Privacy Policy

Who is responsible for your data

FINGERS YODA SP. Z O.O. is the controller of personal data processed for the CremaNote website and app. Contact us at support@cremanote.com or ul. Ostrobramska 101A/301, 04-041 Warszawa, Poland. This policy applies to the website, the mobile app and related support.

Data we process

The app creates an anonymous account identifier through Firebase Authentication. It stores the coffee, bag, diary, recipe and brew details you enter, along with app preferences and the technical information needed to save and sync those records. A journal may remain on your device; cloud copies are processed when sync is available.

If you buy or restore a subscription, we receive the store transaction, product and entitlement status needed to provide paid features. Apple App Store or Google Play handles payment details for purchases made through that store; we do not receive your full payment card number. If you contact support, we process your email address and the information you send us.

Our website host and app service providers may process technical data such as IP address, device or browser details, diagnostic information and request logs. Optional product analytics and attribution may involve app events and device or provider identifiers only when the relevant controls and permissions allow them.

Why we use data and our legal bases

We use your account identifier, journal data and subscription status to provide the app and subscriptions (performance of our contract with you). We use support messages and limited technical logs to answer requests, keep the service secure and diagnose faults (our legitimate interests, or our contract where applicable). We process records required for accounting, tax or legal claims when law requires it or permits us to protect our rights.

Optional analytics, advertising attribution and partner sharing depend on your choices and, where required, your consent. These features are off by default in the app. Refusing them does not prevent basic journal use or purchases. Where consent is the legal basis, you may withdraw it at any time; withdrawal does not affect earlier lawful processing.

Service providers and international transfers

We use Google Firebase for anonymous identity and app infrastructure, RevenueCat for subscription management, Apple for App Store purchases, Google for Google Play purchases, and a hosting and email provider for the website and support. If you enable the relevant optional processing, Google Firebase Analytics and AppsFlyer may process analytics or attribution data. These providers receive only data relevant to their roles; we may also disclose data when required by law.

Some providers may process data outside the European Economic Area. Where a transfer requires protection under the GDPR, we rely on an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. Contact us for information about safeguards relevant to your data.

How long we keep data

We keep journal and account data while needed to provide the service and handle an active account, then delete or anonymise it when it is no longer needed, subject to backups and legal obligations. Subscription and transaction records may be kept for the periods required by tax, accounting or dispute rules. Support correspondence and technical logs are kept only as long as needed to resolve the request, maintain security or meet legal obligations. A copy exported to your device is controlled by you.

Your choices and rights

You can export your journal from the app. You may ask us to access, correct, erase or restrict your personal data, object to processing, or receive data in a portable format where the GDPR provides these rights. You can also withdraw consent for optional processing. Email support@cremanote.com to make a request; we may need information that lets us locate your anonymous account and verify the request. Removing the app from a device does not necessarily delete a cloud copy or subscription.

You may complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), or another competent EU/EEA data protection authority. We do not use your data for decisions based solely on automated processing that have legal or similarly significant effects.

Changes

We may update this policy as the service changes. We will post the current version here and update its effective date. Material changes will be communicated where required by law.