1. Who is responsible
The controller of your personal data is Mateusz Janicki, an individual developer who publishes the Service under the name EVoApps as an unregistered activity (działalność nierejestrowana, art. 5 of the Polish Entrepreneurs' Law), address ul. Opacka 23/62, 80-330 Gdańsk, Poland, e-mail contact@evostickers.app. Write to this address for any question about your data or to exercise your rights.
2. What we process, why, and on which legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Your EVo account and sign-in (e-mail and password, Google or Apple), password-reset e-mails | E-mail, name, sign-in method, account id. If you sign in with Google or Apple, they tell us your e-mail address and name | Contract, Art. 6(1)(b) |
| Your EVoStickers profile and plan | Account id, e-mail, name, when the profile was created and changed, the number of saved stickers, the storage your attachments use, whether you have Pro and until when, graphics packs you own | Contract, Art. 6(1)(b) |
| Saved stickers ("My stickers") and keeping them in sync between your devices | What you put on a sticker: its name, layout, texts, time fields, QR code contents, frames and the paper it prints on, with the times it was created and changed | Contract, Art. 6(1)(b) |
| Attachments behind a sticker's QR code (Pro) | The files you upload (photos, PDF, text, audio, video), their names, types and sizes, the sticker they belong to and the upload time | Contract, Art. 6(1)(b) |
| Public share links (only when you create one) | The link's random token, the sticker it belongs to, the time it was created | Contract, Art. 6(1)(b) |
| Payments and subscriptions | Account id, purchase and subscription records (product, store, purchase date, end date, trial or paid period); card details are handled only by Google Play or Stripe, never by us | Contract, Art. 6(1)(b); keeping billing records: legal obligation, Art. 6(1)(c) |
| Support requests (when you write to contact@evostickers.app) | Your e-mail with its subject, text and attachment names; your name and e-mail address stay only in our mailbox. The text is recorded as a support ticket without your e-mail address, with e-mail addresses and long numbers (phones, account numbers, PESEL) in it removed | Our legitimate interest in answering you and fixing reported problems, Art. 6(1)(f), or the contract, Art. 6(1)(b), if you use EVoStickers. A person reads and answers every message; nothing is answered automatically |
| Security, preventing abuse, keeping the Service working | App integrity checks through Firebase App Check (Google Play Integrity in the Android app, reCAPTCHA Enterprise in the web app, which evaluates the browser and how the page is used), technical logs with the account id, IP address in server logs | Our legitimate interest in a secure service, Art. 6(1)(f) |
Providing account data is needed to use the Service. EVoStickers shows no ads and currently uses no usage statistics (analytics) and no crash reporting. We don't make decisions about you based solely on automated processing, and we don't sell your data.
3. Photos, attachments and share links
- Photos on a label stay on your device: the app stores a scaled-down copy there and syncs only a reference to it, not the photo. They are removed from the device when you sign out.
- Attachments (Pro) are uploaded to our storage and are private: only you can open them, signed in. A sticker's QR code is private by default; scanned by anyone else, it shows nothing.
- A public share link is made only when you choose it for a sticker. Anyone who has the link or scans its QR code sees the sticker's name and its attachments (names, sizes and the files, through links that work for 15 minutes). Such pages are not indexed by search engines. You can revoke the link at any time: it stops working at once, but copies someone already downloaded stay with them. Please don't attach other people's personal data to a public link unless you are allowed to share it.
4. Bluetooth, USB, camera and location
Printing happens on your device; we don't receive what you print. Bluetooth connects the app to label printers (in the web app through the browser's Web Bluetooth); the Android app can also use printers connected by USB. On Android 11 and older the system requires the location permission for Bluetooth scanning; the app does not collect your location. The app doesn't use the camera itself: photos and files are picked with your system's picker.
5. Storage on your device and in the browser
The app keeps what it needs to work on your device: the sign-in session, a copy of your stickers and their sync state, your photos (in the web app in the browser's IndexedDB), the paper and printer you chose and downloaded graphics packs and fonts. Signing out removes your stickers and photos from the device. The web app sets no advertising or analytics cookies; Google's reCAPTCHA (App Check, above) may set a security cookie needed to protect the Service. When you buy Pro on the web, the checkout is a page of RevenueCat and Stripe, which apply their own rules.
6. Who receives the data (processors)
We use these service providers, bound by data processing agreements, only for the purposes above:
- Google (Google Ireland Ltd. / Google LLC): Firebase - authentication (including Google sign-in), database and file storage (stored in Warsaw, Poland), Cloud Functions (Warsaw), hosting, App Check with Play Integrity and reCAPTCHA Enterprise; Google Play (Android purchases).
- RevenueCat (RevenueCat Inc., USA): managing subscriptions and purchases.
- Stripe (Stripe Payments Europe Ltd., Ireland, with Stripe Inc., USA): web payments.
- For support requests: Cloudflare (Cloudflare, Inc., USA) receives and forwards the e-mail, it is stored in our mailbox at Google (Gmail), and its text, without your e-mail address, is recorded as a ticket in a private repository at GitHub (GitHub, Inc., USA), where Claude by Anthropic (Anthropic Ireland, Ltd. / Anthropic PBC, USA) helps us categorise it and draft a reply or a fix.
If you choose Sign in with Apple, Apple (Apple Distribution International Ltd.) confirms your identity to us under its own privacy policy. People you give a public share link to receive what that link shows (section 3). Authorities receive data only where the law requires it.
7. Transfers outside the EEA
Some providers above process data in the USA. Such transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
8. How long we keep data
- Profile, saved stickers and settings: until you delete them or your EVoStickers data.
- Attachments: until you delete them, the sticker they belong to or your EVoStickers data. When Pro ends, your stickers and attachments are kept; you just can't add more past the free limit.
- Share links: until you revoke them or delete the sticker or your EVoStickers data.
- Billing records: as long as tax and accounting law requires (in Poland generally 5 years from the end of the year).
- Technical logs: for the retention period of Google Cloud Logging (30 days by default).
- Support requests: up to 12 months after the matter is closed, unless we need them longer to establish or defend legal claims.
- Recovery copies: deleted data and files can remain in our providers' recovery copies for up to 7 days before they expire.
9. Your rights
You have the right to access your data and receive a copy, to rectify it, to have it erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest.
- Copy of your data: write to us and we will send it to you.
- Delete your data: Settings > Delete my EVoStickers data (you confirm it by signing in again), or an e-mail to us. This deletes your saved stickers, attachments, share links and your EVoStickers profile, and your customer record at RevenueCat. It does not cancel a running subscription in Google Play or on the web: cancel it there (see the Terms).
- One EVo account for the EVoApps apps: EVoStickers, EVoShift and EVoLabels are all provided by us (EVoApps), and one EVo account (e-mail and password, Google or Apple sign-in) can sign you in to each of them. Each app keeps its own data and profile; EVoStickers doesn't see your data in the other apps, nor they yours here. Deleting your EVoStickers data keeps your sign-in if another EVoApps app still has a profile for it; otherwise the sign-in is deleted too. If your sign-in is deleted elsewhere, your EVoStickers data is deleted with it. A new password or sign-in method you set applies to all these apps.
We answer requests within one month. You can also lodge a complaint with the supervisory authority: in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority in your country of residence.
10. Security
Data is encrypted in transit and at rest by our providers; access is restricted by tested database and storage rules, so that only you can read your stickers and files. Files are never public: a share link only hands out short-lived links to them. If a breach affects your data in a way that is likely to result in a high risk, we will inform you without undue delay.
11. Children
The Service is not directed at children. We don't knowingly collect data from children under 16 without their parent's consent; if you believe a child has given us data, contact us and we will delete it.
12. Changes
We will update this page when the processing changes and show the new effective date; material changes will also be announced in the app.