store identifiers of events created by the User in order to link them to tasks or project stages; this takes place after the relevant system permission is granted;
• Browsing external links (SFSafariViewController) – to open websites indicated in the App.

Data obtained via system features is used solely to perform the feature for which the User granted the permission.

16Data security

We apply adequate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or unauthorised modification, including in particular:

16.1. Transmission encryption – the App's communication with external services and the backend takes place using encrypted connections (HTTPS/TLS).

16.2. Secure storage of sensitive data – sensitive technical data (e.g. authentication tokens) is stored in the iOS Keychain mechanism.

16.3. Access restriction – access to data processed on the backend side and to administrative tools is restricted to authorised persons, in line with the need-to-know principle.

16.4. Use of trusted providers – we work with reputable cloud infrastructure and service providers (Apple, Google/Firebase and hosting providers) that apply their own, market-recognised security measures.

16.5. Event logging and monitoring – to the extent necessary to ensure security, we keep event logs and monitor the operation of services in order to detect irregularities and abuse.

16.6. Backups – where appropriate, we use backup mechanisms aimed at ensuring the continuity and integrity of data processed on the service infrastructure side.

At the same time, we note that no method of transmitting or storing data is fully immune to risks. We make efforts to ensure that the security measures applied correspond to the current state of technical knowledge and the nature of the data processed.

17User rights

In connection with the processing of personal data, the User has the following rights:

• Right of access to data

  art. 15 GDPR

• Right to rectification

  art. 16 GDPR

• Right to erasure

  art. 17 GDPR — "right to be forgotten"

• Right to restrict processing

  art. 18 GDPR

• Right to data portability

  art. 20 GDPR

• Right to object

  art. 21 GDPR

• Right to withdraw consent

  at any time

• Right to lodge a complaint with the PUODO

  ul. Stawki 2, 00-193 Warsaw

17.1. Right of access to data and to obtain a copy of it (art. 15 GDPR).

17.2. Right to rectification of incorrect or incomplete data (art. 16 GDPR).

17.3. Right to erasure of data ("right to be forgotten"), in the cases provided for by law (art. 17 GDPR).

17.4. Right to restrict processing (art. 18 GDPR).

17.5. Right to data portability – with respect to data processed on the basis of consent or a contract by automated means (art. 20 GDPR).

17.6. Right to object to processing based on the Controller's legitimate interest (art. 21 GDPR).

17.7. Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (applies to data processed on the basis of consent, e.g. analytics).

17.8. Right to lodge a complaint with a supervisory authority – in Poland this is the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw.

To exercise the above rights, please contact the Controller at homdu.app@gmail.com. We may ask for information allowing us to identify the person making the request. We respond to a request without undue delay, no later than within one month of receiving it, with the possibility of an extension in the cases provided for by law.

The User can exercise some rights themselves – e.g. by deleting local data in the App, managing data in iCloud via the Apple account settings, changing analytics consent settings or revoking system permissions in the iOS settings.

18Children's data

18.1. The App is not directed at children and is not intended for persons under 16 years of age.

18.2. We do not knowingly collect children's personal data. If we become aware that the data of a person below the required age has been provided to us without an appropriate basis, we will take steps to delete it.

18.3. If a parent or legal guardian determines that a child has provided us with personal data, please contact us at homdu.app@gmail.com.

19Changes to the Privacy Policy

19.1. This Policy may be updated from time to time, in particular in connection with the development of the App, changes in the technologies used or changes in the law.

19.2. We will inform of material changes in a manner appropriate to their nature, e.g. through a notice in the App or an update of the document together with a change of the date.

19.3. The current version of the Policy is available at all times in the App and on the website associated with the App. The date of the last update is indicated at the beginning of the document.

20Privacy contact

For all matters relating to the protection of personal data and this Policy, please contact us: