Privacy Policy — Moje Szczepienia

Last updated: 2026-08-12 · Effective date: 2026-05-06

1. Who we are

Moje Szczepienia is a mobile vaccination organizer for families: a calendar, history, and reminders for vaccinations of family members. The app is informational and organizational only — it does not diagnose, treat, prevent illness, nor replace medical consultation. All vaccination entries are stored locally on your device in encrypted storage; no medical data is sent to our servers.

Data controller: Maciej Siemiński — the developer of Moje Szczepienia. Contact: mail@macsiem.dev

For the version of the app distributed via Google Play, the data controller is LICENCEPRO POLSKA Sp. z o.o., ul. Huculska 6, 00-730 Warszawa, Polska.

This Privacy Policy explains what personal data Moje Szczepienia processes, how, why, and what rights you have.

2. Plain-language summary

Moje Szczepienia is a personal vaccination organizer — vaccination records stay on your device in encrypted local storage. We do not run a server that stores your medical data. We use Unity Ads (only on the Settings screen, never on health-data screens), Sentry for crash reporting, optional sync to your own iCloud / Google Drive, and Apple / Google billing for in-app purchases. The app is not a medical device and does not provide diagnosis, treatment, or medical recommendations. You have full GDPR rights including access, deletion, and portability — most exercisable directly in the app.

3. Data we process

3.1 Local-only data

Vaccination data (family member profiles, vaccinations, dates, notes, photos of the vaccination booklet/sticker) are stored only locally on your device, in encrypted MMKV storage (key generated randomly and kept in Apple Keychain / Android Keystore). We never send this data to our servers or to any third party.

3.2 Optional sync (your own iCloud / Google Drive)

Moje Szczepienia may offer optional sync between your own devices using your own iCloud (iOS) or Google Drive AppFolder (Android) accounts. Your data stays on your Apple / Google account — it never reaches our servers. The app stores data in the dedicated AppFolder area, which is private to the app and accessible only by you. You can disable sync at any time in Settings; disabling sync stops further uploads but does not delete content already in your iCloud / Google Drive.

3.3 Diagnostic data (Sentry)

Moje Szczepienia integrates Sentry (sentry.io) for crash and error reporting. Sentry collects:

• error stack traces (crash logs),
• device info (model, OS version, locale),
• app version and build number.

Sentry does not collect your content (entries, files, vaccination records, photos, archives), usernames, or other PII. Diagnostic data is retained by Sentry for up to 90 days.

3.4 Advertising (Unity Ads)

Moje Szczepienia shows non-invasive ads on Settings only (no ads on vaccination data screens). Ads are delivered by Unity Ads, whose SDK collects:

• the Advertising ID (Android Advertising ID / Apple IDFA), shared with Unity Ads to serve ads;
• diagnostic data (device model, country-level location, language).

Default mode is non-personalized ads. On iOS, the App Tracking Transparency (ATT) prompt asks for your consent before any tracking-grade identifier is used; on Android you control the Advertising ID under system Settings. Ads can be permanently disabled via the Lifetime / Premium IAP.

3.5 In-app purchases (IAP)

Moje Szczepienia offers paid features through Apple In-App Purchase (iOS) and Google Play Billing (Android). When you make a purchase:

• Apple / Google process all card and account data — we never see your card number, billing address, or full account information;
• Apple / Google return a purchase token / transaction receipt that Moje Szczepienia stores locally to validate entitlement;
• restore purchases re-fetches your existing entitlements from Apple / Google.

Available products: lifetime premium unlock, optional tip jar, optional annual subscription.

3.6 Device permissions

• Photos / Media (READ_MEDIA_IMAGES / PHPhotoLibrary): add or process images from the gallery (optional unless required for app's core function).
• Files (READ_EXTERNAL_STORAGE / iOS Files): pick documents/archives (only when you choose a file).
• Notifications (POST_NOTIFICATIONS / UNUserNotificationCenter): reminders and operation status (optional).
• Vibrate (VIBRATE): haptic UI feedback (optional).

Each permission is requested contextually. You can deny any permission and still use the core features (where applicable).

3.7 What we do NOT collect

• Your name, email, phone number, address (no account is required).
• Contacts list, calendar, SMS, call logs.
• Precise location.
• Browsing history outside the app.
• Biometric data (Face ID / Touch ID is used only as a system-level lock and never leaves your device).
• Health (HealthKit / Health Connect), financial, or payment card data — Moje Szczepienia does not integrate HealthKit or Health Connect; vaccination entries are user-typed organizational data, not data exchanged with system health stores.

4. Why we process this data (purposes)

• Run the app on your device — local storage and (where present) encryption let your data persist between sessions.
• Sync your own data across your own devices — through your own iCloud / Google Drive AppFolder; we do not see this data.
• Improve stability — Sentry diagnostics help fix crashes that affect your usage.
• Sustain the free tier — Unity Ads delivers non-invasive ads to fund users who do not buy premium.
• Process purchases — Apple / Google billing fulfils premium entitlements you choose to buy.

5. Legal basis (GDPR Article 6)

For users in the European Economic Area, United Kingdom, and Switzerland:

• Performance of a contract (Art. 6(1)(b)) — running the app, processing your purchases.
• Legitimate interest (Art. 6(1)(f)) — Sentry diagnostics, fraud / abuse prevention, non-personalized advertising. Our interest is improving stability and sustaining the free tier; this does not override your fundamental rights.
• Consent (Art. 6(1)(a)) — personalized advertising, where you grant consent via the ATT prompt (iOS) or in-app preference. You may withdraw consent at any time without affecting prior processing.
• Legal obligation (Art. 6(1)(c)) — only when we must respond to a lawful request from authorities.

6. Recipients (with whom we share data)

We do not sell personal data. The categories of recipients are limited to providers strictly required to run the app:

We may disclose data if required by a valid court order or other binding legal process, after verifying the request and notifying you where lawful.

7. International transfers

Some of the recipients above are located outside the European Economic Area (mainly in the United States). Where transfers occur, they are protected by:

• the European Commission's adequacy decision (EU-US Data Privacy Framework) for providers certified under the Framework, including Google LLC;
• Standard Contractual Clauses (SCCs) as adopted by the European Commission, supplemented by additional safeguards where applicable;
• the recipients' own published transfer mechanisms (e.g. Apple's binding corporate privacy commitments).

You can request a copy of the relevant safeguards by writing to mail@macsiem.dev.

8. Retention

9. Your rights (GDPR Art. 15–22)

You have the following rights regarding your personal data:

• Right of access (Art. 15) — confirmation whether we process your data and a copy of it. Most of your data is already on your device; export from the app or write to us for the rest.
• Right to rectification (Art. 16) — correct inaccurate data. Edit data directly in the app.
• Right to erasure / "right to be forgotten" (Art. 17) — delete all data via Settings → "Erase all data", or by uninstalling the app.
• Right to restrict processing (Art. 18) — request a temporary halt; write to us.
• Right to data portability (Art. 20) — Settings → "Export data" produces a JSON / Markdown bundle.
• Right to object (Art. 21) — object to processing based on legitimate interest, especially profiling-style ads. Disable personalized ads in app settings or via system controls.
• Right not to be subject to automated decisions (Art. 22) — Moje Szczepienia does not make automated decisions with legal or similarly significant effect about you.

To exercise any right, write to mail@macsiem.dev. We respond within 30 days (extendable by 60 days for complex requests, with notice).

10. Right to lodge a complaint (GDPR Art. 77)

If you believe we are processing your data unlawfully, you may file a complaint with a supervisory authority. For Polish residents:

Prezes Urzędu Ochrony Danych Osobowych (PUODO) ul. Stawki 2, 00-193 Warszawa, Poland https://uodo.gov.pl

You may also file a complaint with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement in another EEA country.

11. Children's privacy

Moje Szczepienia is not directed at children under 13 (under 16 where applicable per local law). We do not knowingly collect personal data from children under that age. Where parents enter children's vaccination data into the app, the app acts as a personal organizer for the parent; the entries remain on the parent's device under the parent's control. If you believe a child has provided us personal data without parental consent, contact us at mail@macsiem.dev and we will delete it promptly.

The "Designed for Families" / "Ages 5+" Apple / Google flags are not set on Moje Szczepienia — the app is rated for general audiences 13+.

12. Security

• Encrypted-at-rest local storage — vaccination entries, profiles, and reminders are stored in MMKV with a device-derived encryption key kept in Apple Keychain (iOS) / Android Keystore (Android). The key never leaves your device.
• No medical-data network transmission — vaccination entries are never sent over the network to our servers. The only optional cloud touch-point is your own iCloud / Google Drive AppFolder, which only you can access.
• No HealthKit / Health Connect integration — we do not read from or write to system health stores; vaccination entries are user-typed organizational data only.
• Transport security — all network calls (remote vaccine reference data refresh, ads, IAP) use HTTPS / TLS 1.2+.
• Minimization — we collect only what is required for the listed organizational purposes.

No system is 100% secure; please keep your device updated and use strong device locks.

13. App Tracking Transparency (iOS) and Advertising ID

On iOS, before any tracking-grade identifier is used by Unity Ads, Moje Szczepienia shows the system App Tracking Transparency prompt. If you decline, Moje Szczepienia serves only non-personalized ads.

On Android, you can reset or limit your Advertising ID under Settings → Google → Ads. Choosing "Delete advertising ID" stops Unity Ads from using a personal identifier; non-personalized ads continue to be shown.

14. In-app purchases

Moje Szczepienia offers the following in-app products through Apple App Store and Google Play: lifetime premium unlock, optional tip jar, optional annual subscription.

All payment data is handled by Apple Inc. (App Store / iTunes account) or Google LLC (Play Billing). We never see your card number, your billing address, or your full Apple ID / Google account. Apple and Google return only an opaque purchase token and entitlement metadata that we use to unlock features. Subscriptions can be cancelled at any time in iOS Settings → Apple ID → Subscriptions or in the Google Play app → Subscriptions; cancellation rules are governed by Apple / Google.

15. Changes to this policy

We may update this policy as the app, third-party SDKs, or applicable law change. Material changes will be announced in-app and the "Last updated" date at the top will change. Continuing to use Moje Szczepienia after a change constitutes acceptance of the updated policy.

16. Contact

For privacy questions, exercise of rights, or concerns about this policy:

Maciej Siemiński Email: mail@macsiem.dev

Canonical version of this policy: https://macsiem.github.io/szczepienia-privacy/ Source: https://github.com/MacSiem/szczepienia-privacy