Privacy Policy

Last Updated: 17.06.2026

1. General information

This Privacy Policy describes how we collect, use, and protect your personal information when you use our mobile application and website Spanage (the „App”, „Service”).

Data Controller:

  • Company: Spanage Sp. z o.o.
  • Address: UL. PIEKOSZOWSKA 47 / 56, 25-735 KIELCE
  • Contact Email: contact@spanage.app

We process your personal data based on:

  • GDPR Art. 6(1)(a) – Consent (newsletter, analytics)
  • GDPR Art. 6(1)(b) – Contract performance (providing app services)
  • GDPR Art. 6(1)(f) – Legitimate interest (security, service improvement)
  • GDPR Art. 9(2)(a) – Explicit consent for health data processing

3. What data we collect

3.1 Data you provide:

  • Registration data: email address, first name, last name
  • Health data: information from Health Connect/HealthKit (physical activity, sleep, health metrics)
  • Calendar data: information from Google Calendar (with your permission)
  • Communication data: messages sent to AI features

3.2 Data collected automatically:

  • Technical data: IP address, device type, operating system, app version
  • Analytics data: app usage patterns (Firebase Analytics, Google Analytics)
  • Cookies: on our website to improve functionality

3.3 Sensitive data:

The App processes health-related data (GDPR Art. 9). Processing is based on your explicit consent.

4. Purpose of data processing

We process your data to:

  • Provide app services – personalized wellness content using AI
  • Authentication and authorization – through Firebase Authentication
  • Send newsletters – information about the app and wellness content
  • Analytics and service improvement – Google Analytics, Firebase Analytics
  • Ensure security – protection against abuse
  • AI communication – anonymized data sent to Google Gemini LLM

5. Sharing data with third parties

5.1 Third parties:

  • Google/Firebase – authentication, analytics, data storage
  • Google Gemini LLM – processing anonymized data for AI responses
  • Technical service providers – hosting, technical support

5.2 Sharing principles:

  • We do not sell your personal data
  • Data is shared only to the extent necessary for service provision
  • All third parties are required to protect your data
  • Data sent to AI is anonymized

6. Data retention period

  • Account data: until account deletion or consent withdrawal
  • Analytics data: according to Google Analytics policy (default 26 months)
  • Newsletter: until unsubscription or consent withdrawal
  • Offline data: stored locally on device until app deletion

7. Your rights

Under GDPR, you have the right to:

  • Access your personal data
  • Rectify incorrect data
  • Erase data („right to be forgotten”)
  • Restrict processing
  • Data portability
  • Object to processing
  • Withdraw consent at any time

To exercise your rights, contact us at: contact@spanage.app

8. Data security

We implement appropriate technical and organizational measures:

  • Data encryption during transmission (HTTPS/TLS)
  • Firebase Security Rules – access control to data
  • Regular security updates
  • Limited access to personal data
  • Monitoring of potential threats

9. Children’s data

9.1 Users under 16 (EU/GDPR):

Processing data of children under 16 requires parental/guardian consent.

9.2 Users under 13 (US/COPPA):

Collecting data from children under 13 requires verifiable parental consent.

9.3 Procedures:

  • We require age verification during registration
  • For minors, we require parental/guardian contact
  • Parents can request access, modification, or deletion of their child’s data

10. International data transfers

Your data may be transferred to countries outside the EU/EEA:

  • Google (USA) – based on appropriate safeguards (Google Cloud Data Processing Terms)
  • Protection mechanisms: standard contractual clauses, security certifications

11. Cookies

11.1 We use cookies on our website:

  • Necessary – website functionality
  • Analytics – Google Analytics
  • Preferences – remembering settings

You can manage cookies in your browser settings. Disabling some cookies may affect website functionality.

12. Changes to privacy policy

We will notify you of any changes to this Policy through:

  • Updates on our website
  • In-app notifications
  • Email (for significant changes)

13. Contact

For matters regarding personal data protection, contact us:

  • Email: contact@spanage.app
  • Address: Spanage Sp. z o.o., UL. PIEKOSZOWSKA 47 / 56, 25-735 KIELCE

14. Supervisory authority

14.1 EU Users:

If you have concerns about data protection, you can file a complaint with: Personal Data Protection Office (Poland)

Or your local data protection authority in your EU country.

14.2 US Users:

For US-related privacy concerns, you can contact: Federal Trade Commission (FTC)

  • Website: ftc.gov
  • Phone: 1-877-FTC-HELP (1-877-382-4357)

15. California privacy rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • Right to know what personal information is collected
  • Right to delete personal information
  • Right to opt-out of the sale of personal information (we do not sell data)
  • Right to non-discrimination for exercising your privacy rights

16. COPPA compliance

We comply with the Children’s Online Privacy Protection Act (COPPA):

  • We do not knowingly collect personal information from children under 13 without parental consent
  • Parents can review, delete, or refuse further collection of their child’s information
  • We do not condition participation on disclosure of more information than necessary

17. Health data specific provisions

17.1 Health Information Processing:

  • Health data is processed with your explicit consent
  • You can withdraw consent for health data processing at any time
  • Health data is used solely for wellness recommendations and app functionality

17.2 Integration with Health Platforms:

  • iOS HealthKit: governed by Apple’s privacy policies
  • Android Health Connect: governed by Google’s privacy policies
  • We access only data you explicitly authorize

By accepting this Privacy Policy, you confirm that:

  • You have read and understood its content
  • You consent to the processing of your personal data as described
  • If you are a minor, you have parental/guardian consent