Scrollingo Privacy Policy

Version 1.0 • last updated 6 November 2026

This privacy policy (the “Policy”) sets out the rules for processing personal data in connection with the use of the Scrollingo mobile app (the “App”) and the scrollingo.app website (the “Website”). Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”).

1. Controller

1. The controller of personal data is Damian Płatek, doing business as IntellisoTech Damian Płatek, ul. Wizjonerów 6/180, 31-356 Kraków, Poland, tax ID (NIP) 9442201088, REGON 369437231 (the “Controller”).
2. In matters concerning personal data, the Controller can be contacted by email at support@scrollingo.app or by post at the address given in paragraph 1.

2. Categories of data processed

The Controller processes the following categories of data:

• Subscription data: a random, anonymous identifier assigned by the App (shown in the App’s Settings as “Support ID”), App Store transaction information (product, purchase and renewal dates, price, currency, store country, free trial) and basic technical data transmitted when the Subscription is verified (device model, iOS and App version, language, IP address).
• Correspondence data: email address, message content and attachments, where the User contacts the Controller. A message sent from the App (Settings → Support) includes the support ID, the App and iOS versions and the device model; this data is visible in the message and may be deleted before sending.
• Website technical data: IP address and technical request data (in particular browser type and time of visit), processed in connection with displaying the Website.
• Information provided by Apple: aggregate download and sales statistics and, where the User has consented in iOS settings (“Share with App Developers”), crash reports and diagnostic data. This information does not allow the User to be identified.

3. Data stored only on the device

1. The App stores on the User’s device the selected language and level, settings (number of flashcards, unlock duration, Strict Mode, theme, reminders), progress (experience points, streaks, quests, history of unlocks and attempts to open blocked apps) and Subscription status.
2. The data referred to in paragraph 1 is not transmitted to the Controller or to third parties. The Controller has no access to it. Where iCloud Backup is used, this data may be included in the device backup under Apple’s terms.
3. The User selects the apps to block in Apple’s system picker. The App receives only encoded tokens from iOS and does not learn which apps have been selected.
4. Notifications and the Lock Screen countdown are scheduled locally on the device. Word pronunciation is performed by the iOS speech synthesizer on the device.
5. The App does not use location, contacts, the microphone, the camera or photos.

4. Purposes and legal bases of processing

Personal data is processed for the following purposes:

• providing services under the Subscription (verifying its status, restoring purchases) – under Article 6(1)(b) GDPR (performance of a contract);
• responding to correspondence and handling complaints and withdrawal statements – under Article 6(1)(b) and (c) GDPR (performance of a contract, legal obligation) and, for other correspondence, under Article 6(1)(f) GDPR (the Controller’s legitimate interest in responding);
• displaying the Website and protecting it against attacks – under Article 6(1)(f) GDPR (the Controller’s legitimate interest);
• fixing App errors on the basis of crash reports provided by Apple – under Article 6(1)(f) GDPR (the Controller’s legitimate interest);
• complying with tax and accounting obligations – under Article 6(1)(c) GDPR (legal obligation);
• establishing, pursuing and defending legal claims – under Article 6(1)(f) GDPR (the Controller’s legitimate interest).

5. Analytics and tracking

1. The App contains no third-party analytics or advertising tools, does not use the advertising identifier and does not track the User’s activity across other apps or websites.
2. The Website does not use cookies, analytics tools or advertising pixels. Only the selected Website language is stored in the browser.

6. Recipients of data

1. Personal data may be disclosed to:
   • RevenueCat, Inc. (United States) – a processor acting on behalf of the Controller for Subscription verification and restoration;
   • Cloudflare, Inc. (United States) – provider of Website hosting and protection services;
   • OVH SAS (France) – provider of email services;
   • an accounting office – to the extent necessary to keep accounting records;
   • public authorities – where required by law.
2. Apple Distribution International Ltd. (Ireland) and other Apple group companies process data in connection with App distribution, payments and Subscription billing as separate controllers, under Apple’s Privacy Policy. The Controller does not receive the User’s payment card data or Apple Account data such as name or email address.
3. The Controller does not sell personal data and does not share it for marketing purposes.

7. Transfers to third countries

1. RevenueCat, Inc. and Cloudflare, Inc. are established in the United States.
2. Transfers to Cloudflare, Inc. are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, in which Cloudflare, Inc. participates.
3. Transfers to RevenueCat, Inc. are based on the standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR), included in the data processing agreement.
4. A copy of the safeguards referred to in paragraphs 2 and 3 may be obtained by contacting the Controller.

8. Retention periods

• Data stored on the device: until the User deletes the App.
• Subscription data: for the duration of the Subscription and thereafter until the expiry of limitation periods for claims and periods required by tax law. At the User’s request, the data may be deleted earlier, unless the law requires it to be retained.
• Correspondence data: until the matter is closed and thereafter until the expiry of limitation periods for claims.
• Website technical data: for the period set by Cloudflare, Inc. that is necessary to operate and secure the Website.

9. Rights of data subjects

1. The User has the right of access to their data and to obtain a copy, the right to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on the Controller’s legitimate interest.
2. To exercise these rights, the User should contact the Controller at support@scrollingo.app. As the Controller holds no data identifying the User, for matters concerning Subscription data the Controller may ask for the support ID available in the App (Settings → Support ID). The User deletes data stored on the device by deleting the App.
3. The Controller responds without undue delay and in any event within one month of receiving the request.
4. The User has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority in the country of their residence.
5. Users outside the European Union also have the rights granted by the laws of their country. The Controller does not sell personal data and does not share it for cross-context behavioural advertising.

10. Minors

1. The App is intended for persons aged 13 and over. Minors use the App with the knowledge and consent of a parent or legal guardian, in accordance with the Terms of Use.
2. The Controller does not direct marketing at children and does not knowingly collect data that identifies a child.
3. A parent or legal guardian who becomes aware that a child has provided personal data to the Controller may request its deletion.

11. Profiling

The Controller does not profile Users and does not make decisions based solely on automated processing that produce legal effects concerning the User or similarly significantly affect them. Flashcards are selected on the User’s device solely for learning purposes.

12. Data security

The App communicates with external services only over encrypted connections (TLS). Data stored on the device is protected by iOS mechanisms, including device encryption. Access to the email and service dashboards used by the Controller is secured and limited to the Controller.

13. Changes to the Policy

1. The Controller may amend the Policy, in particular in the event of changes to the App’s features or to the law.
2. The amended Policy is published on the Website, and the Controller announces significant changes in the App.
3. The date of the last update is indicated at the beginning of the Policy.