Privacy policy

1. Data controller

The controller is Nazar Kashuba, sole trader, Company ID 23562765, Dandova 2619/13, 193 00 Praha, Czech Republic. Contact for anything about your personal data: nazarkashuba@anynaz.com, phone +420 720 326 352 (Mon–Fri, 08:00–12:00 and 13:00–17:00 (Europe/Prague)).

We have not appointed a data protection officer, as the law does not require one for the scale of our processing.

2. What data we process

Account data: email address, name, username, profile photo, date of birth, country and currency, app language, sign-in method and — if you sign in with Apple or Google — the identifier of your account with that provider.

Content you create: wishes (title, description, photos, price, shop link), events (title, date, cover, guests), planned gifts, friends and friend requests, privacy and notification settings.

Phone number: if you add one, we store only a one-way hash of it and, for display, the country prefix and last three digits — never the number itself.

Finding friends in your contacts: if you turn it on, addresses and numbers from your contacts are turned into one-way hashes on your phone; only those hashes are sent and stored, and you can delete them in the app at any time.

Technical data: push notification token, device language and time zone, app version, IP address (for security and rate limiting) and server logs.

Account deletion request: the date, the reason you chose and an optional comment.

3. Purposes and legal bases

Providing the service — your account, wishlist, calendar, friends, gift planning and reminders (Art. 6(1)(b) GDPR, performance of a contract).

Push notifications and finding friends in your contacts (Art. 6(1)(a) GDPR, consent you give in iOS or in the app and can withdraw at any time).

Security, abuse prevention, rate limiting and server logs (Art. 6(1)(f) GDPR, legitimate interest).

Product suggestions: for wishes you have made public and linked to a shop, the product’s name, price, currency, link and photo may be offered to other users in the same country as a suggestion while they type a wish — without your name or anything else about you (legitimate interest). Make the wish private or remove its link and the suggestion disappears.

Service emails — sign-in codes and account deletion confirmations (performance of a contract). We send no marketing emails.

Compliance with legal obligations (Art. 6(1)(c) GDPR).

4. Who sees your data

Other users see your profile, wishlist, birthday and events according to your privacy settings (friends, chosen people or only you). A public link shows only your public wishes and can be revoked at any time.

Planned gifts are hidden from the person they are for.

We do not sell data, show advertising or use third-party analytics or tracking tools.

5. Processors and recipients

Websupport s.r.o. — hosting, database and email delivery on servers in the European Union.

Apple Inc. — push notification delivery (Apple Push Notification service) and Sign in with Apple.

Google LLC — only if you choose to sign in with Google.

Public authorities where the law requires it.

6. Transfers outside the EU

Apple and Google may process data in the United States. Such transfers are covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

7. How long we keep data

Account data and content for as long as the account exists. After a deletion request the account is blocked at once and erased for good within 7 working days; backup copies expire in the hosting provider’s normal cycle.

Sign-in codes for at most 1 day, sessions for at most 90 days after last use, rate-limit records for a few hours, server logs for as long as the hosting provider keeps them.

The record of a deletion request (date and reason) for 3 years, as proof that your request was carried out.

8. Security

Connections are encrypted (TLS). Sign-in codes and sessions are stored only as hashes, phone numbers and contacts only as one-way hashes. Server access is protected by keys.

9. Your rights

You have the right of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent. Details and how to exercise them are on the “Your rights under the GDPR” page (anynaz.com/kinship/gdpr).

You have the right to lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.

10. Age limit

Kinship is intended for people aged 15 and over. We do not knowingly create accounts for younger people; if we learn that an account belongs to one, we delete it.

11. Changes to this policy

We may update this policy. We will tell you about material changes in advance in the app or by email. The date of the last update is shown at the top.