Krokiet Polski

Privacy policy

Effective 26 September 2026 · Last updated 20 October 2026

This policy explains how we process your personal data when you use the Krokiet app for iPhone and Android and the website krokiet.app. It is the information we must give you under Articles 13 and 14 of the GDPR. The GDPR applies to every user, wherever you live, because we are based in Poland. Section 14 adds what the laws of some other countries ask for. The English and Polish versions have equal force.

1. Who we are

The controller of your personal data is Artur Witkowski, a sole trader, ul. Stefana Batorego 23/7, 81-365 Gdynia, Poland, NIP 5862405430, REGON 528542614 ("we", "us"). We operate the Krokiet app and the website krokiet.app. "GDPR" in this policy means Regulation (EU) 2016/679, the General Data Protection Regulation.

You can contact us at contact@krokiet.app, in English or Polish. We have not appointed a data protection officer, as the law does not require one.

Krokiet shows no ads and does no tracking. We do not sell personal data. We count a few things people do in the app, such as how often the Krokiet Plus offer opens, as anonymous daily totals. Section 2 explains what those totals hold.

2. Data we process

Your phone sends each counted event to our server while you are signed in. The server checks the session so nobody can send made-up numbers. It then adds one to that day's total and writes down nothing about who sent it. To stop one account from inflating a number, the server counts each account's events for one minute, in memory only. The daily totals cannot be linked to any person, so they are not personal data. The check of your session is, and section 3 gives its legal basis.

Some data about you may come from other people. A friend who records a meal you were at enters who sat at the table and the scores given there, including yours. If you have no account, the friend types a name for you. We use that data for the same purposes and on the same legal bases as data you give us yourself. If you later join Krokiet through an invite link, you take those scores into your own account and this policy applies to you in full.

The website krokiet.app sets no cookies and runs no scripts. When you open a page, our server receives your IP address and browser details so it can send the page back. It keeps no access log.

3. Purposes and legal bases

The articles below are articles of the GDPR.

Where we rely on legitimate interests, you can object on grounds relating to your particular situation. Section 11 explains how.

We do not rely on your consent for any processing. Location and notifications need your permission on the phone, and you can turn either off at any time in your phone's settings. The rest of the app keeps working.

Krokiet makes no decision about you based solely on automated processing, including profiling, that has legal or similarly significant effects on you, as described in Article 22 of the GDPR. An automatic filter holds back new place names and menu lines that contain swearing, links or phone numbers. Only their author sees them until a person reviews them.

4. Required and optional data

To create an account you must give an email address and a name. This is a requirement of the contract. Without them we cannot provide the service. No law requires you to give us any data.

Everything else is optional. Photos, menu scans, notifications and Apple or Google sign-in are your choice. Location is optional too, and the rest of the app works without it. The app asks for it once after your first sign-in, then only when you tap something that needs it. Your coordinates answer one request for nearby places, and we do not store them. The only location we store is the pin of a place you add by hand.

5. Who can see your data

Your meals, scores and photos are visible to you and to the friends you have both accepted. A friend also sees scores that either of you entered for someone without an account. Your friends see the list of your friends, with their names and faces, so they can ask them to be friends too. Nobody else sees that list. Someone who shares a friend with you can see your name, your face and the friends you have in common, and can send you a friend request. There are no public profiles, no feed, no comments and no messaging.

Places added by hand and menu lines read from photos are visible to all Krokiet users, without the name of the person who added them.

If you send an invite link to someone you scored at your table, whoever opens it sees the name you typed for them, your name and how many scores are waiting. The link works once and expires after seven days.

A person you report is not told who reported them.

Besides the users described above, the recipients of your data are the service providers in section 6 and the companies in section 7. We disclose data to public authorities only when the law obliges us to.

6. Service providers

These companies process personal data on our behalf and only on our instructions. Each is bound by a data processing agreement under Article 28 of the GDPR. DPF is the EU-US Data Privacy Framework and SCCs are the standard contractual clauses. Section 8 describes both.

Krokiet asks OpenAI not to store menu photos. OpenAI does not train its models on API data, and may keep a request for up to 30 days to monitor abuse. Anything else in the frame goes to OpenAI too, so point the camera at the menu, not at people.

Expo passes each notification to Apple or Google, which deliver it to your phone.

7. Other companies you may deal with directly

These companies are not our processors. Each acts as a separate controller for its own processing, and its own privacy policy applies.

• Apple and Google handle sign-in if you choose them. They learn that you signed in to Krokiet.
• Apple and Google sell Krokiet Plus through the App Store and Google Play. They take the payment, handle renewals, cancellations and refunds, and keep your payment details. We never see your card or bank details.
• OpenFreeMap serves the map tiles. It sees your IP address and the area of the map on screen.
• Apple Maps, Google Maps and Waze open only when you tap Directions on a place, with that restaurant as the destination.
• Facebook hosts the public pages our server copies some place logos from, once. Your phone never contacts Facebook.

8. Transfers outside the EEA

OpenAI, RevenueCat, Expo and GitHub process data in the United States. DigitalOcean, Cloudflare, Resend and Sentry process it in the EEA, but they are US companies and may be able to access it from the United States.

For these transfers we rely on one or both of two safeguards. The first is the EU-US Data Privacy Framework, for providers certified under it, on the basis of the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795). The second is the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914. The table in section 6 shows the safeguard for each provider. You can ask us for a copy of the standard contractual clauses.

9. How long we keep data

We use a backup only to recover from a failure. If we restore one, we apply again every deletion made after the date of that backup.

10. Deleting your account

In the app, open Profile, tap Delete my account, then Delete it permanently. Deletion is immediate and cannot be undone.

We delete your account, email address, name, face, friend code, sessions, push tokens, the link to your Apple or Google account, your friendships, your purchase records at RevenueCat and every photo you took, image files included. Meals that were yours alone and scores that nobody else could see are deleted too.

Data that is part of other people's meals stays, with no link to you.

• Scores you gave at meals with other people stay under the name "Someone who left".
• Meals you recorded that other people were at stay, without your photos.
• Places you added and menus you scanned stay on the map.

If you want these remaining scores deleted as well, email us and we will delete them. When a meal is deleted, its photos and their files are deleted with it.

Deleting your account does not cancel a Krokiet Plus subscription. Cancel it first in your App Store or Google Play settings, or it keeps renewing. Apple and Google keep their own record of the purchase, so you can bring Plus back on a new account with "Restore purchase" on the Krokiet Plus screen.

contact@krokiet.app

11. Your rights

Under the GDPR you have the right to

• access your data and get a copy of it (Article 15)
• have inaccurate data corrected (Article 16). You can also change your name and face in the app
• have your data erased (Article 17)
• restrict how we process your data (Article 18)
• receive the data you gave us, which we process to perform the contract, as a JSON file, and have it sent to another controller (Article 20)
• object, on grounds relating to your particular situation, to processing based on legitimate interests (Article 21). We then stop, unless we show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims

These rights apply as far as the GDPR provides. Using them is free of charge.

To use a right, email us. The app has no export button, so we send copies of your data by email. We answer within one month of receiving your request. For complex or numerous requests we may extend this by two more months, and we will tell you within the first month (Article 12(3)). If we have reasonable doubts about who is asking, we may ask you to confirm the request from the email address on your account.

contact@krokiet.app

You have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, or with the supervisory authority in the EU country where you live or work, or where you believe the infringement took place (Article 77).

uodo.gov.pl

12. Security

• All connections between the app, our server and our providers use TLS encryption.
• Photos go from your phone straight to private storage. The app reads them through links that expire after one hour.
• Krokiet has no passwords. You sign in with an emailed code, or with Apple or Google.
• Before a photo leaves your phone, the app saves it as a new image, which removes the location and camera details in the file.

13. Children

You must be at least 16 years old to use Krokiet, as the terms of use also state. Article 8 of the GDPR sets 16 as the age from which a person in Poland can consent to an online service on their own, and we use the same age as our minimum. If we learn that a user is under 16, we delete the account. If you believe someone under 16 has an account, email us. Krokiet is not directed at children under 13. If we learn that an account belongs to a child under 13, we delete it, as we do with any account of a person under 16.

14. Users outside the European Union

We are based in Poland, so the GDPR and the rest of this policy apply to every user, wherever you live. This section adds what the privacy laws of some other countries ask us to tell you. It takes away none of the rights in the other sections.

Where your data goes

To run Krokiet we send personal data to the providers in section 6. This table names each recipient, the country where it processes the data, what it receives and why.

DigitalOcean, Cloudflare, Resend and Sentry are US companies and may be able to access the data from the United States. The data travels over the internet, encrypted with TLS, each time you use the feature it serves. The database backup goes once a night, and a crash report goes to Sentry when the app crashes or our server hits an error. Each provider keeps it for the periods in section 9. These transfers are needed to provide the service. If you do not want one, you can stop using the feature behind it, such as menu scans, or delete your account.

Switzerland. Under the Federal Act on Data Protection, Germany, Ireland and the other EEA countries give adequate protection. For the United States we rely on the Swiss-US Data Privacy Framework for providers certified under it, and otherwise on the standard contractual clauses in section 8.

Japan. Under the Act on the Protection of Personal Information, the EEA has an adequacy finding from Japan's Personal Information Protection Commission. Providers in the United States process data under contracts that require GDPR-level protection, and we rely on those contracts as the measures the Act asks of a recipient abroad. The United States has no general federal privacy law. Sector rules and the laws of some states cover privacy there. Section 12 describes our security measures.

South Korea. The table gives the recipient, country, data and purpose of each transfer that the Personal Information Protection Act asks for. The paragraph under it says when and how the data is sent and how to refuse. Section 9 says how long each recipient keeps it.

Brazil

Under Brazil's General Data Protection Law, the LGPD, the person in charge of processing personal data, the encarregado, is Artur Witkowski, at contact@krokiet.app. Write to that address to use your rights under Article 18 of the LGPD. You can also complain to the National Data Protection Authority, the ANPD.

US state privacy rights

Residents of some US states, such as California, Virginia and Colorado, have rights under state privacy laws. They can ask what personal data we hold about them, get a copy, correct it and delete it. They can also opt out of the sale or sharing of their data, of targeted advertising and of profiling. We do none of those things. We do not sell or share personal data, we show no ads and we profile nobody. To use any right, email us. Using it does not change how we treat you. If we refuse a request, you can appeal by replying to our answer.

India and other countries

If you live in India or in any other country, send any question or grievance about your data to contact@krokiet.app. Artur Witkowski handles grievances and answers within one month. You can also complain to the data protection authority in your country.

15. Changes to this policy

The date at the top of this page shows when this policy last changed. If we make a material change, we will email you before it takes effect.

16. Contact

Krokiet · Privacy policy · Terms of use · Support