Privacy Policy

Privacy Policy – “Kto Będzie” / “Who is Down”

Last updated: 1 September 2026

§1. Data Controller and scope

  1. The Data Controller within the meaning of Regulation (EU) 2016/679 (“GDPR”) is:

ML-Design Miłosz Leśniewski
ul. Bułgarska 59/68
60-320 Poznań, Poland
VAT ID: PL7781436321

  1. This Privacy Policy applies to personal data processing in connection with:
    • the ktobedzie.pl website;
    • the browser-based application available at app.ktobedzie.pl;
    • the “Kto Będzie” / “Who is Down” mobile application for iOS and Android;
    • associated services, contact forms, support channels and communications.
  2. The Controller may be contacted by post at the address stated above or through the contact and support tools available in the application.

§2. Categories of personal data

The following categories of data may be processed when using the website or application:

1. Account and profile data

  • first name, username, nickname or pseudonym;
  • optionally, surname;
  • email address;
  • profile picture and other profile information;
  • user account identifier;
  • language and application settings;
  • information about account status and selected preferences.

2. Service usage data

  • information concerning events and clubs created by the user;
  • participation in events and membership of clubs;
  • messages, chats, comments and other content published by the user;
  • uploaded photographs, files, routes and other materials;
  • information about actions performed, such as starting or completing registration, proceeding through onboarding, creating an event or joining an event.

3. Purchase information

  • information about a purchase;
  • type of service purchased;
  • transaction status;
  • transaction identifier received from the relevant store operator.

The Controller does not receive complete payment card or bank account details.

4. Technical and diagnostic data

  • IP address;
  • device type and identifier;
  • operating system and its version;
  • browser type and version;
  • application and active update version;
  • language, time zone, screen resolution and basic device parameters;
  • session identifier;
  • visited page, referral source and visit time;
  • error, crash, performance and stability information;
  • technical logs, stack traces, network request information and actions directly preceding an error.

5. Location data

  • country and city approximately determined from an IP address;
  • approximate geographical coordinates;
  • device location, including more precise coordinates, if the user permits the application to access location;
  • location manually selected by the user.

6. Notification data

  • push subscription identifier or notification token;
  • device and operating system information;
  • system notification permission status;
  • notification preferences;
  • information about a notification being sent, delivered, displayed or opened.

7. Analytics and marketing data

  • analytics and online identifiers;
  • consent identifier and selected consent categories;
  • identifiers stored in cookies or browser storage;
  • after marketing consent has been granted, Meta identifiers such as _fbp or _fbc;
  • information about interactions with the website, application, advertisements or notifications;
  • information used to measure campaign effectiveness and attribute conversions.
  1. The Controller does not require special categories of personal data, such as health information, beliefs, sexual orientation or political opinions. Users should not include such information in public descriptions, messages or other content unless necessary.

§3. Purposes of processing

Personal data may be processed for the following purposes:

  • creating, maintaining and securing the user account;
  • providing application features, including events, clubs, participant lists and communication;
  • displaying events located near the user;
  • remembering settings, language and selected location;
  • processing purchases and confirming payment status;
  • sending system communications and push notifications;
  • providing support and responding to user requests;
  • ensuring security, preventing abuse and diagnosing errors;
  • analyzing use of the application and improving its features;
  • operating functional tests and feature flags;
  • measuring advertising effectiveness and attributing conversions;
  • optimizing advertisements and conducting remarketing, only after obtaining the required consent;
  • complying with legal, accounting and tax obligations;
  • establishing, exercising or defending legal claims.

§4. Location and geolocation

1. Approximate website location – GeoIP

  1. To display nearby events, the website may automatically determine the user’s approximate location from their IP address.

  2. For this purpose:

    • the IP address may be processed by the application server and transferred to ipgeolocation.io through Supabase Edge Functions;
    • the result may include approximate coordinates, country and city;
    • the geolocation result may be stored in browser localStorage for 24 hours;
    • GeoIP location is approximate and does not use GPS;
    • the user may manually select a city, replacing the automatically determined location.

2. Device location in the mobile application

  1. The mobile application may request system permission to access device location to display nearby events or provide map-related features.

  2. Device location is used only after the relevant permission has been granted in iOS or Android.

  3. The user may refuse permission without losing access to the application’s core features. A location may then be selected manually.

  4. Location permission may be changed at any time in the device’s system settings.

§5. Maps and location search

  1. The application and website may use Mapbox services provided by Mapbox Inc. to display maps, search for places and routes and provide geographical information.

  2. Mapbox features may involve the transfer of:

    • IP address;
    • device and browser information;
    • location search queries;
    • coordinates or the area displayed on the map;
    • information about map interactions.

  3. Where configured, Mapbox telemetry is limited or disabled.

  4. Further information is available in the Mapbox Privacy Policy.

§6. Analytics, diagnostics, notifications and user support

1. PostHog

  1. The Controller uses PostHog for product analytics, feature flags and improvement of the application.

  2. In the application, PostHog may process:

    • user identifier;
    • email address and profile name of a signed-in user;
    • device, session or installation identifier;
    • information about features used and actions performed;
    • technical data, platform, language and application version;
    • error and performance information.

  3. Session replay may be used in the application to diagnose interface and usability problems. Where session replay or persistent analytics involves optional device storage or detailed recording of interactions, it should be activated only after analytics consent has been obtained.

  4. On ktobedzie.pl, before analytics consent is granted, PostHog may operate in a limited in-memory configuration, without storing cookies or localStorage data, without session recording and without recognizing the same browser during a later visit.

  5. After analytics consent has been granted, PostHog may use persistent identifiers stored in cookies or localStorage.

  6. Further information is available in the PostHog Privacy Policy.

2. Bugsnag

  1. The Controller uses Bugsnag, a SmartBear service, to identify errors, crashes and performance problems.

  2. Bugsnag may receive information about an error, device, operating system, application version, visited page, active session and actions preceding an error.

  3. For signed-in users, a user identifier, email address or profile name may be added to a diagnostic report to enable support for a specific issue.

  4. The Controller does not intend to transfer the contents of private messages or special categories of personal data to Bugsnag.

  5. Further information is available in the SmartBear Privacy Policy.

3. OneSignal

  1. The Controller uses OneSignal to provide push notifications.

  2. OneSignal may process a notification token, subscription identifier, device, operating system and language information and information about notifications being sent, delivered or opened.

  3. Notifications are sent in accordance with the user’s preferences and the device’s system permissions.

  4. Notifications may be disabled in the application or device settings.

  5. Further information is available in the OneSignal Privacy Policy.

4. Tawk.to

  1. A support chat provided by Tawk.to may be available in the browser-based application.

  2. When the chat is used, the following information may be transferred to Tawk.to:

    • the user’s name or nickname;
    • email address;
    • chat contents;
    • technical device and browser information.

  3. This information is used to respond to and handle the user’s support request.

  4. Further information is available in the Tawk.to Privacy Policy.

§7. Legal bases for processing

Personal data is processed based on:

  • Article 6(1)(b) GDPR – where processing is necessary to perform a contract or take steps at the user’s request, particularly to provide an account and application features;
  • Article 6(1)(c) GDPR – where processing is necessary to comply with a legal obligation, such as an accounting or tax obligation;
  • Article 6(1)(f) GDPR – for the Controller’s legitimate interests, including security, abuse prevention, basic diagnostics, protection of legal claims and improvement of the service without using optional tracking technologies;
  • Article 6(1)(a) GDPR – the user’s consent, particularly for optional analytics, marketing, advertising measurement, marketing personalization or other features for which consent is requested;
  • Article 399 of the Polish Electronic Communications Law – for storing information or accessing information stored on the user’s device for non-essential purposes.

Consent to analytics or marketing is separate from acceptance of the Terms of Service and is not a condition for creating an account or using the application’s core features.

§8. Data recipients and transfers outside the EEA

  1. The Controller does not sell users’ personal data.

  2. Personal data may be transferred to entities supporting the service, including:

    • Supabase – infrastructure, database, authentication and server functions;
    • Apple Inc. and Google LLC – application distribution and purchase processing;
    • Mapbox Inc. – maps, geocoding and location search;
    • PostHog – product analytics and feature flags;
    • SmartBear/Bugsnag – error and performance diagnostics;
    • OneSignal – push notifications;
    • Tawk.to – support chat;
    • ipgeolocation.io – approximate GeoIP location;
    • Google LLC – Google Tag Manager, if activated after the relevant consent has been obtained;
    • Meta Platforms Ireland Limited – advertising measurement and marketing after consent;
    • hosting, email, technical support and other infrastructure providers;
    • public authorities where disclosure is required by law.

  3. Some providers may process personal data outside the European Economic Area.

  4. In such cases, the transfer is based on safeguards required by the GDPR, including adequacy decisions, Standard Contractual Clauses or other permitted transfer mechanisms.

§9. Data retention

  1. Account data is retained while the account remains active and, after its deletion, for the period necessary to settle the service, ensure security and establish or defend legal claims.

  2. User-created content is retained until it is deleted, the account is deleted or the purpose of retention ceases, subject to the rights of other users and the Controller’s legal obligations.

  3. Purchase and accounting records are retained for the period required by tax and accounting law.

  4. Security and claim-related data may be retained until the relevant limitation periods expire.

  5. A GeoIP result stored in localStorage is retained for 24 hours.

  6. Cookie preferences on ktobedzie.pl are generally retained for no longer than 182 days unless the user changes their decision earlier or a change in technologies requires renewed consent.

  7. A push notification token is retained until the subscription is withdrawn, the account is deleted or the device is considered inactive in accordance with the provider’s rules.

  8. Analytics, diagnostic and advertising data is retained in accordance with periods configured in the relevant services and no longer than necessary for the purposes described in this Policy.

§10. Cookies and similar technologies

  1. ktobedzie.pl and the browser-based application at app.ktobedzie.pl may use cookies, localStorage and similar technologies.

  2. These technologies are divided into:

    • necessary technologies – required for service functionality, security, session maintenance and remembering privacy settings;
    • functional technologies – supporting features such as support chat or remembering user preferences;
    • analytics technologies – helping the Controller understand how the website and application are used;
    • marketing technologies – used for advertising measurement, conversion attribution, campaign optimization and remarketing.

  3. Analytics technologies using persistent identifiers and marketing technologies are activated only after the user’s voluntary consent. The corresponding switches should be disabled by default.

  4. Refusing consent does not prevent the user from using the core functions of the website or application.

  5. Consent choices may be changed through “Cookie settings” on the website and the relevant privacy option in the browser-based application.

  6. Withdrawing consent stops the future operation of the relevant technologies. Recognized cookies are removed where technically possible.

  7. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

§11. Meta Pixel and advertising measurement

  1. After marketing consent has been granted, the Controller may use Meta Pixel on ktobedzie.pl and the browser-based application at app.ktobedzie.pl. Meta Pixel is provided by:

Meta Platforms Ireland Limited
Merrion Road
Ballsbridge
Dublin D04 X2K5
Ireland

  1. Meta Pixel may transfer information to Meta including:
    • the visited page and referral source;
    • date and time of the visit;
    • IP address;
    • browser, operating system and device information;
    • Meta cookie identifiers such as _fbp or _fbc;
    • information about a measured action;
    • for public event pages, the type of sport, general event location and public content identifier.
  2. Measured actions may include:
    • viewing a page;
    • clicking a public event card;
    • starting or completing registration;
    • starting, proceeding through a step of or completing onboarding;
    • creating an event;
    • joining an event.
  3. This information is used to:
    • determine whether an advertisement resulted in a measured action;
    • create aggregated campaign effectiveness reports;
    • optimize advertisement delivery;
    • conduct remarketing or create audiences where such activities are launched within the scope of the user’s consent.

  4. The Controller does not intentionally send a user’s first name, surname, email address, account identifier, participant identifier, private event identifier or payment information to Meta as application event parameters. The Controller does not currently use advanced matching.

  5. Even without direct identifiers, Meta may recognize the browser or associate the information with a Facebook or Instagram account using its own cookies and other information held by Meta.

  6. The legal basis is the user’s consent under Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law.

  7. For the collection and transmission of event data, the Controller and Meta may act as joint controllers. Meta’s subsequent use of the data is governed by Meta’s own documents.

  8. Further information is available in:

  9. Marketing consent may be withdrawn at any time. Following withdrawal, the Controller will stop sending subsequent events from the relevant browser. Information transferred previously may continue to be processed by Meta in accordance with its policies and applicable law.

§12. Payments

  1. In-app purchases are processed through Apple App Store and Google Play.

  2. The Controller:

    • does not receive complete payment card or bank account information;
    • receives information about the product, purchase status and transaction identifier;
    • uses this information to provide the service, process complaints and meet accounting obligations.
  3. Store operators process payment information in accordance with their own privacy policies and terms.

§13. Profiling and automated decision-making

  1. The Controller does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the user.

  2. Advertising providers, particularly Meta, may use received information to personalize advertising or create audiences in accordance with their own policies. Such activities on the Controller’s side are conducted only within the scope of the user’s marketing consent.

§14. User rights

Depending on the legal basis and scope of processing, the user has the right to:

  • access personal data;
  • receive a copy of personal data;
  • rectify inaccurate data;
  • erase personal data;
  • restrict processing;
  • data portability;
  • object to processing based on legitimate interests;
  • withdraw consent at any time;
  • lodge a complaint with the President of the Polish Personal Data Protection Office or another competent supervisory authority.

Withdrawing consent should be as easy as granting it. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

The exercise of certain rights may be restricted under the GDPR or other applicable laws, particularly where continued retention is necessary to comply with a legal obligation or protect legal claims.

§15. Data security

The Controller applies appropriate organizational and technical measures to protect personal data against loss, unauthorized access, alteration or disclosure.

However, no method of data storage or transmission can guarantee complete security.

§16. Changes to this Policy and Terms of Service

  1. The Controller may update this Policy, particularly in connection with changes to application features, providers or applicable law.

  2. Users will be informed of material changes through the application, website or email where required.

  3. Where a change affects consent-based processing and exceeds the scope of the consent previously granted, renewed consent will be requested.

  4. Detailed rules for using the application are available in the Terms of Service.

§17. Automated translations

The mobile application may offer translations of event descriptions and messages. Automatic chat translation is local-only. When supported on the device, language identification and translation are performed locally using Google ML Kit; the text selected for that local translation is not sent by us to Google for the translation. ML Kit may however process device and application information, per-installation identifiers, performance and diagnostic data, configured or identified languages, and information about model downloads and feature events for diagnostics and usage analytics. Google ML Kit Translate may use Firebase Remote Config and Firebase Installations for remote-configuration diagnostics.

If local translation is unavailable, a user-initiated translation of an event description or message may use Azure Translator. In that case, our server retrieves the selected content after the applicable access check and sends the text and target language to Microsoft to provide the translation. Microsoft states that Azure Translator text translation does not persist customer text. The translated version of a public event description may be cached in our infrastructure together with the event identifier, source-content hash, source and target language, and timestamps; it is removed when the related event is deleted. Automatic chat translation does not use this cloud fallback.

For the purposes of §8, the providers supporting this feature are Google LLC – Google ML Kit, including Firebase diagnostic services – and Microsoft – Azure Translator.

Translations are automated and may contain errors. Do not rely on them as a substitute for the original text and do not submit special-category or confidential information for translation.

Google notice and disclaimer:
THIS SERVICE MAY CONTAIN TRANSLATIONS POWERED BY GOOGLE. GOOGLE DISCLAIMS ALL WARRANTIES RELATED TO THE TRANSLATIONS, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTIES OF ACCURACY, RELIABILITY, AND ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

More about Google Translate: https://translate.google.com.