Mythlift Privacy Policy

Version: 1.1. Publication and effective date: 2026-10-06.

This policy describes what data the Mythlift app (the App) processes, for what purpose, on what legal basis, where, for how long, and how you can use or delete it.

1. Data controller

1. The controller is Przemysław Jurek, conducting business under the name Przemysław Jurek, ul. Wileńska 15, lok. 87, 20-603 Lublin, Poland, tax ID (NIP) 7141952574, REGON 525521072 (the Controller).
2. Contact for privacy matters: mythlift@przemekjurek.pl.

2. Principles

1. We collect as little data as possible. The App does not collect health data: symptoms, injuries, illnesses, body weight or measurements. There are no free-text fields about health.
2. We do not track users across apps. The App uses no advertising ID and contains no advertising libraries. Optional Google Analytics through the Firebase SDK is enabled only after the consent described in section 4; it is not used for advertising or advertising profiling.
3. Age: the App is intended for people aged 16 or over. We do not collect dates of birth, only a confirmation of age.
4. The App does not use Google cloud backup of app data. Data may be sent to our Supabase server and directly to Google, RevenueCat, Sentry and Cloudflare Turnstile within the scopes described below. Exporting or sharing at your request can also save data or send it to an app you choose.

3. What data we process

In addition:

1. Learning reminders are scheduled locally on the device. They need no server. Notification permission is given in the Android system dialog and can be withdrawn in system settings.
2. Events about content gaps (concept, level, role) are sent without a user ID and regardless of the analytics consent.
3. Payment data (card numbers and so on) is processed only by Google Play. The Controller does not receive it.
4. You give your email address voluntarily when you save an account. Without it you can use the App as a guest, but buying Premium requires a saved account.
5. When the store integration is enabled, opening the Premium screen sends the Supabase account ID to RevenueCat and fetches the offer. This also applies to guest accounts and people who do not make a purchase. A guest who does not open this screen does not activate this integration. Turning off product analytics does not turn off offer retrieval.

4. Analytics consent

1. Product events sent to Supabase and optional Google Analytics measurement in the App require active consent. The switch is shown on first launch and is off by default. You can change it at any time in Settings. Accepting the Terms or Privacy Policy is not analytics consent.
2. Withdrawing consent blocks further events immediately, disables Google Analytics collection and requests a reset of local SDK analytics data. We do not send Google pending events from the previous consent. A local reset does not confirm deletion of earlier data from Google servers. Withdrawal does not affect the lawfulness of processing before it.
3. The learning log is necessary for the service to work (reviews, sync) and does not depend on the analytics consent.
4. Membership in a test group or assignment of a label variant does not imply analytics consent. Sending optional product events requires the switch to be enabled.

1. The App sends Google only names from a closed list of general interface and purchase events. It sends no question text, answers, learning results, health descriptions, comments, referral codes, email address or account identifier userId. The SDK may automatically add app lifecycle events, purchase information, an app-instance identifier and device information. Automatic SDK data is separate from the event names sent by Mythlift code. This is not anonymous measurement. According to Google's disclosure, IP addresses are processed to derive approximate location. We do not obtain GPS location. Advertising-ID collection and advertising personalisation are disabled.

5. Recipients and transfers outside the EEA

Data is not sold or shared for advertising.

6. How long we keep data

7. Your rights

You have the rights under the GDPR: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time. You also have the right to lodge a complaint with a supervisory authority (in Poland, the President of the Personal Data Protection Office, UODO).

We may ask you to confirm that a request comes from the account holder. We reply within one month.

8. Account deletion

1. Deleting in the App removes the profile, events, learning state and reports from our server, and requests deletion of the RevenueCat customer if one was created. The RevenueCat request is queued and retried after errors; deletion of local data or the Supabase account does not by itself confirm completion of this part. Data stored on the device is deleted immediately. We complete the server part within 30 days.
2. When the device has no network, the request is remembered on the device and carried out once the connection returns. Do not uninstall the App until it is confirmed: the remembered request disappears with it. If that has happened, write to mythlift@przemekjurek.pl and we will delete the account on request.
3. Deleting the account does not refund active Premium access. Google Play handles refunds; this does not limit statutory consumer rights described in the Terms.
4. A guest account has no email address, so a guest deletes it in the App. When the App can no longer reach the guest account (for example after uninstalling), we delete an account with no activity automatically 18 months after the last activity.

1. Google Analytics data is not labelled with the Mythlift account identifier. Deleting an account or resetting local SDK data does not automatically delete historical Google Analytics data from Google servers. Contact the Controller to exercise rights concerning these data; we may need additional information to identify the relevant measurement.

9. Security

Connections to the server are encrypted (TLS). User data is protected by row-level security in the database: each person can access only their own data. Administrative keys are kept only in the server environment, never in the App. The app removes account IDs, email addresses, question and answer text, request headers and parameters from Sentry reports. It does not send screenshots or session recordings. The provider receives a network connection, so absence of these fields in a report does not mean that no technical transmission data are processed.

10. Automated decisions

The App chooses the order of reviews and learning recommendations from your answers. We take no decisions that produce legal effects or similarly significantly affect people who use the App.

11. Website

1. Mythlift pages are part of przemekjurek.pl and use WordPress. Mechanisms necessary to operate the website and protect the form, and technical hosting logs, may operate without analytics consent. Other parts of the website are described in the website privacy policy.
2. On Mythlift pages, Google Analytics operates only after the analytics category is enabled in the existing cookie panel. Before consent and after refusal we do not load the Google tag or send analytics pings. Marketing consent alone does not start measurement. Website consent and the App switch are independent.
3. The website explicitly sends a page_view event with the canonical page address without query parameters or fragments, a fixed title and an empty referrer. The Google tag may also record technical session events. We send no referral code, form data, email address or userId. Google may process cookie identifiers, browser and device data and IP addresses to derive approximate location. Enhanced measurement, Google signals, advertising and advertising personalisation are disabled.
4. Measurement uses cookies with names beginning with mythlift_ga, scoped to the Mythlift path. Withdrawing consent in the cookie panel stops the running measurement and removes these cookies. It does not delete historical data already sent to Google.
5. The referral-code page /mythlift/polecenie/ is an exception: it runs neither Google Analytics nor the cookie panel. Merely displaying a code does not grant a reward.
6. Website and App Google Analytics are not linked through a Mythlift account identifier. The hosting provider may keep technical request logs under its own terms.

12. Changes to this policy

A material change means a new version of the document. On first launch after a change, the App asks for acceptance again. Declining acceptance does not remove already paid Premium access: it can be used under the previously accepted terms until the access period ends. Another purchase requires acceptance of the current documents. Without active Premium access, declining pauses learning, while viewing the documents, data export and account deletion remain available.