Mobile app privacy policy

This is an English translation of the Polish Polityka prywatności aplikacji mobilnej, provided for convenience. The Polish version is binding and prevails in the event of any discrepancy between the two.

This document covers the mobile app. A separate document describes the privacy policy of the website. How the content of documents uploaded by the company using the product is processed is also governed by the data processing agreement concluded with that company.

1. Data controller

The controller of the personal data processed in connection with the use of the app is Marciniak IT Paweł Marciniak, publisher of the Czytelnia product, with its registered office at ul. Karpia 23G lok. 4, 61-619 Poznań, Poland, NIP (Polish tax ID) 7811949227, REGON (business register number) 367646433. Contact in matters of personal data: contact@czytelnia.cloud.

For the content of documents uploaded to the product by the company that uses it, that company remains the controller — we process the content as a processor, on the basis of a data processing agreement.

2. What the app is

The mobile app is a client of an existing Czytelnia account — the same service that is used in the browser. You cannot create an account in the app: accounts are created by invitation only. You log in with your email address and password, which opens the same session as in the web application.

3. What data the app processes

• account data — email address, user name and role in the product;
• password — sent only over an encrypted connection (TLS) to the server in order to log in; the app never stores the password on the device;
• session token — kept in the device's secure system storage (the Keychain on iOS, storage encrypted with a key from the Android Keystore);
• working content — collections, PDF documents uploaded from the phone, questions, answers, citations (including page images) and ratings of answers; they are stored on the product's servers, not on the device;
• device token for notifications — see section 5;
• technical server logs — standard request metadata (including the IP address and timestamps), kept for the security and continuity of the service; we do not build user profiles from them.

The only things stored permanently on the device are the session token and local settings (e.g. the theme and notification preferences). The app does not keep a local copy of documents or conversations.

4. What the app does not do

• it contains no advertising, analytics or tracking SDKs,
• it does not read your location, contacts, photos, microphone or camera,
• it does not browse the files on the device — it gets access to a file only when you choose it yourself in the system file picker while uploading,
• it does not profile users or make automated decisions about them that produce legal effects.

5. Push notifications

Notifications are optional — they appear only after you give consent in the system permission dialogue. After consent, the app registers a device token on the server; notifications are delivered by the system notification delivery service of the platform (Android or iOS), run by the provider of that operating system.

A notification never contains the content of documents — only the type of event, technical identifiers and the name of the file the event concerns. Individual types of notification can be muted in the app's settings (the server enforces the muting, not the phone). The device token is deleted when you log out and when the account is deleted.

6. Processing of content by AI providers

Answers to questions are produced using external artificial intelligence services: a language model and semantic search. We pass to them only what is needed to answer: the text of the question and the document passages found by the search. Under the terms of those services, the data passed to them is not used to train their models. The transfer may involve sending data outside the European Economic Area — it takes place on the basis of the mechanisms provided for in Chapter V of the GDPR (including standard contractual clauses). We provide the list of current sub-processors on request at the contact address in section 1.

7. Purpose and legal basis

• providing the service — logging in, storing and searching documents, answering questions (Article 6(1)(b) GDPR — performance of a contract),
• security and continuity of service — technical server logs, protection against abuse (Article 6(1)(f) GDPR — legitimate interest),
• push notifications — only with your consent (Article 6(1)(a) GDPR), which you can withdraw at any time in the system settings or in the app.

8. Where and for how long we keep the data

We keep account data and working content on servers in the European Economic Area for as long as the account exists. Deleting the account deletes collections, documents, the question history and device tokens. Technical server logs are rotated automatically.

9. Deleting your account and data

You can delete your account in the web application (profile settings) or by sending a request to contact@czytelnia.cloud. Deleting an account is irreversible and covers the data listed in section 8.

10. Recipients of the data

The data may be processed by entities that provide us with technical services: our server infrastructure provider, our email provider (transactional messages, e.g. a password reset), the providers of the system push notification delivery services and the AI service providers described in section 6. They act under contracts and only to the extent necessary to provide those services. We do not sell data and do not share it with third parties for marketing purposes.

11. Your rights

• access to your data and a copy of it,
• rectification of inaccurate data,
• erasure of data (the “right to be forgotten”),
• restriction of processing,
• data portability,
• objection to processing based on legitimate interest,
• withdrawal of consent at any time — without affecting the lawfulness of processing before the withdrawal.

We act on each of these rights when you write to the address in section 1. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

12. Changes to this policy

If we change how the app works in the respects described above, we will update this document beforehand and record the date of the change below.

Document version: August 2026.