Privacy

Data controller

The controller of your personal data is Don Rozario s.r.o., a limited liability company with registered office at Ružová Dolina 670, 919 01 Suchá nad Parnou, Slovakia, Company ID (IČO) 47 051 604, registered in the Commercial Register of the District Court Trnava, Section Sro, Insert No. 31170/T (the "we" or "Controller").

For any matter concerning personal data you can contact us at: 4friends@4friends.sk.

What data we process

The data depends on how you use Alchemia Czucia:

• Account data (when you register): email address, name or display name, account identifier, and - if you sign in with Google - basic Google profile data.
• Emotion journal entries: the emotions you select and their intensity, body sensations, energy level, breath, needs, life situations, your reflections and notes, and - if you choose to provide it - information about your menstrual cycle.
• Reminders: a push notification subscription (a device or browser identifier) and your chosen reminder days and hours.
• Technical data: data stored locally in your browser (localStorage) needed for the journal to work, and optionally your chosen gender and "My progress" self-assessment scores if you fill them in.

Special category data (health data)

Information about your emotions, body sensations, mental wellbeing and menstrual cycle constitutes special category data (data concerning health) within the meaning of Art. 9 GDPR.

We process it solely on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give when creating an account and using the journal. You can withdraw consent at any time by deleting entries or your account. This does not affect the lawfulness of processing before withdrawal.

Purposes and legal bases

• Running your account and authentication - necessary to perform the service contract (Art. 6(1)(b) GDPR).
• Running the journal and syncing across devices - your explicit consent to process health data (Art. 9(2)(a) GDPR).
• Sending push reminders - your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in settings.
• Security, abuse prevention and keeping the service running - our legitimate interest (Art. 6(1)(f) GDPR).

Recipients of data

We do not sell your data and do not use it for advertising. We only entrust it to trusted providers who process it on our behalf:

• Google / Firebase (Google Ireland Limited and Google LLC) - authentication, journal database and notification delivery.
• Vercel Inc. - hosting and serving the application.
• Browser push service providers (e.g. Google, Mozilla, Apple, Microsoft) - technical delivery of notifications if you enable them.

Transfers outside the EEA

Some providers (e.g. Google, Vercel) may process data outside the European Economic Area, including in the USA. This is done on the basis of Standard Contractual Clauses approved by the European Commission and other appropriate safeguards under the GDPR.

Retention

• We keep account and journal data until you delete entries or your account.
• After you delete your account we permanently remove the associated cloud data.
• Data stored locally in your browser is removed on sign-out or when you clear your browser data.
• Notification subscriptions are removed when you turn them off or when they become inactive.

Your rights

In relation to the processing of your data you have the following rights:

• the right of access to your data and to a copy of it,
• the right to rectification,
• the right to erasure - you can delete your account yourself in the Account section,
• the right to restriction of processing,
• the right to data portability - you can export your journal entries to a JSON file,
• the right to object to processing,
• the right to withdraw consent at any time,
• the right to lodge a complaint with a supervisory authority: in Poland - the President of the Personal Data Protection Office (UODO, uodo.gov.pl), in Slovakia - the Office for Personal Data Protection (dataprotection.gov.sk). You may contact the authority for your place of residence.

Cookies and local storage

We do not use cookies for tracking, profiling or advertising, and we do not use third-party analytics.

We use only technically necessary browser storage (localStorage) for the journal to work and - when you are signed in - the session mechanisms needed for that. This does not require consent because it serves only the service you request.

Children

The service is intended for people aged 16 and over. We do not knowingly collect data from anyone younger. If you are a parent or guardian and believe a child has given us data, contact us and we will remove it.

Artificial intelligence

Some descriptions of complex emotions (dyads) were produced as a first draft with the help of artificial intelligence tools and reviewed by a human. This content is educational in nature.

We do not make any automated decisions about you that produce legal or similarly significant effects (Art. 22 GDPR). Emotion suggestions in the journal are only a helper hint based on your own choices.

Changes to this policy

We may update this policy. We will announce significant changes in the service. The date of the last update is at the top of this document.

Contact

For data protection matters, write to us: 4friends@4friends.sk.