Privacy Policy

The Plavni platform (the plavni.com website and the related apps, hereinafter the “Service”) is operated by a private individual in Ukraine (“we”, “Plavni”). We are the owner (controller) of your personal data within the meaning of the Law of Ukraine “On Personal Data Protection” and, where it applies, of the EU General Data Protection Regulation (GDPR).

For privacy matters, write to [email protected]. Full details of the personal data owner are provided on request at the same address.

We process only the data needed to run the Service:

• Account data: email, password (stored only as a cryptographic hash — we never see it), name, unique handle (@handle) and, if you wish, an avatar, bio, region and interface language. If you sign in with Google, all we receive from Google is your name, email and a technical account identifier; your Google password is never shared with us.
• Content you create: reviews, catch logs (species, weight, photos, date), private map points, comments in groups, your “Favourites” list, group memberships and invitations. Content with public visibility is shown to other users together with your handle and avatar; private points and “group only” content are visible solely to you or to the members of the relevant group.
• Precise location: if you attach coordinates to a catch, a review or a point — only with your browser’s or device’s permission. Coordinates are needed to place the item on the map and to award the “Verified visit” badge. You can withdraw the permission in your browser settings at any time.
• Technical data: IP address, device and browser type, request and error logs — for security and diagnostics.
• Push notifications (mobile app): if you have allowed notifications, we store a technical token for your device in order to deliver them. Notification categories can be switched on and off in your profile settings; the token is deleted when you sign out or revoke the permission on your device.
• Beta testing requests: the email address and platform you submit in the form on the “Beta test” page are used only to invite you to test the app (TestFlight or an APK build) and are deleted on request.
• Analytics: we use our own (self-hosted) Umami analytics on our servers. It uses no cookies, builds no profiles and collects no personal identifiers — only anonymised statistics on visits and events (which pages and features are popular). We do not share this data with third parties.
• Cookies: see the Cookie Policy. Strictly necessary cookies are required to sign in; optional ones are set only with your consent.

We do not collect special categories of data (race, health, political opinions and the like) and do not ask you to provide them.

• Providing the Service (creating an account, displaying the map and content, running groups) — performance of a contract, Art. 6(1)(b) GDPR.
• Consent — optional cookies and access to precise location, Art. 6(1)(a). Consent can be withdrawn at any time.
• Legitimate interests — security, prevention of fraud and abuse, anonymised cookieless analytics, basic diagnostics and improvement of the Service, Art. 6(1)(f).
• Legal obligations — where required by law, Art. 6(1)(c).

We do not sell your data. To keep the Service running we engage trusted third-party providers (processors) that handle data only on our instructions and only to the extent required — in particular for hosting and the database, storage of uploaded photos, sending service emails and error diagnostics. Product analytics is self-hosted, so that data is not shared with third parties.

If a processor handles data outside the EU or Ukraine, we rely on appropriate safeguards (the EU Standard Contractual Clauses or an adequacy decision). We may also disclose data upon a lawful request from public authorities.

• Account data and your content — for as long as the account exists.
• After the account is deleted — erased within 30 days, except for data the law requires us to keep longer.
• Backups are rotated and purged within roughly 30 days.
• Security and request logs — up to 12 months; error logs — up to 90 days.

Under the GDPR and Ukrainian law you have the right to:

• access your data and obtain a copy of it (Art. 15, 20);
• rectify inaccurate data (Art. 16);
• have your data erased — the “right to be forgotten” (Art. 17);
• restrict or object to processing (Art. 18, 21);
• withdraw a consent you have given — without affecting processing carried out before the withdrawal.

You can delete your account yourself in the app: Profile → Delete account. You then have 30 days to restore it (simply sign in again); after that the account and personal data are permanently erased, while your reviews and catches are anonymised (detached from you and marked as “Deleted user”). To exercise the other rights, write to [email protected]. You also have the right to lodge a complaint with a supervisory authority — in Ukraine this is the Ukrainian Parliament Commissioner for Human Rights, and in the EU the national data protection authority of your country of residence.

Passwords are stored as hashes; connections are encrypted (HTTPS); access to data is restricted. No system is absolutely secure, so 100% safety cannot be guaranteed, but we follow industry practice and notify about incidents where the law requires it.

The Service is not intended for persons under 16, and we do not knowingly collect their data. If you believe a child has provided us with data without parental consent, write to us — we will delete it.

If you use the Plavni mobile app, this same policy applies. On the app listing we disclose our data collection in line with the requirements of Apple (Privacy Nutrition Labels) and Google (Data Safety). We do not track you across other apps and websites for advertising. Location, camera and photo library are used only with the system’s permission and only for the features described in the permission prompt; push notifications are optional. Beta versions of the app (in particular via TestFlight) may additionally send us crash reports for diagnostics.

We may update this policy. We will announce material changes in the Service or by email. The date at the top shows the latest update.

The administrator of the Plavni Service, Ukraine. Email: [email protected]. Full details of the personal data owner are provided on request.