Privacy Policy
1. Controller
For any privacy matter, write to contact@thelion.app.
This policy covers the website thelion.app and the mobile apps published under the brand The Lion App Studio. We follow the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
2. Our approach in short
- Content you enter in our apps (your entries and settings) is stored on your device. We do not receive it. If an app ever offers cloud sync, we will describe it here before it launches.
- We do not sell your data and do not use advertising trackers.
- We process only what is needed to sell subscriptions, answer messages and keep accounting records.
3. What data we process, why and for how long
| Situation | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Using the app | Content you enter (entries, settings): stored locally on your device | Not processed by us. You can delete it at any time by deleting the data in the app or uninstalling it. | On your device, until you delete it |
| In-app subscription (App Store / Google Play) | Random app user ID, subscription status, product, country, transaction ID and dates. We do not receive your name or card details. | Providing Premium and handling the subscription: performance of the contract (Art. 6(1)(b) GDPR); accounting: legal obligation (Art. 6(1)(c)). | For the duration of the subscription, then as required by tax law (5 years from the end of the tax year) |
| Purchase on our website (Stripe) | Name, e-mail, billing country/address, payment method type, last 4 digits of the card, order details. Full card details are handled by Stripe only. | Concluding and performing the contract (Art. 6(1)(b)); invoices and accounting (Art. 6(1)(c)); fraud prevention and handling claims: legitimate interest (Art. 6(1)(f)). | Contract duration, then 5 years from the end of the tax year; claims: until they become time-barred |
| Contacting us by e-mail | E-mail address, name (if given), content of the message | Answering your message and support: legitimate interest (Art. 6(1)(f)) or steps related to a contract (Art. 6(1)(b)). | Up to 3 years after the conversation ends |
| Visiting the website | IP address, browser type, time of request (technical logs of our hosting provider) | Security and delivery of the website: legitimate interest (Art. 6(1)(f)). | Short-term, according to the hosting provider's log settings |
| Crash reports | Anonymous technical crash data shared by Apple or Google only if you allowed it in your device settings | Fixing errors: legitimate interest (Art. 6(1)(f)). | As set by Apple / Google |
Providing data is voluntary, but without data needed for a purchase we cannot sell you a subscription. We do not make decisions based solely on automated processing that produce legal effects for you.
4. Who receives the data
We share data only with providers that help us run the Services, under data processing agreements or as independent controllers:
- Stripe (Stripe Payments Europe, Ltd., Ireland): payment processing for website purchases;
- Apple and Google: app distribution and in-app payments (as independent controllers, under their own privacy policies);
- RevenueCat, Inc. (USA): management of in-app subscription status;
- Cloudflare, Inc.: website hosting and security;
- our e-mail hosting provider and accounting office;
- public authorities, when required by law.
5. Transfers outside the EEA
Some providers (e.g. RevenueCat, Cloudflare, Apple, Google, Stripe group companies) may process data in the USA or other countries outside the European Economic Area. In such cases transfers are based on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) for certified companies or on Standard Contractual Clauses. You can request a copy of the safeguards by writing to us.
6. Your rights
You have the right to access your data, rectify it, erase it, restrict processing, data portability, and to object to processing based on our legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting earlier processing. To exercise your rights, write to contact@thelion.app. We reply within one month.
You also have the right to lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
7. Cookies
Our website does not use analytics, marketing or advertising cookies. Our hosting provider may use strictly necessary technical cookies for security (e.g. bot protection), which do not require consent. Stripe's checkout pages use their own cookies, described in Stripe's privacy policy.
8. Children
Our apps are not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will delete it.
9. Security
We use appropriate technical and organisational measures, including encrypted connections (HTTPS), access control and selection of trusted providers.
10. Changes
We may update this policy when our Services or the law change. The current version is always available on this page with its effective date.