Kostra Privacy Policy

The controller of the personal data processed in Kostra is the sole trader named above, registered in Poland and operating under the name HulerDevelopment. We have not appointed a Data Protection Officer. Article 37 GDPR does not require one here: we are not a public authority, our core activity is not large-scale monitoring, and we do not process special categories of data on a large scale. Every question, request or complaint about data goes to the email address above and is handled by the controller personally.

Only what the app needs to keep your vehicle records for you. Concretely: • Account: your email address and display name. If you register with a password, we store a bcrypt hash of it, never the password itself. If you sign in with Google or Apple, we store the account identifier that provider gives us instead. • Apple authorisation token: if you use Sign in with Apple, we keep the refresh token Apple issues. It has one purpose — revoking your authorisation with Apple when you delete your account, which Apple requires us to do and which cannot be done without it. • App settings: home currency, language, distance and volume units, and which expense categories you have hidden. • Vehicles: name, make, model, year, registration plate, VIN, initial odometer reading, default fuel type, purchase price and currency — whichever of these you choose to fill in. Only the name is required. • Expenses: category, date, amount, currency, odometer reading, your notes, and for refuelling also fuel type, volume, unit, whether it was a full tank, and the station. • Trips: date, purpose, start and end odometer, destination, business partner and description. Every edit to a trip keeps a copy of the values it replaced, because a log whose entries can be changed without a trace is worthless to a tax office. That edit history is deleted together with the trip. • Reminders: type, title, due date, due odometer and how far in advance you want to be warned. • Custom categories: the name, icon and colour you choose. • Sessions: for each active login we store an identifier of the refresh token, its expiry and whether it has been revoked. The token itself is never stored, which is what makes logging out on a lost device meaningful. • Technical server data: our hosting provider records the IP address and basic request data of every call to the API, as any server does, for security and diagnostics. • Subscription: which plan you are on, whether it is still running, when the current period ends, and the identifier the store gave the subscription so that we can ask the store about it. We never see your card — Apple and Google take the payment and tell us only that it happened.

One thing people usually expect to be sent somewhere is not: • Reminders. Reminder notifications are scheduled by your phone's operating system, locally. There is no push server, we hold no push token, and we cannot see or trigger the notifications you receive.

Kostra contains no advertising SDK, no analytics SDK and no crash-reporting SDK. There is nothing in the app that reports your behaviour back to us or to a third party. Specifically, we do not collect: advertising identifiers, your location or GPS trail, your contacts, your calendar, your device's other apps, browsing history, payment card details or bank data. We do not track you across apps or websites, we do not profile you, and we do not sell, rent or share your data for advertising. The odometer readings and destinations you type into a trip are data you entered; the app never records where your phone is.

• Running your account and storing your records — Art. 6(1)(b) GDPR, performance of the contract you enter into by creating an account. Without this data there is no service: the whole app is your records. • Converting amounts between currencies — Art. 6(1)(b), part of the same service. We fetch daily reference rates from an external rate provider; we send it currency codes, never anything about you. • Keeping the service secure — Art. 6(1)(f), our legitimate interest in protecting accounts against unauthorised access and abuse. This covers password hashing, session revocation, rate limiting and server logs. We consider this interest balanced because the data involved is minimal and the alternative is leaving your records exposed. You may object under Art. 21 and we will explain the balance in your case. • Answering your support and data requests — Art. 6(1)(c), our legal obligation under Chapter III GDPR, and Art. 6(1)(b) for ordinary support. • Notification permissions — Art. 6(1)(a), your consent, given through your operating system's permission prompt and withdrawable at any time in your device settings. Denying it leaves the rest of the app working. We do not ask for special categories of data (Art. 9) and the app has no field for them. Please do not type health, political or similar details into a free-text note; if you do, you are choosing to store them and you can delete them at any time. Running your subscription falls under the same contract — Art. 6(1)(b). Without knowing whether it is paid and until when, we cannot open the app for you, and checking a purchase with the store is part of that: it is the only way to tell a real subscription from a claim to have one.

We use a small number of providers, each under a data processing agreement as required by Art. 28 GDPR, each acting only on our instructions: • Neon (Neon Inc.) — the PostgreSQL database holding your account and records. Region: Frankfurt, Germany. • DigitalOcean (DigitalOcean LLC) — the servers running the Kostra API. Region: Frankfurt, Germany. Two further parties are not our processors but independent controllers, and their own privacy policies apply to what they do: • Google and Apple, if you use their sign-in. They tell us an account identifier, your email address and your name; they learn that you use Kostra. Apple's Hide My Email gives you a relay address instead of your real one, and the app works normally with it. • Apple and Google as app stores, for distribution, installation statistics and any crash diagnostics you have allowed them to collect at the operating-system level. We also call an external exchange-rate service (open.er-api.com) once a day from our server for reference rates. That request contains no personal data. Beyond this we share data with no one, except where we are legally obliged to disclose it to a public authority acting within its powers, or where a business transfer would require it — in which case you would be told in advance. Apple and Google also handle the payment itself, and there they are the seller rather than a processor acting for us. They take the money, issue the invoice, decide refunds and tell us only whether a subscription is valid and until when. Your card details, billing address and tax data are theirs and never reach us, which also means a request to us cannot produce them.

Your database records are stored in the European Union, in Frankfurt, Germany. The companies operating that infrastructure are, however, incorporated in the United States, and remote administrative access from outside the EEA cannot be ruled out. Any such transfer is covered by the Standard Contractual Clauses adopted by the European Commission under Art. 46(2)(c) GDPR, together with the supplementary measures in our agreements with those providers, and, where the provider is certified, by the EU–US Data Privacy Framework adequacy decision of 10 July 2023. If you sign in with Google or Apple, that sign-in is handled on their infrastructure under their own transfer safeguards. You may ask us for a copy of the relevant safeguards at the address above.

• Your account and everything in it: until you delete your account. We do not expire inactive accounts or quietly remove old entries — a spending history is only useful if it is complete. • After you delete your account: the database rows are deleted immediately. Copies may survive in our providers' rolling backups for up to 30 days, after which they expire on their own; we cannot pull an individual record out of a backup earlier, and we do not restore deleted accounts from one. • Session records: until the refresh token expires (30 days), plus a short period for revoked sessions, because a second attempt to use a revoked token is how we detect a stolen one. • Server logs: kept by our hosting provider for a short operational period, no longer than 30 days. • Correspondence with us: for as long as needed to deal with your request, and afterwards only where a limitation period requires it. • Subscription records: for as long as the account exists, and deleted with it. We hold no invoices — the stores issue those, and their own retention rules apply to them.

Under the GDPR you have the right to: • Access your data and receive a copy of it (Art. 15). • Have inaccurate data corrected (Art. 16) — most of it you can edit directly in the app. • Have your data erased (Art. 17) — see the next section. • Restrict processing (Art. 18) and object to processing based on legitimate interest (Art. 21). • Receive your data in a portable, machine-readable format (Art. 20). The app already exports your expenses and trips as CSV from the Statistics and Trips screens; ask us and we will send you the rest. • Withdraw a consent at any time (Art. 7(3)), without affecting what was done before you withdrew it. Write to the email address above. We answer within one month of receiving your request, and may extend that by two months for complex requests, telling you why (Art. 12(3)). This costs you nothing unless a request is manifestly unfounded or excessive. We may ask you to confirm you control the account email — not to obstruct you, but because handing your records to someone impersonating you would be the worse failure.

You can delete your account and everything in it from inside the app, at Settings → Delete account. It takes effect immediately and cannot be undone. If you have already uninstalled the app, or cannot sign in, use the deletion page at /kostra/delete-account or write to the email address above. Deleting your account removes your vehicles, expenses, trips and their edit history, reminders, custom categories and sessions. If your account is backed by Sign in with Apple, we also revoke our authorisation with Apple at the same time, so Kostra stops appearing under your Apple ID. Deleting the app from your phone does not delete your account — the records live on our server, and only one of the two routes above removes them.

• All traffic between the app and our API runs over TLS. • Passwords are stored as bcrypt hashes; we cannot read them, and we will never ask you for one. • Access tokens expire after 15 minutes; refresh tokens are revocable, and the server stores only an identifier of each one rather than the token. • Tokens on your device are kept in the platform's secure storage — Keychain on iOS, Keystore on Android. • On Android, participation in system cloud backup is switched off for the app, so your local app data is not copied to a backup that could be restored onto another phone. • Data at rest is encrypted by our database and storage providers. • Administrative access to production data is limited to the controller. No system is perfect. If a breach ever occurs that is likely to put your rights at risk, we will notify the supervisory authority within 72 hours and tell you directly as required by Art. 33 and 34 GDPR.

Kostra is a tool for car owners and is not directed at children. You need to be at least 16 to hold an account, or the lower age your country has set under Art. 8(2) GDPR, but no younger than 13. We do not knowingly process the data of anyone below that age. If you believe a child has created an account, write to us and we will delete it.

There is none. Kostra makes no automated decisions producing legal or similarly significant effects for you within the meaning of Art. 22 GDPR, and does not profile you. The statistics the app shows are arithmetic on the entries you made, computed for you to read.

If we change how the app handles data, we update this page and the date at the top. For a change that materially affects you — a new processor, a new purpose, a longer retention — we will tell you in the app or by email before it takes effect, and where the change requires your consent we will ask for it rather than assume it.

If you think we are handling your data unlawfully, please tell us first — most problems are faster to fix directly. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Ours is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland — uodo.gov.pl. You may equally complain to the authority of the EU country where you live or work.