GuidaVista Privacy Policy

Who is responsible

The app is developed and sold on the App Store by the developer, Darius Cirjan ("the developer", "we"). The developer is the controller of the personal data described in this policy. You can reach the developer at iosallapps@gmail.com.

What the app does not do

• There is no account and no sign in. The app never asks for your name, email address or phone number.
• The app contains no analytics, advertising or tracking software and shows no ads. We do not track you across other companies' apps or websites, and we do not sell or share personal data.
• The app does not access your location. It also does not access your contacts, photos, camera or microphone.

Data stored on your device

Your library (the guides you see, the editions you own and which guides are downloaded), the downloaded guide files, your favourites, your reading position and your language choice are stored only on your device. The developer does not receive them.

They are deleted when you delete the app. Like other app data, they can be included in the device backups that you control (iCloud Backup or a backup on your computer).

Purchases: Apple and RevenueCat

Guides are bought through Apple In-App Purchase. Apple handles the payment: the developer never sees your name, Apple Account, payment card or billing address. Apple's processing is covered by Apple's privacy policy.

To know which guides you own, including after a reinstall or on another device, the app uses RevenueCat, a purchase management service provided by RevenueCat, Inc. RevenueCat gives the app a random anonymous app user ID (it starts with "$RCAnonymousID:" followed by random characters). RevenueCat receives:

• this anonymous app user ID;
• your purchase history in the app: which guides and editions you bought, when, the price and currency, and the App Store transaction identifiers and receipt that Apple issues;
• technical data its software needs to work, such as the app version, the device model, the operating system version, the language, the App Store country and the IP address of the connection.

"Restore purchases" asks Apple for your purchases and links them to the current app user ID. RevenueCat's processing is described in RevenueCat's privacy policy.

Guide downloads

The guide catalog, the guide images and the guide files come from the developer's download service, which runs on Cloudflare (Cloudflare, Inc.). When you download a guide you bought, the app sends your RevenueCat app user ID in a request header. The service uses it only to ask RevenueCat whether that ID owns the guide, and then returns a download link that is valid for 5 minutes and contains no data about you. The service does not store the app user ID.

As with any internet service, Cloudflare receives your IP address and standard request information in order to deliver the content and protect the service. The service's own logs record only the guide, the edition, the result and the duration of each request: they contain no app user ID and no IP address, and Cloudflare's automatic request logs are turned off. To limit abuse, the service counts requests for one minute under a hashed form of the app user ID and of the IP address. Cloudflare's processing is described in Cloudflare's privacy policy.

Why we use the data and on which legal basis

• To sell, restore and deliver the guides you buy: performance of the contract with you (Article 6(1)(b) GDPR).
• To keep the download service secure and protect it against abuse: our legitimate interest in running a reliable service (Article 6(1)(f) GDPR).
• To keep purchase records required by tax and accounting law: legal obligation (Article 6(1)(c) GDPR).

We do not use your data for marketing, advertising, profiling or automated decisions that have legal or similar effects on you.

Who receives the data

Only the service providers named above, each for the purpose described: Apple (App Store, payment, distribution of the app), RevenueCat (purchase records) and Cloudflare (hosting of the download service). RevenueCat and Cloudflare act on the developer's instructions. Apple acts under its own terms and privacy policy for the App Store. We do not sell personal data and do not give it to anyone else, unless the law requires it.

International transfers

Cloudflare, RevenueCat and Apple can process data outside the European Economic Area, including in the United States. Cloudflare handles each request in a data centre of its global network, usually the one closest to you. Where data leaves the European Economic Area, these providers rely on the safeguards the GDPR provides, such as the EU-US Data Privacy Framework for certified companies or the Standard Contractual Clauses approved by the European Commission.

How long the data is kept

• Data on your device: until you delete it or delete the app.
• RevenueCat purchase records and the anonymous app user ID: for as long as they are needed to restore and deliver your purchases, and for the periods required by tax and accounting law. After that, or at your request where the law allows, they are deleted.
• Download service: the app user ID is used only while the request is handled and is not stored. Rate limit counters expire after about one minute. The service logs contain no personal data.
• Apple: according to Apple's privacy policy.

Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw it at any time.

To use these rights, write to iosallapps@gmail.com. Because there is no account, we can only find your purchase records if you include your Apple order ID (from the purchase receipt Apple emails you) or your app user ID. We answer within one month. Deleting the app removes all the data stored on your device.

You can also complain to a data protection authority, in particular in the country where you live or work. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Children

The app is not directed at children, and we do not knowingly collect personal data from children. Purchases require an Apple Account, and parents can control them with Apple's Family Sharing, Ask to Buy and Screen Time. If you believe a child has given us personal data, write to us and we will delete it.

Security

All connections use HTTPS. The secret keys that check purchases stay on the server and never reach the app. Download links are signed, are bound to one file and expire after a few minutes.

Changes to this policy

If a future version of the app adds features that need more data, for example trip planning that uses your location, we will update this policy before that version is released, and the app will ask for your permission where iOS requires it. The date at the top shows the latest version.

Contact

Darius Cirjan, developer of GuidaVista: iosallapps@gmail.com.