Patternly Privacy Policy
Effective upon publication of this version. Version 2026-10-16. This Policy explains how Łukasz Kurczab, natural person, at ul. Wróblewskiego 59, 33-170 Tuchów, Poland (the “Controller”) processes personal data in Patternly.
1. Controller and contact
Controller: Łukasz Kurczab, natural person, ul. Wróblewskiego 59, 33-170 Tuchów, Poland. Privacy contact: privacy@patternly.it; phone: +48 793 724 184. Data protection officer or designated privacy contact: No data protection officer has been appointed; privacy contact: privacy@patternly.it.
2. Scope and age policy
This Policy covers the mobile app, account and synchronization services, public legal pages, and support or content-report channels. Account-free guest learning can be available to younger users. Self-service account creation and cloud synchronization are restricted to users aged 18 or over; Patternly does not provide a guardian-consent flow.
3. Data kept on your device
Guest and account use may store an installation identifier, local dataset identifier, selected track, goals, settings, learning sessions, answers, results, review queue, recovery state, notification schedule and content-report outbox on the device. Local reminders are scheduled on the device; Patternly does not currently register a server push token.
Local learning data is protected by the device storage controls used by Patternly. A recovery code copied at your request is cleared when the operating system permits and only if the clipboard still contains that code. Data remaining only on the device is not sent to the Controller unless you create an account and synchronize an allowed record, submit a report, or invoke another network feature.
4. Account and authentication data
For an account, Patternly processes Firebase and Patternly user identifiers, email address, verification state, authentication provider and security timestamps to create and secure the account, authenticate requests, synchronize supported data, recover access and prevent abuse. The legal bases are performance of the service contract and the Controller’s legitimate interest in service security; legal obligations apply where records must be retained.
Google and Firebase process authentication and device-attestation data under their own terms. If and when Sign in with Apple is made available and you choose it, Apple may also process authentication data under its own terms. Under Article 14 GDPR, these providers may be sources from which Patternly receives identity and provider identifiers, an email address and name when returned, and device-attestation or security signals. If you choose Sign in with Apple, Patternly requests email and name scopes and limits use to fields returned for authentication and account operation.
5. Learning and synchronization data
When synchronization is enabled, Patternly sends the selected track and completed learning records such as session summaries, results, answers, review state, versions, timestamps and device or dataset identifiers to the Patternly backend. Active drafts, timers, preferences and notification settings are not in the current synchronization allowlist. The purpose and legal basis are providing the account synchronization service and maintaining its integrity.
Learning progress is retained while the account exists and is removed through the account-deletion process, subject to limited deletion evidence described below. Completed synchronization-operation metadata is retained for 30 days after completion.
6. Content reports and communications
A content report can include a category, optional free-form description, a random submission identifier, content and package identifiers, route, locale, app build, platform, time and an App Check or device-attestation token. The content-report form does not attach an account or contact email. A free-form description can still contain personal information. The server receives the connection IP address and turns it into a one-way rate-limit identifier used only to limit repeated reports. Do not include passwords or unnecessary sensitive information.
Reports are processed to improve content and protect the reporting channel. The legal basis is the Controller’s legitimate interest under Article 6(1)(f) GDPR in maintaining accurate content and protecting the reporting channel; you may object under Article 21 GDPR. All content reports are retained for 30 days from receipt. The one-way IP identifier is used to enforce a rate-limit window of 3600 seconds. Each newly accepted, nonduplicate report sets the identifier’s expiry time to 3600 seconds after receipt. Firestore TTL removes expired records asynchronously, so physical deletion may occur later. A locally accepted report is removed after the server confirms receipt. An unconfirmed report in the local outbox is automatically removed after 30 days.
7. Security and technical data
Patternly uses authentication tokens, App Check or device-attestation signals, request metadata, rate-limit identifiers derived by hashing network or email data, operational logs and security-event records to protect accounts, investigate faults and prevent abuse. Patternly does not use advertising or cross-app tracking SDKs, a general-purpose external product-analytics SDK, or an external crash-reporting SDK. RevenueCat processes purchase history for subscription functionality and purchase analytics as described below.
Operational logs are retained for 30 days and security logs for 90 days. Patternly redacts credentials and payloads from production logs. Recovery codes copied at your request may remain in the system clipboard; Patternly attempts to clear them after 5 minutes where the operating system permits and does not remove content you copied later.
8. Processors, recipients and transfers
Verified active cloud processors and their purposes: Google Cloud/Firebase — account authentication, backend and synchronization; RevenueCat — subscription management; Brevo — transactional email delivery; OVHcloud/Zimbra — support and contact mailboxes. Active independent controllers and recipients: No recipients other than the Controller and the service providers described in this policy.. Email delivery provider: Brevo SMTP. Provider regions: Google Cloud europe-central2 (Warsaw, Poland). Safeguards for transfers outside the EEA: The providers' applicable data-processing terms describe the safeguards for transfers outside the EEA. Google states that its Cloud and Firebase terms provide the EU–U.S. Data Privacy Framework for transfers to covered certified Google entities in the U.S., and EU Standard Contractual Clauses (SCCs) for restricted transfers where the applicable terms require them. Firebase Authentication processes data in the U.S.; the Warsaw backend region does not apply to every service. For restricted transfers from the EEA to countries without an adequacy decision, RevenueCat's DPA incorporates SCC Module 2 for our controller-to-processor relationship, with transfer details and security measures in its annexes. Brevo's DPA provides for SCCs and supplementary measures, and reliance on the EU–U.S. Data Privacy Framework for covered U.S. transfers while applicable. OVHcloud's DPA regulates remote processing. Its SCC annex provides Module 3 for processor-to-processor transfers to countries without an adequacy decision within its stated scope, where the customer expressly requests such processing. A data-centre location alone does not exclude overseas support access. The providers' subprocessor lists include services that may not be used for Patternly; the lists do not establish that every listed provider receives Patternly data. Brevo confirms that its standard DPA automatically applies to our account. It identifies the United States, India and Canada as countries from which its employees may remotely access data when necessary for customer care and maintenance, limited by data minimization. This describes possible support access, not routine hosting in those countries..
RevenueCat status: RevenueCat is integrated for subscription management. New Premium purchases are currently disabled. If you later obtain a subscription through the App Store, Apple may independently retain transaction and subscription records. Deleting a Patternly account does not cancel that App Store subscription or remove records controlled independently by Apple. Patternly reviews its processors, recipients and transfer arrangements whenever providers or their processing locations change.
9. Retention and account deletion
Account and synchronized learning data are kept while the account is active, unless a shorter period or an earlier valid request applies. Account deletion removes the account subtree, identity mappings and authentication account. Earlier content reports linked to the account are detached from it. If you later obtain a subscription through an app store, deleting your account does not by itself cancel that subscription.
After deletion, Patternly uses a keyed HMAC pseudonym solely to prevent accidental account resurrection for 7 days from the original deletion time, without renewing that period. It remains personal data; it is not anonymous, but no raw provider UID remains. Its legal basis is the Controller’s legitimate interest under Article 6(1)(f) GDPR; you may object to this processing under Article 21 GDPR by contacting privacy@patternly.it. A minimal proof of completed deletion, containing an opaque operation and confirmation identifier, date and result, may be retained for 12 calendar months after completion to check the operation using the confirmation number supplied by the user. It contains no learning history. This limited documentation is retained under Article 6(1)(c) GDPR together with the accountability and rights-obligation framework in Articles 5(2), 12(2), 17 and 24 GDPR; this does not establish a fixed statutory retention period. Patternly does not keep a blanket anti-fraud record after deletion: any event-specific anti-fraud retention needs its own documented threat model, necessity assessment and legitimate-interest assessment. Backup and point-in-time-recovery deletion: Firestore point-in-time recovery retains database versions for up to 7 days. Patternly does not maintain an additional scheduled Firestore backup. Expired or deleted data may therefore remain recoverable within the protected PITR window and is no longer recoverable after that window expires. Physical TTL deletion is asynchronous. Historical versions of an account-deletion tombstone may remain in PITR for up to 7 days after its removal from the active database; this does not extend its logical blocking period..
10. Your rights
Subject to applicable law, you may request access and the information required by Article 15 GDPR, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. Contact privacy@patternly.it. Requests are normally free of charge. Patternly may verify identity and must respond within one month; where legally permitted, it may extend by up to two further months after notifying you within the first month and explaining why. Any refusal must be reasoned and explain complaint and court options.
Patternly handles privacy requests through intake, identity verification where necessary, assessment, fulfilment or a reasoned refusal, and closure. This also applies where Patternly cannot identify a guest without additional information. You may complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, Poland): https://uodo.gov.pl/en/681/1404 or another competent authority, and may seek a judicial remedy. Patternly does not make solely automated decisions that produce legal or similarly significant effects.
11. Changes and version evidence
Each published Policy has an effective date and immutable version. Material changes are communicated as required by law. Where consent is the legal basis, a new consent is requested when required. Patternly retains an auditable record of the language, version, time and scope accepted or acknowledged by an account user.
12. Controller details
Registration number: Not entered in a business register. Tax identifier: No public tax identifier. Territories: European Economic Area (EEA).
13. Processing purposes and legal bases
For account services you request, Article 6(1)(b) GDPR covers data necessary to perform the account contract or, at your request, take steps before entering it. Account data may include account and sign-in identifiers, email and verification status, and the completed learning records you choose to synchronize, including answers, results, versions and dates. Recovery codes are stored as hashes with the request status. Where package delivery forms part of the account service you request, we use only necessary delivery data.
Article 6(1)(c) applies when a specific legal duty requires processing: handling rights requests and required responses under Articles 12–22 GDPR; documenting or notifying a personal data breach when Articles 33–34 require it; and keeping the minimum record needed to demonstrate and verify account deletion under applicable duties, including Articles 5(2), 17 and 24. The record is limited to a request or operation reference, relevant dates, action and outcome.
Article 6(1)(f) covers limited data for these interests: account and service security (preventing takeover, automated abuse and unauthorized session restoration); content accuracy and report-channel protection (report ID, content/version, reason and optional text); effective account deletion and applying it to eligible restored copies, using a keyed pseudonym derived from provider identity and deletion data for seven days from original deletion, without renewal; and specific or identifiable legal claims, using necessary evidence. It also covers free local learning you choose, including continuity of history and progress between launches, review and learning recommendations based on relevant local data. The deletion pseudonym remains personal data. Under Article 21, you may object based on your particular situation. We will no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims (section 10).
For a service-contract matter, we use your contact details and message, plus necessary attachments, to respond under Article 6(1)(b), including pre-contract steps you request. Complaints and privacy requests follow the legal duty for that matter; claim evidence may rely on Article 6(1)(f). New account purchases are disabled. If a subscription is offered later, necessary service data relies on Article 6(1)(b), and any separate duty on Article 6(1)(c). We do not conduct additional general-purpose product analytics or marketing; this does not include purchase analytics in section 7. Terms acceptance or Policy acknowledgement is not consent. See sections 8 and 14.
14. Detailed retention periods
Ordinary support correspondence: 90 days after closure. Operational logs: 30 days; selected security logs: 90 days. Completed synchronization operations and mutations: 30 days. Content reports: 30 days from receipt, without an attached account or contact address. Account-deletion tombstones: 7 days of logical blocking from the original deletion time, without renewal. Minimal deletion evidence and completed deletion-operation records: 12 calendar months from completion. Closed privacy requests without a dispute: minimal record of request type, dates, method and outcome for 12 calendar months from closure; unnecessary working data and secrets for 30 days after reasoned closure. Generated privacy responses and exports: 30 days from confirmed availability. Non-financial data-return requests and suspension appeals without a claim: minimal record for 12 calendar months from closure. Necessary complaint, withdrawal and refund evidence: until the applicable limitation period, assessed for the particular claim and law; unnecessary copies and attachments removed within 90 days of closure. Disputes: necessary evidence through proceedings and execution of the outcome, reviewed every 6 months; unnecessary materials removed within 90 days after final resolution and execution. Any remaining necessary evidence has a documented applicable deadline. Incidents without a personal-data breach or dispute: minimal description, assessment reason and remediation for 12 calendar months from closure. Confirmed personal-data breaches: necessary core documentation and notification evidence for a reviewable baseline of 6 calendar years from closure, reviewed annually; this is not a fixed statutory period or a universal maximum. Unnecessary incident working materials: 30 days after closure. Documented legal holds preserve only necessary evidence and are reviewed at least every 6 months; they are not silently released or deleted. Logical expiry denies access to expired materials before asynchronous physical TTL deletion. Provider and backup retention: see the separate provider and backup disclosures. Guest learning records remain in app-managed on-device storage while needed for your local learning history, until you reset local learning history or clear app data in device settings. The reset covers the supported learning records managed by the app; separately exported copies and operating-system or device-backup copies may remain under your device settings and are outside that reset. Brevo transactional email logs: one month for all senders. Saving previews of new emails is disabled; this setting does not delete earlier previews. Provider deletion processing and backups have their own rules and do not guarantee immediate physical deletion. RevenueCat processes customer deletion asynchronously. Removal of the customer record from its dashboard or API does not confirm simultaneous erasure of associated logs, backups, archives or other systems. Retention and deletion depend on the type of data and the system in which it is maintained.