Controller and contact
Controller: BESOFT CONSULTING SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ SPÓŁKA KOMANDYTOWA, with its registered office at ul. Czajki 18, 33-100 Tarnów, Poland, entered in the National Court Register under KRS 0000755246, NIP 8733268783, REGON 381696101.
Privacy and account requests: privacy@tuvvy.app.
Scope
This Policy covers the Tuvvy mobile application, tuvvy.app, api.tuvvy.app, account authentication, cloud synchronisation and related support. A third-party page opened from Tuvvy is governed by that provider's own terms and privacy notice.
Data we handle
Account data
Account ID, email address, chosen name or nickname, profile image URL, authentication provider, account timestamps and session information. If you use Google or Facebook sign-in, that provider supplies the identity details you approve.
Content you add
Depending on the modules you use, this can include tasks, habits, journal entries, family and friend details, messages, travel and location records, financial records, vehicle data, scans, photos, documents, health records, medicines, visits and other information you choose to save.
Technical sync data
A random device identifier, document collection and record identifiers, update times, deletion state, file hashes, storage paths and synchronisation diagnostics.
Device permissions
Tuvvy may request access to location, contacts, camera, photos, notifications, sensors or files when a feature needs it. Access depends on your device permission and the action you choose. A contact selected or imported into a Tuvvy record may become part of cloud sync when you are signed in.
Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Account and authentication | Create and secure your account, sign you in and provide support. | Performance of the service agreement, Art. 6(1)(b) GDPR. |
| Cloud documents and files | Synchronise your selected Tuvvy information across devices and restore it after sign-in. | Performance of the service agreement, Art. 6(1)(b) GDPR. |
| Health and other special-category data | Store and synchronise information that you deliberately add to sensitive modules. | Your explicit consent, Art. 9(2)(a) GDPR. You may withdraw it at any time. |
| Security and technical logs | Prevent abuse, diagnose failures, protect accounts and maintain the service. | Our legitimate interests, Art. 6(1)(f) GDPR. |
| Legal requests | Comply with binding law or establish and defend legal claims. | Legal obligation or legitimate interests, Art. 6(1)(c) and (f) GDPR. |
We do not sell personal data, serve behavioural advertising or use Tuvvy data for automated decisions that produce legal or similarly significant effects.
Local storage and cloud sync
In guest mode, app records are stored locally on your device. Uninstalling the app or clearing its storage can permanently remove them unless you exported a backup.
After sign-in, Tuvvy synchronises eligible application records and attached local files to your private account. Records are stored in a self-hosted Supabase database and files are stored in a private object bucket. Access rules separate records by authenticated user.
Health and sensitive data
Medical information and some other modules may contain health data or other highly private information. Tuvvy is not a medical records provider. You decide what to enter.
When you use a signed-in account for sensitive data, the data can be synchronised to Tuvvy cloud. You may withdraw consent and request deletion by contacting us. Withdrawing consent does not affect processing that was lawful before withdrawal.
Providers and international transfers
We use infrastructure and service providers only where needed to operate Tuvvy:
- Contabo for virtual server infrastructure and operational backups.
- Cloudflare for DNS, security, delivery and private object storage through R2.
- Google when you choose Google sign-in.
- Meta when you choose Facebook sign-in.
- Email providers to deliver verification, security and support messages.
Selected modules contact public data providers directly, including Open-Meteo, OpenStreetMap/Nominatim, OSRM, Open Food Facts, Open Beauty Facts, Frankfurter, CoinGecko, Yahoo Finance, PAP, NHTSA and public medical registries. These providers may receive your IP address and the query, coordinates, barcode, symbol or other value needed to answer your request.
Some providers may process data outside the European Economic Area under their own privacy terms and lawful transfer safeguards.
Retention and deletion
- Local data remains until you delete it, clear app storage or uninstall Tuvvy.
- Active cloud data remains while your account exists or until you delete it.
- Deletion markers and limited technical metadata may remain as needed to propagate deletions between devices and secure the service.
- Backups are overwritten according to the infrastructure backup cycle.
- Security logs are kept only for the shortest period reasonably needed, unless an incident or legal duty requires longer retention.
Automated account deletion is not yet available in the beta. Email us to delete your account and associated active cloud data and files.
Security
We use encrypted network connections, authentication, private storage, per-user database access rules and restricted server access. No system is perfectly secure.
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to certain processing. Where processing relies on consent, you may withdraw it. You may also complain to the Polish supervisory authority, the President of the Personal Data Protection Office: uodo.gov.pl.
We may need to verify your identity before completing a request.
Children
Tuvvy accounts are not directed to children under 16 without the authorisation of a parent or guardian where required by law. Do not place a child's sensitive information in cloud sync unless you have the authority and a clear reason to do so.
Website
tuvvy.app stores your selected language in local browser storage. We do not use advertising cookies or third-party analytics on the current website. Servers and security providers may process IP address, user agent, requested URL and timestamps to deliver and protect the site.
Changes and contact
We may update this Policy when Tuvvy changes. Material changes will be announced in the app or on the website before they take effect where required.