Privacy policy

1. Data Controller

The Data Controller of your personal data pursuant to Regulation (EU) 2016/679 (GDPR) is: Jakub Gabrychowicz, sole trader operating as JAKUB GABRYCHOWICZ GameGoods, ul. Łęczycka 15/1, 99-340 Krośniewice, Poland, registration details: NIP: 7752647541, REGON: 360765637, CEIDG: wpis w rejestrze prowadzonym przez ministra właściwego do spraw gospodarki.

For any data protection queries, requests to exercise rights, or consent withdrawal, contact us at: kontakt@yourpet.pl or via the contact form.

2. What Data We Collect and Process

We process only the data strictly necessary for our services:

• Account Data: email address or mobile phone number (when you sign up with a number), username / display name, and an encrypted password hash (passwords are never stored in plaintext). We only send one-time SMS codes to the phone number - when you create the account and when you change your password; never advertising.
• Sign-in with Google (optional): when you sign in with a Google account, we receive the name, email address and profile picture of that account from Google, and we also store the Google account identifier and sign-in tokens (limited to that basic profile) needed for later sign-ins. We never receive the Google account password.
• Referrals and the creator programme: the referral code assigned to the account and which referral code an account was created or a purchase was paid with (to calculate the creator’s commission). A creator only sees how many people they referred, never their data.
• Pet and Artwork Data: pet name, species, uploaded photos, and generated 2D models, images and animations.
• Profile picture (optional): a photo you choose as the account avatar, scaled down to about 256 px, visible only to you and deleted with the account.
• Gameplay and Progress Data: pet level, health, energy, happiness stats, virtual coins, inventory and mini-game scores.
• Transactional Data: Paws purchase history - on the website, Przelewy24 payment amounts and identifiers (credit card details are never stored by us; they are handled directly by certified provider Przelewy24); in the mobile app, the store transaction ID, the product bought, the number of Paws and the date - plus the history of spending Paws and buying packages. We never receive card details or Apple or Google account data.
• Mobile app technical data: device and operating system type and the app version - sent when connecting to our server and when checking for updates. Used to run the app, deliver its updates and handle support requests.
• Data stored on the device (mobile app): play progress and settings (app storage) and the sign-in token (the system secure store - Keychain on iOS, Keystore on Android). Deleting the app removes the progress and settings; the sign-in token is removed by signing out or deleting the account (on iOS the system secure store may keep it after the app is uninstalled).
• Sign-in session data: the IP address and browser/device information recorded at each sign-in. They serve account security only (spotting an unusual login, defending against account takeover) and are deleted automatically once the session expires.
• In-app activity history: the start and end times of visits (including how you signed in and whether you signed out), the type of device and browser - without the IP address - and the mini-game rounds played (game, pet, start and end time, score). Only the Controller can see it; it is not used for profiling or advertising.
• Cookie consent register: a random decision ID, timestamp, document version and a truncated IP address (IPv4 without the last octet, IPv6 to /64) - with no browser information and no account identifier.
• System logs and error reports: technical records of the server and hosting provider, needed to detect failures and abuse. When the website or the app crashes, it sends the error message and the name of the screen where it happened (without account data and without the IP address) - used only to fix bugs and kept only in the server logs.

3. Purposes and Legal Bases for Processing

We process data based on the following GDPR legal grounds:

• Performance of a contract (Art. 6(1)(b) GDPR): account management, game synchronization, AI pet generation, Paws management (purchases on the website and in the mobile app, balance and history).
• Compliance with legal obligations (Art. 6(1)(c) GDPR): tax and accounting documentation, and proving valid consent under Art. 7(1) GDPR.
• Consent (Art. 6(1)(a) GDPR in conjunction with Electronic Communications / ePrivacy laws): newsletter subscriptions and analytics cookies (Google Analytics 4) - set only after you consent in the banner; you can withdraw that consent at any time under "Cookie settings" in the footer - and pet care reminders in the mobile app (only after you allow notifications; withdraw it in your phone settings).
• Legitimate interests (Art. 6(1)(f) GDPR): securing our systems against abuse and network attacks, maintaining platform stability, defending legal claims, and keeping an account activity history (visits and game rounds) to handle support requests, detect abuse and improve the games.

4. Special Protection of Children’s Data (GDPR Art. 8 & DSA Art. 28(2))

YourPet is designed as a safe digital playground for children and families. The account - and with it the consent to data processing - is created only by an adult (18 or older), usually a parent or legal guardian. This limit is higher than the 16 years of GDPR Art. 8, because the account holder also decides about purchases and about creating a pet with artificial intelligence. Therefore:

• Users under 18 use the platform on a parent’s or guardian’s account, with their knowledge and consent.
• The newsletter (signing up without an account) is open to people aged 16 or older (Art. 8 GDPR) - they confirm this on the page opened from the link in the activation email.
• There is no chat, private messaging or ability for strangers to contact children within the app.
• Prohibition of profiling (DSA Art. 28(2)): We strictly never profile children for behavioural advertising and never sell data to third parties.
• Parents may request access, rectification, or complete deletion of their child’s data at any time (see Parent Zone).

5. Who We Share Data With (Data Processors)

We entrust data only to trusted service providers operating under strict Data Processing Agreements (DPAs):

• Hosting and Edge Infrastructure: Vercel Inc. (USA – Standard Contractual Clauses / Data Privacy Framework); server functions run in the EU region (Ireland).
• Database and File Storage: Supabase Inc. / Amazon Web Services (EU servers – Ireland).
• AI Generation Engines: Google (Gemini API in a paid Google Cloud project; processing may also take place outside the EEA, including the USA) and Fal.ai Inc. (USA) - secure cloud processing; private photos are not used to train public models.
• Payment Gateway: PayPro S.A. (Przelewy24, Poland) – for processing Paws purchases on the website.
• In-app purchase processing: RevenueCat, Inc. (USA) - verifies Paws purchases in the App Store and Google Play; receives a pseudonymous YourPet Account identifier (no email address), the store transaction data and, like any server, the IP address and basic device data (model, operating system).
• Mobile app updates: 650 Industries, Inc. (Expo, USA) - the servers the app downloads updates from; when checking for updates they receive the IP address, operating system type, app version and a random installation identifier.
• Transactional Emails: Postmark (ActiveCampaign, LLC, USA) - system notices, password recovery, newsletter.
• SMS codes: LINK Mobility Poland sp. z o.o. (SMSAPI, Poland) - only one-time codes when you sign up with a phone number and when you change your password.
• Visit statistics (only with your consent): Google Ireland Ltd. (Google Analytics 4) - pseudonymous usage statistics (a random browser identifier, never linked to your account).

App stores: Apple (App Store) and Google (Google Play) process data related to downloading the app and paying in the store as independent controllers, under their own privacy policies, which you accept when you create a store account.

Sign-in with Google: if you choose to sign in with a Google account, Google Ireland Ltd. processes the sign-in data as an independent controller, under its own privacy policy.

Transfers outside the European Economic Area: some providers (Vercel, Google for the Gemini API, Fal.ai, Postmark, RevenueCat, Expo, and - with analytics consent - Google LLC for Google Analytics) operate from the USA or may process data in the USA. Those transfers rest on data processing agreements containing the European Commission’s Standard Contractual Clauses, or on the provider’s participation in the Data Privacy Framework. We transfer data to no other third country.

6. Data Retention Periods

We retain personal data only for as long as necessary:

• Account & Pet Data: for the duration of your active account. Upon deletion, data is permanently erased (GDPR erasure).
• Billing & Payment Records (including Paws purchases on the website and in the app): 5 years from the end of the tax year, in accordance with statutory tax laws.
• Cookie Consent Logs: up to 3 years to demonstrate compliance with supervisory authorities.
• Sign-in sessions (IP, browser): until the session expires (7 days); expired records are removed by a weekly housekeeping job.
• SMS code log: a cryptographic hash of the phone number and the sending time (without the code) - 30 days, to prevent abuse; older entries are removed by a daily housekeeping job.
• Activity history (visits and game rounds): 90 days; older records are removed by a daily housekeeping job, and deleting the account removes them at once.
• Contact form messages: for as long as handling the case and evidencing its resolution requires, and no longer than 3 years from the last correspondence.
• Newsletter Subscription: until consent is withdrawn via the unsubscribe link.

7. Your Rights Under GDPR

Data subjects have the following statutory rights:

• Right of access (Art. 15 GDPR): obtain confirmation and a copy of your personal data.
• Right to rectification (Art. 16 GDPR): correct inaccurate or incomplete data.
• Right to erasure / "to be forgotten" (Art. 17 GDPR): request permanent deletion of your account and data.
• Right to restriction of processing (Art. 18 GDPR): restrict processing in legally defined circumstances.
• Right to data portability (Art. 20 GDPR): receive your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3) GDPR): withdraw consent at any time without affecting prior lawful processing.

To exercise your rights, email us at: kontakt@yourpet.pl or use the contact form. You can also delete your account and data yourself in the mobile app: My panel → Account settings → Delete account.

8. Supervisory Authority Complaint

If you believe that the processing of your data infringes GDPR, you have the right to lodge a complaint with the competent supervisory authority:

Prezes Urzędu Ochrony Danych Osobowych (UODO)
Address: ul. Stawki 2, 00-193 Warszawa
Website: https://uodo.gov.pl

9. Cookies, Analytics and Consent Register

Essential cookies are always active (pursuant to statutory exemptions for strictly necessary technical storage) – they enable user authentication, session security, language persistence and cookie choices. They do not require consent and the service cannot function without them.

Analytics cookies (Google Analytics 4) are stored only after your prior, freely given consent (Art. 6(1)(a) GDPR and electronic communications regulations). Without consent the Google script is not loaded at all. The provider is Google Ireland Ltd.; we use it for pseudonymous visit statistics (a random browser identifier in the _ga cookie, no IP address in the reports: how many people visit, from which devices, which pages are used) so we can improve the service. Google advertising signals stay off (Google consent mode), we do not link the statistics to your account and we do not share them with ad networks. Data may also be processed by Google LLC in the USA under the Data Privacy Framework.

We do not use Meta Pixel or any marketing cookies. You can withdraw analytics consent at any time under "Cookie settings" in the footer - we then delete the _ga cookies and stop loading the Google script.

Consent Register (GDPR Art. 7(1)): When we do ask for cookie consent, to demonstrate its validity our server logs: a random consent ID, timestamp, policy version, choice state and a truncated IP address (IPv4 without the last octet, IPv6 to /64). Records are deleted after 3 years.

Browser storage (localStorage): besides cookies we keep your play progress in the browser (pet stats, backpack, mini-game results), sound settings and small view preferences. These are not tracking identifiers, they go to nobody outside us (for signed-in users they sync with the account so progress survives a change of device), and the game could not work without them. Clearing site data in your browser removes them immediately.

Mobile app: it does not use cookies, Google Analytics, advertising tools or the device advertising identifier (IDFA / AAID) and does not track you across apps. It may ask for two permissions: photos - only when you choose a pet photo or a profile picture yourself (the system picker, so the app gets only the chosen photo, with no access to the whole gallery) - and notifications - optional care reminders scheduled on the phone. The app does not use the camera, microphone, location or contacts.

Below is the complete declaration of all cookies used by this website:

10. International Standards: US (COPPA, CCPA) & UK

Children in the United States (COPPA - Children’s Online Privacy Protection Act): YourPet does not knowingly collect personal information from children under 13 in the United States without prior verifiable parental consent. If a parent or guardian discovers that their child under 13 has submitted personal information without consent, please contact us at kontakt@yourpet.pl and we will promptly delete such information.

California Residents (CCPA / CPRA): We affirm that YourPet does not sell personal information nor share it for cross-context behavioral advertising ("Do Not Sell or Share My Personal Information"). California residents have statutory rights to request information regarding categories of collected data, request deletion, request correction, and receive non-discriminatory treatment for exercising their privacy rights.

United Kingdom (UK Children’s Code / Age-Appropriate Design Code): We observe the UK ICO Children’s Code requirements: default high-privacy settings (privacy by default), no geolocation tracking, and absence of manipulative nudge techniques (dark patterns).

International Transfers: Data transfers outside the European Economic Area are governed by Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and the EU-US Data Privacy Framework (DPF).