Privacy Policy

Last updated: October 6, 2026

Pakaya is a mobile and web app for creating and organizing checklists for your plans — jobs at a client's and trips — with notes and optional sync across devices. This privacy policy describes what data the App ("the App", "we") collects and processes, on what legal basis, and what rights you have as a user.

1. Data controller

The data controller can be contacted at: contact@pakaya.app.

2. Legal basis for processing

We process your data based on:

• Art. 6(1)(b) GDPR (performance of a contract) — to the extent necessary to provide the account and cross-device sync feature you opt into by creating an account;
• Art. 6(1)(f) GDPR (legitimate interest) — for technical data collected via Sentry and sync diagnostics, necessary to detect errors and maintain the App's stability, and for the Cloudflare Turnstile check that protects sign-in from bots.

Data you enter locally (without an account, in offline mode) is never processed by us at all — it stays exclusively on your device.

3. What data we collect

a) Account (optional) — The App works fully without creating an account (local/offline mode). If you choose to create an account to sync data across devices, we collect only your email address and your password (stored hashed, never in plain text). You can also sign in with Google or Apple instead. Then we receive from them your email address, your account identifier with that provider and — if they share it — your name; we never receive your Google or Apple password. If you choose "Hide My Email" when signing in with Apple, Apple gives us a relay address (…@privaterelay.appleid.com) and our emails (e.g. a password reset) reach you through Apple. An account created with a relay address is a separate account — it is not linked to an account created with your real address.

b) The content of your plans — if sync is enabled, the following data you enter is stored on our server: plan names, checklists and their contents, free-text notes (e.g. booking references, directions), and participant details you enter manually — name, color, and optionally a broad age range (e.g. "school-age child"). The areas you joined, the area you are in and the specializations you selected under “What do you do?” are stored as well. So are a plan's location and dates, your saved templates and your travel preferences. In a plan's name, location and notes you may choose to enter details of other people, for example a client's name or address. The App does not require it; if you do, they are stored as part of the content of your plan. Participants are not separate accounts — they are information about the participants of your plans (including children) that you, the account holder, enter for your own planning. Children never create accounts or log in to the App themselves.

c) Technical data (app stability) — we use Sentry to detect application errors and crashes so we can fix them. Only technical information is collected (error type, application context, and the kind of device, operating system and browser in use) — never the content of your personal data or checklists. If you are signed in, a report may carry your account's random identifier (never your email address). Error reports are deleted automatically after 90 days at the latest. If you have an account with sync enabled, the App also stores technical sync diagnostics with your account on our server (technical event records and counters, tagged with a random identifier of the app installation so problems on different devices can be told apart — no names or list content), deleted together with the account.

d) Bot protection — when you sign in, create an account or reset your password, the form is protected by Cloudflare Turnstile. To tell people from bots, Cloudflare processes technical data such as your IP address and browser or device characteristics. We receive only the check result.

4. Where data is stored

Locally on your device — always, regardless of whether you have an account (SQLite database on mobile / browser storage on web). This lets you use the App offline. On our server — only if you have an account and sync enabled. We use Supabase, with servers located in the European Union.

5. Do we share data with third parties

We do not sell or share your data with third parties for marketing or advertising purposes. We only use technical services necessary for the App to function: Supabase (account data storage and sync), Vercel (web version hosting), Sentry (error reports) and Cloudflare (Turnstile bot protection on sign-in). In the web version, the sign-in form loads Google's and Apple's sign-in libraries as soon as it opens, so your browser downloads them from those companies' servers — even if you then sign in with email. We receive data from your Google or Apple account only after you choose that provider and confirm the sign-in; Google and Apple act as independent controllers of your sign-in data under their own terms. The App contains no ads or advertising trackers, and does not set cookies itself.

6. Your rights (GDPR)

As we process data of EU individuals, you have the right to:

• access your data,
• rectify inaccurate data,
• delete your account and all associated data — you can do this yourself in App Settings ("Delete account" button), which permanently removes data from our servers, or request it without the App — see Delete your account. If your account uses Sign in with Apple, deleting it also revokes Pakaya's access in Apple; if that fails, we show you how to revoke it yourself,
• data portability — the App lets you export a plan's data to a file,
• object to processing,
• lodge a complaint with your national data protection authority (in Poland: UODO) if you believe your rights have been violated.

7. Children

The App is not directed at children and does not collect data directly from children — children never create accounts or log in. Data about children (name, approximate age) may only appear as information entered by an adult user (parent/guardian) about a participant of a plan.

8. Changes to this policy

We may update this policy periodically. We will notify you of material changes within the App.

9. Contact

Privacy questions: contact@pakaya.app.