Privacy policy

The “KidRoles: Shop” app runs entirely on your device. We do not create accounts and do not collect names, emails or any personal data. There is no server storing your data. There are three exceptions, all described below: the optional feedback form (data leaves your device only if you choose to fill it in), visit counting on the kidroles.com website, which is separate from the app, and the technical logs and anonymous statistics of the server the app loads from and of the pairing relay (they concern traffic, not the contents of your register; the pairing server only relays scanned codes, the shop name, appearance settings and a random pairing identifier between the register and the scanner phone — in memory, with no write to disk). We also describe our correspondence with institutions (preschools, schools, after-school clubs) separately — it concerns their staff, not users of the app. A cashier photo (optional avatar) stays on this device only — it is never sent anywhere, not even to the phone scanner; you can remove it in Settings → Cashiers.

Settings, the product catalog, cashiers (a name, a PIN you choose and an optional photo) and sales history are stored only locally in your browser storage (localStorage). Clearing your browser data removes them permanently.

Barcode scanning uses the device camera. The image is processed on the fly solely to read the code — it is not recorded, saved or transmitted. The camera is also used for the optional cashier photo. An adult (or a child with their help) takes it in the add or edit cashier window (in Settings or on the login screen; behind the parent gate, if it is turned on) — you can also pick a photo from a file instead of using the camera. The photo is saved only on this device and we never send it anywhere. You can remove it in that window with “Remove photo” and by saving the changes, or by deleting the cashier (the last cashier cannot be deleted).

If you turn on online product-name suggestions, then when you add a product, only the barcode itself is sent to the public Open Food Facts database to fetch its name. None of your data is sent with it. This feature is off by default.

When you use a phone as a scanner, the register and the phone connect through a temporary room on a relay server. Only scanned codes, the template name and the product details needed to confirm a scan (name, icon, price) are transmitted — no personal data. The room expires when you disconnect. Besides that, we transmit a random pairing identifier (generated anew for every new pairing and deleted from the phone when you disconnect), which lets the register recognise the same phone after a brief loss of connection, as well as the shop name and appearance settings (colours, currency, sounds) that the register sends to the scanner phone so that it looks like the register. The identifier is not used for tracking or for recognising a device across pairings; please do not put a child's name in the shop name. The relay server also records anonymous technical statistics for each connection: whether pairing succeeded, its duration, the number of scans (not the codes themselves) and reconnections, and the general type of the register and the phone (e.g. iPhone, iPad, Android, Windows, Mac — no model or name). The statistics contain no IP addresses or identifiers. They are used only to maintain and improve the service; we keep the aggregated summaries for up to 90 days. From this data we also create anonymous daily summaries — numbers only, without IP addresses or identifiers, with no way to identify a person or a device. We keep them without a time limit to compare traffic over longer periods.

Like any web server, the server the app loads from records the IP address and browser name in technical access logs (security and troubleshooting); these logs are deleted automatically after 14 days. From them we count aggregated, anonymous statistics: the number of visits and returns to the app, the general device type (e.g. iPhone, Android, Windows) and the country, determined in a local DB-IP database on our server. The stored statistics contain no IP addresses; we keep them for up to 90 days. From this data we also create anonymous daily summaries — numbers only, without IP addresses or identifiers, with no way to identify a person or a device. We keep them without a time limit to compare traffic over longer periods. Links to the app with parameters in the address (e.g. the “shop from an AI recipe” link with „?shop=…”): when the address contains a „shop” parameter, the server does not write the address with its parameters or the referring page to the access log, and the app removes the parameters from the address bar immediately on load. We recommend links with „#” (the fragment never reaches the server).

In Settings you can open a short feedback form. It is entirely voluntary — if you do not fill it in, nothing is sent. When you submit it, only the fields you provide (including an optional email), plus basic technical info — app version, language, platform, display theme, time of sending and — in the beta version — release channel — are sent to our own server. We collect no other data from your device. We keep submissions for at most about 180 days, after which they are deleted automatically. Your email, if provided, is used solely to reply to you or to tell you about news — we do not pass it on. We forward each submission to ourselves by e-mail through the SMTP mail server of our provider (OVH, in the European Union, acting on our behalf), so its content, including any e-mail you give, also passes through that server. We delete the notification copies in our mailbox on your request (see the “Data deletion” section). The form is intended for adults (parents and guardians): the email field is labelled “parent / guardian email”, and children should not enter their own address. The Google Play version of the app has no email field at all and no address is sent.

The website (separate from the app) counts visits without cookies and without ad networks. We store: the page visited, the name of the site you came from (the address only, e.g. google.com — not the rest of the link), campaign labels from the link (utm_*), the language, a timestamp, the device type (phone, tablet or computer), the family and major version of your browser and operating system (e.g. Chrome 140, Android 14 — not the full browser description), the country, clicks on buttons and on links leading off the site (only the name of the destination site), form submissions (without their content), starting the video, the time spent on the page, how far you scrolled (in 25% steps) and loading-speed measurements (Web Vitals). The IP address is used only momentarily — to look up the country in a local database on our own server (no other company is asked) and to compute the daily identifier — and is not kept in the stored statistics. Like any web server, our server records IP addresses in technical access logs (security and troubleshooting); these logs are deleted automatically after 14 days and are not used to count visits. The identifier is derived from your IP address and browser name using a random value that is rotated every day and never saved, so once it rotates the identifier cannot be linked to you or to visits from the previous day — it exists only to count how many people visited on a given day. This data is deleted automatically after about 180 days. From this data we also create anonymous daily summaries — numbers only, without IP addresses or identifiers, with no way to identify a person or a device. We keep them without a time limit to compare traffic over longer periods. To opt out of counting, open the site with ?notrack=1. The country is determined using IP Geolocation by DB-IP (db-ip.com), licensed under CC BY 4.0.

This part covers our correspondence with institutions and their staff, not the app. Controller: „SELESA SYSTEMS” Przemysław Piegza (sole proprietorship registered in the Polish CEIDG business register), tax ID (NIP) 628-214-77-91, REGON 123012120, contact: kontakt@kidroles.com. What data: the institution's work e-mail address and phone number, the contact person's name and position (if we know them) and the content of our correspondence. Where it comes from: publicly available contact details of the institution (its website, the website of its governing body, public registers of institutions) or directly from you — when you write to us or use the contact form. Purpose and legal basis: contacting you about a trial of the app in your institution and answering your messages — our legitimate interest in establishing and maintaining business contact with institutions (Art. 6(1)(f) GDPR); where the conversation concerns a contract with the institution, also steps taken before entering into it (Art. 6(1)(b) GDPR). We send marketing by e-mail only with your consent (Polish Electronic Communications Law); a first message without consent only asks for it. How long: if you do not reply to the first message, we delete the address after 40 days; data from further correspondence is kept until the conversation ends or you object, and then only as long as the law or protection against claims requires. Recipients: only the e-mail and hosting service providers we use, acting on our behalf; we do not sell the data or pass it to other companies for their own purposes. If a provider processes data outside the European Economic Area, this happens only on the basis of a European Commission adequacy decision or standard contractual clauses. Your rights: access, rectification, erasure and restriction of processing, objection (to direct marketing — at any time; just reply “UNSUBSCRIBE”), withdrawal of consent at any time (without affecting earlier processing) and a complaint to the President of the Polish Personal Data Protection Office (UODO) or the supervisory authority in your country. Providing the data is voluntary, but without it we cannot reply to your message. We do not make automated decisions about you.

The app is meant for play under the supervision of a parent or guardian. External links are protected by a “parent gate”.

This is how to ask us to delete data related to the “KidRoles: Shop” app and the kidroles.com website. There are no accounts, so there is no “delete account” button.

Play data. The shop, cashiers, order history and cashier photo exist only on your device, and we do not have them. You can delete them yourself: uninstall the app or clear the site data in your browser. On Android: Settings → Apps → KidRoles: Shop → Storage & cache → Clear storage (item names may differ depending on your phone). You can also remove single items in the app: a cashier with their photo in Settings → Cashiers (the last cashier cannot be deleted, but you can remove their photo when editing), the order history in the History view (“Clear”), the products in Settings → General (“Clear catalog”).

Feedback and bug reports, step by step. These are the only content from the app that we store on our server, and only if you send it yourself. 1. Email kontakt@kidroles.com with the subject “Data deletion — KidRoles”. 2. Give the approximate date you sent it, a fragment of the text and the app version (Settings → General → About). Without accounts, this is the only way for us to find the entry. 3. If an email address was entered in the form (not applicable to the Google Play version), write from that address. 4. We will reply without undue delay and within 30 days at the latest. We may ask for more details so that we do not delete someone else’s entry. We will delete the entry from our server and the notification copy from our mailbox. Without a request, entries on the server are deleted automatically after about 180 days; we delete notification copies in our mailbox on request.

Notification sign-ups and institutions. Write to the same address (subject “UNSUBSCRIBE” or “Data deletion”) and we will delete the address and the message. Without such a request we keep a notification sign-up until you withdraw consent, and correspondence with institutions as described in the “Contacts with institutions” section.

Scanner phone pairing. There is nothing to delete on request. The random pairing identifier, the codes and the shop name exist only in the memory of the relay server, are not written to disk, and disappear when the room ends.

Logs and statistics. The server access logs are deleted automatically after 14 days. Aggregated statistics are anonymous and cannot be linked to a person, so we do not delete them on request; the retention periods are described in the sections above.

Backups. If an encrypted server backup is running, a deleted entry disappears from it after 30 days at the latest.

What we keep. Nothing beyond what is listed above. The exception is data that the law requires us to keep or that we need to defend against claims; then only as long as necessary.

For privacy and data matters, write to kontakt@kidroles.com. We reply without undue delay and within 30 days at the latest.