Privacy Policy
Effective date: 10 July 2026 · Last updated: 10 July 2026
This Privacy Policy explains what personal data Notifind collects, why, how it is used and shared, and the rights you have over it. It is written to comply with the EU General Data Protection Regulation (GDPR), the Czech Personal Data Processing Act (Act No. 110/2019 Coll.), and the California Consumer Privacy Act as amended by the CPRA (CCPA). Notifind is available worldwide, so this policy applies to you wherever you are.
Please read it together with our Terms of Service.
1. Who we are (Data Controller)
The “data controller” is the person who decides how and why your data is processed. For Notifind, that is:
- [Legal name / trading name], a sole trader (OSVČ) established in the Czech Republic.
- IČO: [IČO] · Registered seat: [Registered address], Czech Republic.
- Contact for privacy, data-protection and legal matters: jacob@sproduction.cz
We refer to Notifind as “the app”, “Notifind”, “we”, “us” or “our” throughout. If you have any question about this policy or want to exercise your rights, email us at the address above — we aim to respond within 30 days. We are a small independent developer and are not legally required to appoint a Data Protection Officer.
2. Plain-English summary
We know legal text is dense, so here is the short version (the sections below are the binding detail):
- We collect the minimum we need to run the app: your email, password (stored encrypted — we never see it), display name, username, and the content you create (notes, calendar events, messages).
- You choose who sees you. There is no public feed and no algorithm. Other people can only find you by your username or a link you share, and can only see what you send them or share with them.
- We do not sell your data, we do not run ads, we do not use third-party analytics or tracking SDKs, and we do not collect your GPS/precise location.
- We use Supabase for our database, sign-in and file storage, and Apple for app distribution and subscription billing.
- Notifind is a downloadable app (Apple App Store now; Google Play planned later), not a website — the only thing we run on the web is an informational landing page.
- You can delete your account and all its data at any time, from inside the app.
- You have full GDPR and CCPA rights — see sections 9 and 10.
3. Information we collect
3.1 Information you give us
| Data | What it is | When |
|---|---|---|
| Email address | Used to create and secure your account, sign you in, and send essential emails. | At sign-up. |
| Password | Stored only as a salted cryptographic hash by our authentication provider (Supabase). We never see or store your plain-text password. | At sign-up / reset. |
| Display name | The name shown to people you chat with. | At sign-up; editable. |
| Username | A unique handle (3–20 characters) that others use to add you as a friend. | Optional; set in Profile. |
| Profile picture (avatar) | An image you may upload. (Avatar upload is not enabled in the current release; when enabled, avatars are stored in Supabase Storage.) | Optional. |
| Your content | Notes and note folders, calendar events, direct and group messages, friend requests, and the groups you create or join. | While you use the app. |
3.2 Information created automatically when you use the app
| Data | What it is |
|---|---|
| Account identifiers | A unique user ID and a random “friend code” that powers your shareable “add-me” link (the code is random so the link never exposes your username). |
| Technical & security logs | Like any online service, our hosting provider processes limited technical data needed to deliver and secure the service — for example your IP address, timestamps, and error/security logs. |
| Subscription status | Whether you have an active Notifind Pro subscription. We receive this from Apple. We never receive your card number or full payment details. |
3.3 Information we deliberately do not collect
- No precise location / GPS. The app does not request or collect your geolocation.
- No advertising identifiers and no third-party advertising or analytics SDKs (see section 4).
- No special-category (“sensitive”) data. We do not ask for it; please do not put health, biometric, political, religious or similar data into your profile where it is not needed.
4. Analytics and crash reporting
Notifind does not currently include any third-party analytics, advertising, or tracking software.
Because the app is distributed through the Apple App Store, Apple may provide us with aggregated, non-identifying app-usage statistics, and — only if you opt in on your device — anonymised crash and diagnostic reports, through App Store Connect. This data is provided by Apple under Apple’s own privacy terms and does not identify you to us individually.
If we introduce analytics or crash-reporting tools in the future, we will name the provider in this policy, update the “last updated” date, and obtain your consent where the law requires it before doing so.
5. Payments and subscriptions
Notifind is free to download. It offers an optional Notifind Pro subscription (currently $3.99 / month, or the equivalent shown in your local currency in the App Store).
- Payment is handled entirely by Apple through your App Store account. Apple acts as the seller/merchant of record and processes your payment details directly.
- We never receive or store your card number, billing address, or full payment information. We only receive confirmation of your subscription status so we can unlock Pro features.
- Apple’s handling of your payment data is governed by Apple’s Privacy Policy.
- Managing, cancelling, and refunds for the subscription are handled through your App Store account and Apple’s policies. See our Terms of Service for the subscription terms.
Note (Android): if Notifind is later released on Google Play, the equivalent billing and payment processing will be handled by Google, and this section will be updated to reflect that.
6. Why we use your data, and our legal bases (GDPR Article 6)
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and secure your account; sign you in | Email, password hash, identifiers | Contract (Art. 6(1)(b)) |
| Provide the core features — notes, calendar, messaging, groups, friends | Your content, display name, username, friend code | Contract (Art. 6(1)(b)) |
| Let approved contacts and group members see the content you share with them | Display name, username, avatar, shared content | Contract (Art. 6(1)(b)) |
| Send essential service emails (sign-up confirmation, password reset) | Email address | Contract (Art. 6(1)(b)) |
| Provide and record your Pro subscription | Subscription status | Contract (Art. 6(1)(b)) |
| Keep the service secure, prevent fraud and abuse, moderate reported content | Technical/security logs, reported content | Legitimate interests (Art. 6(1)(f)) |
| Keep tax and accounting records relating to purchases | Transaction records | Legal obligation (Art. 6(1)(c)) |
| Establish, exercise or defend legal claims | As relevant | Legitimate interests (Art. 6(1)(f)) |
| Any future marketing emails or optional analytics | Email / usage data | Consent (Art. 6(1)(a)) — only if you opt in |
Where we rely on legitimate interests, we have weighed those interests against your rights and will provide our balancing assessment on request. You can object to that processing (see section 9).
7. How your information is shared
We do not sell your personal data and we do not share it for cross-context behavioural advertising. Your data is disclosed only in these limited ways:
7.1 With other users, at your direction
- Your display name, username and avatar are visible to people you connect or share with.
- Messages are visible to their recipient(s); group messages are visible to members of that group; shared notes/folders are visible to the group you share them with (and editable only if you grant edit rights).
- There is no public profile, no public feed, and no discovery by strangers — people can only reach you via your username or a link you deliberately share.
7.2 With our service providers (processors / sub-processors)
| Provider | Role | Data |
|---|---|---|
| Supabase (Supabase Inc.) | Database, authentication, file storage, hosting, and transactional emails (sign-up confirmation, password reset) | Account data, your content, email address, technical/security logs |
| Apple (Apple Inc. / Apple Distribution International) | App distribution, in-app subscription billing, optional aggregated analytics & crash reports | Payment data (processed by Apple directly), subscription status, opt-in diagnostics |
| Spaceship (domain & web hosting) | Registers our domain and hosts our public landing-page website | Domain/DNS records; standard web-server logs for the website |
7.3 For legal and safety reasons
We may disclose data where we reasonably believe it is necessary to comply with a legal obligation, a lawful request from an authority, to enforce our Terms, or to protect the rights, safety and property of our users, the public, or us.
7.4 In a business transfer
If the app or business is transferred (e.g. sold), data may be transferred as part of that transaction; we will notify you and any new controller will remain bound by this policy or an equivalent one.
8. International data transfers
Your account data and content are stored within the European Union — our Supabase database, authentication, and file storage run in an EU hosting region.
Some providers — in particular Apple (for app distribution, payments, and optional diagnostics) — may process limited data outside the European Economic Area (EEA), including in the United States. Where that happens, the transfer is protected by an appropriate safeguard under GDPR — an adequacy decision by the European Commission, or the European Commission’s Standard Contractual Clauses (SCCs) — so your data keeps an equivalent level of protection. You can ask us for details of the safeguards that apply.
9. Your rights under GDPR
If you are in the EEA, UK, or Switzerland, you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data (much of which you can edit yourself in the app).
- Erasure (“right to be forgotten”) — delete your data; you can do this instantly via Settings → Delete Account, or by emailing us.
- Restriction — ask us to limit processing in certain circumstances.
- Data portability — receive your data in a structured, machine-readable format.
- Object — object to processing based on legitimate interests.
- Withdraw consent — where we rely on consent, withdraw it at any time (without affecting prior processing).
- Not be subject to automated decision-making — we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
To exercise any right, email jacob@sproduction.cz. Exercising your rights is free and we will respond within one month.
Right to complain: You may lodge a complaint with your local supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), www.uoou.gov.cz.
10. Your rights under the CCPA (California residents)
In the past 12 months we have collected the following categories of personal information (as defined by the CCPA) for the business purposes described in section 6:
- Identifiers — email address, username, display name, user ID, friend code, IP address.
- Customer records — account credentials (password stored only as a hash).
- Commercial information — Notifind Pro subscription status.
- Internet/network activity — limited technical and security logs.
- Other user content — the notes, messages, calendar events and files you create.
We do not collect precise geolocation, and we do not knowingly process the “sensitive personal information” categories for the purpose of inferring characteristics.
Your CCPA rights: know / access, delete (also available instantly via Delete Account), correct, opt out of “sale” or “sharing” — not applicable here, because we do not sell or share your personal information for money or for cross-context behavioural advertising, and we have not done so in the preceding 12 months — and non-discrimination: we will never deny service, charge a different price, or provide a different quality of service because you exercised your rights.
To exercise these rights, email jacob@sproduction.cz. You may use an authorised agent; we may need to verify your identity before we act. We will respond within the timeframes the CCPA requires (generally 45 days).
11. Data retention
- We keep your account data and content for as long as your account is active.
- When you delete your account, your account and associated data are permanently deleted from our live systems. Copies may persist in encrypted backups for no longer than 30 days before they are overwritten.
- We keep transaction and tax records for as long as Czech and EU law requires (generally up to 10 years for accounting/VAT records).
- Content you sent to other users may remain visible to those users even after you delete your account, to the extent it now forms part of their own conversation history — but it will no longer be linked to an active profile.
12. How we protect your data
- All traffic between the app and our servers is encrypted in transit (TLS).
- Passwords are hashed and never stored or visible in plain text.
- Access to your content is enforced at the database level by Row Level Security (RLS), so users can only reach data they are authorised to see.
- Account deletion requires re-entering your password to confirm it is really you.
No system is perfectly secure, so we cannot guarantee absolute security, but we take reasonable technical and organisational measures appropriate to the risk. If a data breach affects your rights, we will notify you and the relevant authority as required by law.
13. Children and minimum age
Notifind is intended for users aged 16 and over. This threshold is at or above the GDPR “age of digital consent” in every EU member state, so we do not need to operate a parental-consent system, and it is above the U.S. COPPA threshold of 13.
We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has created an account, contact jacob@sproduction.cz and we will delete it.
14. Cookies and tracking technologies
The Notifind app is a native application and does not use cookies or similar cross-site tracking technologies, and it contains no third-party advertising or analytics trackers.
Our public landing-page website (hosted via Spaceship) is a static, informational site. It does not use advertising or analytics cookies; any cookies it may set are strictly necessary for the site to function. If we later add website analytics, we will update this section and, where the law requires it, ask for your consent first.
15. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will change the “last updated” date above. If the changes are material, we will provide a more prominent notice (for example, an in-app notice or an email) before they take effect. Continuing to use Notifind after an update means you accept the revised policy.
16. Contact us
Questions, requests, or complaints about privacy?
[Legal name / trading name] (OSVČ) — jacob@sproduction.cz