Privacy Policy of the SELAH – Focus and Prayer Mobile Application

1. General information

This Privacy Policy explains how the SELAH – Focus and Prayer mobile application processes Users' personal data.
The data controller is MODERN COMMUNICATION SYSTEMS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Poznań, at ul. Jeleniogórska 16, 60-179 Poznań, Poland, KRS: 0000441265, NIP: 7773228737, REGON: 302284564, hereinafter referred to as the “Controller”.
The Controller may be contacted at: MCS_KONTAKT@HOTMAIL.COM.
The same e-mail address may be used for privacy and personal data matters: MCS_KONTAKT@HOTMAIL.COM.
If the Controller appoints a Data Protection Officer, their contact details will be indicated in this Privacy Policy.
This Privacy Policy applies to Users from Poland, the European Economic Area, the United Kingdom, Switzerland and the United States, subject to the local differences described below.

2. Key information

The Application does not require the User to create an account or provide an e-mail address.
The Application is a timer for focus, prayer, silence, reflection, study or personal work.
The Application may generate basic statistics concerning sessions, such as the number of sessions, completed sessions, focus time, average session duration, streaks or achievements.
Payments are processed by the App Store or Google Play and technically supported by RevenueCat.
The Controller does not process the User's full payment card details.
The Application may process technical identifiers, purchase and subscription status, diagnostic data, crash data and analytics data.
The User has rights under GDPR, including the right of access, rectification, erasure, restriction, objection, data portability and the right to lodge a complaint with a supervisory authority.

3. Data we may process

Technical and identification data: Application installation identifier; pseudonymous User identifier; device model, operating system, Application version, language and country; IP address and approximate location inferred from the IP address; technical logs and system events.
Data concerning use of the Application: number of sessions; session duration; completed or interrupted sessions; selected timer settings; use of selected functions; information about errors, crashes and performance; premium entitlement or limit status.
Statistics and progress data: number of focus sessions; total focus time; average session duration; streaks, achievements and activity history; reports generated by the Application.
Purchase and subscription data: subscription status; product type; start and end date of the subscription; transaction identifier; store where the purchase was made: App Store or Google Play; technical data processed by RevenueCat.
Contact data, if the User voluntarily provides it: e-mail address; name or identifier; content of a message, complaint or support request.
Consent and preference data: privacy consents; notification settings; analytics or marketing consents, if used; privacy preferences.

4. Data we do not require

The Application does not require the User to provide an e-mail address.
The Application does not require the User to create a personal account.
The Application does not require the User to provide their real name.
The Application does not require the User to provide religious affiliation, health data, biometric data, document numbers or payment card details.
The User should not send sensitive data, passwords, document numbers, card details, health data or data of third parties through support channels.

5. Purposes and legal bases of processing under GDPR

Providing the SELAH service, including the timer, session settings and basic functions — performance of a contract or steps taken prior to entering into a contract.
Displaying statistics, reports and achievements — performance of a contract or legitimate interest in providing and improving the service.
Managing subscriptions and premium access — performance of a contract.
Handling complaints, support requests and communication — performance of a contract, legal obligation or legitimate interest.
Security, fraud prevention and protection of claims — legitimate interest.
Analytics, diagnostics, crash reporting and performance improvement — legitimate interest or consent, depending on the configuration and legal requirements.
Compliance with tax, accounting and legal obligations — legal obligation.
Marketing of the Controller's own services, if used — consent or legitimate interest, depending on the communication channel and applicable law.

6. Payments, App Store, Google Play and RevenueCat

Payments in the Application are processed by Apple App Store or Google Play.
RevenueCat is used to technically manage purchase, subscription and premium entitlement information.
The Controller may receive from RevenueCat or app stores information such as: subscription status; transaction identifier; purchased product type; renewal, expiry or cancellation date; country or store of purchase; pseudonymous User identifier.
The Controller does not receive the full payment card number.
Subscription management, cancellation, refunds and payment complaints may be handled through the User's Apple ID or Google Play account.

7. Notifications

The Application may send push notifications if the User grants permission in the device settings.
Notifications may relate to session completion, breaks, reminders, achievements, Application functions or technical information.
The User may disable notifications at any time in the iOS or Android system settings.

8. Analytics and diagnostics

We may analyse the way the Application is used in order to improve stability, security and functionality.
Analytics data may include technical information, events in the Application, errors, crashes and performance data.
If applicable law requires consent for certain types of analytics, we will ask the User for such consent.
The User may be able to change privacy preferences in the Application or device settings.

9. External providers

Data may be transferred to the following categories of recipients: hosting and cloud infrastructure providers; Apple and Google for app distribution, payments, diagnostics and store services; RevenueCat for subscription and entitlement management; analytics providers, if used; crash reporting and error monitoring providers, if used; customer support providers, if used; legal advisers, accountants and public authorities where required by law.
Implementation note: before publication, the Controller should list the actual providers used by the Application, for example RevenueCat, Firebase, Google Analytics for Firebase, Sentry, Supabase, AWS, Google Cloud, Azure or other tools, if applicable.

10. International data transfers

Data may be processed outside the European Economic Area, in particular where we use technology providers located in the United States or other countries.
In such cases we apply mechanisms required by GDPR, in particular: an adequacy decision of the European Commission, if applicable; Standard Contractual Clauses; additional organisational and technical measures where required.
The User may contact the Controller to obtain more information about safeguards used for international data transfers.

11. Data retention

Technical logs and diagnostic data — for the period necessary for security, diagnostics and proper operation of the Application, usually up to 12 months.
Local session statistics — for as long as they remain stored in the Application or on the User's device, unless deleted earlier.
Subscription data — for the duration of the subscription and for the period necessary for settlements, complaints and claims.
Support and complaint data — for the period required to handle the matter and for the limitation period for claims.
Accounting and tax data — for the period required by law.
Data processed on the basis of consent — until consent is withdrawn, unless another legal basis applies.

12. User rights

Right to access their data.
Right to rectify their data.
Right to erase their data.
Right to restrict processing.
Right to data portability.
Right to object to processing.
Right to withdraw consent at any time, where processing is based on consent.
Right to lodge a complaint with a supervisory authority. In Poland, the supervisory authority is the President of the Personal Data Protection Office.
Requests may be sent to: MCS_KONTAKT@HOTMAIL.COM.

13. Minors and children

Minors may use the Application only with the consent of a parent or legal guardian, where such consent is required by law.
In the European Union, the processing of a child's personal data in relation to information society services requires parental consent if the child has not reached the age specified by the law of the relevant Member State.
In Poland, the age for independent consent in information society services is 16.
In the United States, the Children's Online Privacy Protection Act may apply if the Application is directed to children under 13 or if the Controller has actual knowledge that it collects personal data from children under 13.
A parent or legal guardian may contact the Controller to request access to, deletion of or restriction of the processing of a child's data.
If the Controller learns that it has processed data of a child without the required consent, it may delete the data or take other appropriate measures.

14. Automated processing

The Application may automatically process technical data, session data and subscription data in order to provide the timer, statistics, reports, achievements and premium access.
The Application does not make decisions that produce legal effects concerning the User or similarly significantly affect the User within the meaning of GDPR.
Statistics, achievements and reports are informational and motivational only.

15. Security

We apply technical and organisational measures intended to protect data against unauthorised access, loss, alteration or disclosure.
These measures may include encrypted transmission, access control, pseudonymisation of identifiers, monitoring of errors and abuse, and limiting access to data to persons and providers who need it.
No method of transmission or storage of data is completely risk-free.

16. Marketing and advertising

If the Application uses marketing, advertising or tracking technologies, the User will be informed in accordance with applicable law and platform requirements.
If required by law or Apple/Google policies, the User will be asked for consent.
The User may limit advertising tracking in the iOS or Android system settings.
If the Application does not use behavioural advertising, the following statement applies: the Application does not display behavioural advertising and does not sell Users' personal data to advertisers.

17. Users from California and other US states

If the User is a resident of California or another US state with applicable privacy laws, the User may have additional rights, including the right to know, access, delete, correct and opt out of certain data sharing or sale practices, where applicable.
The Controller does not sell personal data in the traditional meaning of the term.
If the Application uses advertising technologies that may be considered a “sale” or “sharing” under applicable US privacy laws, the User will be provided with an appropriate opt-out mechanism.
Privacy requests may be sent to: MCS_KONTAKT@HOTMAIL.COM.

18. App Store and Google Play

The Application is distributed through the App Store and Google Play.
Apple and Google may process the User's data in accordance with their own terms and privacy policies.
The Controller is not responsible for independent actions of Apple or Google as separate data controllers.
The User should review the privacy settings of their Apple ID or Google account.

19. Changes to this Privacy Policy

This Privacy Policy may be amended in particular in the event of: changes in law; changes in Application features; changes in technology providers; changes in data processing practices; requirements of the App Store, Google Play or supervisory authorities.
Users will be informed of material changes in the Application or by another available method.
The current version of the Privacy Policy will be available in the Application or on a website.

20. Contact

For privacy, personal data, Application, complaint or subscription matters, please contact: MCS_KONTAKT@HOTMAIL.COM.