Privacy policy

Dietabis · CodeDriven Sebastian Rosiński

Informative translation, adapted for consumers in EU/EEA countries other than Poland. The legally binding version is the Polish one: original in Polish

Dietabis privacy policy

Version 1.2 of 25 October 2026 — in force from 25 October 2026.

1. Data controller

The controller within the meaning of the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council; in Polish: RODO) is (hereinafter the “Controller” or the “Seller”):

CodeDriven Sebastian Rosiński
NIP: 6351828443
Address: ul. Nowa 27/18, 43-190 Mikołów
Contact for personal data matters: kontakt@codedriven.pl

The Controller has not appointed a data protection officer — for all matters concerning personal data, please contact us at the address above.

2. The key points in brief

In Dietabis you do not create an account and you do not give us your name, e‑mail address, weight or any other health data. The App does not require registration — access to purchased content is linked only to your account in the Store (Google Play / App Store), not to an account in the App. Below we also explain what technical data nevertheless has to be created in order to verify your purchase and deliver the content to you.

3. What data we do NOT collect

The App does not ask for your first name, surname or e‑mail address — we receive them only if you write to us yourself (see point 4 “Data you give us yourself”).

The App and its developer also deliberately do not collect or ask for:

  • weight, height, age or any other data concerning health,
  • location data,
  • login details for third‑party services (including Cookidoo®).

The Dietabis app has no user account system.

4. Data you give us yourself

Correspondence — if you write to us at kontakt@codedriven.pl (a complaint, a question about your data, a report about a base recipe), we process your e‑mail address and the content of your message solely in order to handle the matter (Article 6(1)(b) and (f) GDPR), for as long as needed to resolve it and for the limitation period for any claims.

Withdrawal from the contract and refunds — if you send us a declaration of withdrawal from the contract (by e‑mail or in writing), we process the data in the declaration: your e‑mail address or postal address, your name (if you provide it), the Product, the date of purchase and the Store’s order number. If you withdraw using the Store’s refund function, your data is processed by the Store as a separate controller (point 6). If the refund requires a bank transfer directly from the Seller (§ 5 point 8 of the terms of use), we also process the account number and the name of the account holder that you give us for this purpose. We do this to acknowledge receipt of the declaration and to refund the payment, as required of us by the Polish Consumer Rights Act (Article 6(1)(c) GDPR), and to establish, exercise or defend legal claims (Article 6(1)(f) GDPR).

5. Data on your device — and data that has to leave it

The following settings are saved only locally, on the User’s device, and are not sent to the Seller:

  • meal swaps made in the plan,
  • favourite dishes (marked with a heart),
  • downloaded content packages (meal plans) saved offline,
  • purchase confirmations (Product name, price, date of purchase and the text of the consent given) — visible in Settings (Ustawienia) → Your purchases (Twoje zakupy),
  • App settings (e.g. the selected market, theme, the selected plan and its variant, the list of Products owned and the state of the switch for links to base recipes),
  • answers to the “Help me choose a diet” (“Pomóż w doborze diety”) questionnaire (sex, age, height, body weight, activity, goal, preferences, number of meals) — the calculations (BMI, estimated requirements) are performed only on the device; the answers can also be deleted separately by choosing “Delete adviser answers” (“Usuń odpowiedzi doradcy”) in Settings.

You can delete this data yourself at any time by choosing “Delete data from device” (“Usuń dane z urządzenia”) in the App’s Settings, or by uninstalling the App from the device — both actions permanently erase the local data.

Storing this information on the device and the App’s access to it are necessary to provide the features you use (Article 399(3)(2) of the Polish Electronic Communications Law (ustawa — Prawo komunikacji elektronicznej)), which is why we do not ask for separate consent. The App does not use cookies or similar technologies for advertising or analytics purposes.

“Delete data from device” does not erase the random installation identifier or the copy of the purchase history stored on the device by the purchase service (RevenueCat) — they are needed to handle purchases, which is why the App still recognises purchased Products after the data has been deleted. They are removed by uninstalling the App. On Android, the App has the system backup disabled (both cloud backup and device‑to‑device transfer), so uninstalling erases them irrecoverably. On iOS this cannot be disabled: restoring an iPhone from an iCloud or computer backup may restore the App’s data, including the purchase service identifier. After reinstalling, or on a new device, access to purchased Products is restored by the “Restore purchases” (“Przywróć zakupy”) function in Settings, which reads the purchase history from the Store account (Google Play or App Store).

To be clear: the information about which Product (diet × kcal level) you have bought does not stay only on the device. It goes to RevenueCat as purchase history and — each time content is downloaded — to our server, together with a random installation identifier that contains no identifying data (pseudonymisation within the meaning of Article 4(5) GDPR) and your IP address. Without this, it is not possible to check that you are entitled to the content you have purchased.

6. Recipients and processors of data

For the App to work, it is necessary to use the services of the following entities, which process data to the extent described below:

  1. RevenueCat (RevenueCat, Inc., USA) — a provider of infrastructure for handling in‑app purchases, a processor acting on behalf of the Controller. It processes the random installation identifier (app_user_id), the purchase history of Products, the regional settings and currency and — in connection with the network connection — the device’s IP address, which are necessary to verify that a given copy of the App is entitled to receive the content of a purchased Product. RevenueCat does not receive the User’s first name, surname or e‑mail address from the Seller; the collection of device identifiers (e.g. the advertising identifier) is disabled in the App.
  2. Supabase (contract with Supabase Pte. Ltd., Singapore; the Controller’s project in the Frankfurt region, EU) — a provider of infrastructure that serves the diet catalogue and the content of meal plans after the purchase has been verified. To the server function that delivers purchased content, the App sends the identifier of the purchased Product and the random installation identifier (as well as the code of the selected country, used solely to deliver the content intended for that country); these are used to verify the purchase with RevenueCat and to limit abuse (a request limit per identifier and IP address). To limit abuse, the database stores only cryptographic hashes (salted SHA-256) of the IP address and the installation identifier, never their raw values. Downloading the free preview (1 sample day) sends only the product identifier and the code of the selected country to the same function, without the installation identifier — because the preview does not require verification of a purchase. Downloading the diet catalogue and the state of the links switch does not send any identifier (only the code of the selected country is sent with the catalogue request). The Seller configures this infrastructure itself — to this extent Supabase is a processor. In connection with handling network requests, in all these cases Supabase processes standard server logs, including the device’s IP address, to the extent typical for the operation of any internet service (security, diagnostics, limiting abuse).
  3. Cloudflare (Cloudflare, Inc., USA) — a provider of the content delivery network from which the App downloads photos of dishes (the address img.codedriven.pl). When a photo is downloaded, Cloudflare processes the device’s IP address, the address of the file being downloaded and the standard request headers in order to deliver the file and protect the service, as a processor. Downloading a photo does not send the installation identifier or any information about purchases.
  4. The e‑mail service provider that operates the kontakt@codedriven.pl mailbox — in respect of correspondence, including declarations of withdrawal from the contract (point 4).
  5. The Store (Google Play / App Store) — handles payment for Products as a separate, independent controller of the User’s billing and payment data. The Seller has no access to payment card details or the billing details processed by the Store. A refund request submitted through the Store’s function is handled by the Store under its own data processing rules.

Data may also be disclosed to public authorities where such an obligation arises from the law.

Security. All communication between the App and the servers takes place over an encrypted connection (HTTPS). We collect only the data necessary to verify a purchase and deliver content, and to limit abuse we store only salted cryptographic hashes, not raw IP addresses or identifiers. Only the Controller has access to the configuration of the services.

7. Transfers of data outside the European Economic Area

  • Supabase — the App’s data (the database and the server function) is stored in the Frankfurt region, in the European Union. The party to the data processing agreement is Supabase Pte. Ltd., based in Singapore, and access to the data from a third country (e.g. as part of technical support or by sub‑processors) is possible; the European Commission has not issued an adequacy decision for Singapore, so such a transfer takes place on the basis of the standard contractual clauses adopted by the Commission (Implementing Decision (EU) 2021/914, Article 46(2)(c) GDPR).
  • RevenueCat — RevenueCat, Inc. is based in the United States and processes data in the USA. As at the date of issue of this version of the policy, RevenueCat is not on the list of participants in the EU-U.S. Data Privacy Framework, so the transfer takes place on the basis of the standard contractual clauses (Implementing Decision (EU) 2021/914, Article 46(2)(c) GDPR) provided for in RevenueCat’s data processing agreement.
  • Cloudflare — Cloudflare, Inc. is based in the United States and participates in the EU-U.S. Data Privacy Framework, which is covered by a European Commission adequacy decision (Implementing Decision (EU) 2023/1795, Article 45 GDPR); Cloudflare’s data processing agreement additionally provides for standard contractual clauses for transfers not covered by that framework.

A copy of the safeguards applied (the standard contractual clauses) can be obtained by writing to kontakt@codedriven.pl.

The data described in point 6 is processed on the basis of:

  • Article 6(1)(b) GDPR — to the extent necessary for the performance of the contract for the supply of purchased digital content (verification of the purchase, delivery of the Product’s content),
  • Article 6(1)(c) GDPR — to the extent of obligations under the Polish Consumer Rights Act on withdrawal from the contract (acknowledging receipt of the declaration, refunding the payment) — point 4,
  • Article 6(1)(f) GDPR — the Seller’s legitimate interest in ensuring the security of the service, preventing abuse and keeping the infrastructure working properly (server logs, request limits, delivery of the catalogue and photos), and, in the case of correspondence, in handling enquiries and establishing, pursuing or defending claims.

Providing the random installation identifier and the IP address is a condition of purchasing and downloading content — without them it is not possible to verify a purchase or deliver a Product. Writing to us is voluntary.

9. Retention period

  • Cryptographic hashes in the request limit (Supabase) — entries older than 2 days are marked for deletion and erased in batches while subsequent requests are being handled; they contain only the hash and a request counter.
  • Supabase server logs (including the IP address) — for the log retention period of the service plan, no longer than 7 days.
  • Cloudflare logs — for the period resulting from the terms of the Cloudflare service, to the extent necessary to deliver the file and protect the service.
  • Installation identifier and purchase history (RevenueCat) — for the period during which we make the content of purchased Products available for download and restoration (§ 12 of the terms of use), and thereafter until they are deleted by the Controller; earlier — at the User’s request (point 11), with the proviso that once they have been deleted it will not be possible to confirm the purchase when content is downloaded.
  • Correspondence, including declarations of withdrawal from the contract and refund details — for as long as needed to resolve the matter, and thereafter until the limitation period for any claims has expired.

10. No profiling and no advertising

The App does not profile Users, does not display advertisements and does not pass data on User behaviour to third parties for marketing purposes. The Controller does not take decisions concerning Users based solely on automated processing which produce legal effects or similarly significantly affect the User (Article 22 GDPR).

11. Rights of the data subject

The User has the right of access to their data, to rectification, erasure, restriction of processing, data portability and to object to processing based on Article 6(1)(f) GDPR. To exercise these rights, you can contact the Seller at kontakt@codedriven.pl.

As the App has no user accounts, the Controller is not itself able to link the random installation identifier to a specific person (Article 11 GDPR). To exercise your rights in respect of purchase data, include in your message the order number from the Store’s proof of purchase — this will make it possible to find the corresponding identifier. We do not link the cryptographic hashes from the request limit to any person — they are deleted after 2 days (point 9).

12. Right to lodge a complaint

The User has the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, https://uodo.gov.pl — if they consider that the processing of their data infringes the GDPR. Under Article 77 GDPR, the User may also lodge a complaint with the supervisory authority in the Member State of their habitual residence, their place of work or the place of the alleged infringement; the list of the Member States’ supervisory authorities is published by the European Data Protection Board: https://www.edpb.europa.eu/about-edpb/our-members_en.

13. Changes to the privacy policy

The Seller may update this privacy policy, in particular if there is a change in the scope of the data processed, in service providers or in the law. The current version of the policy is always available in the App’s Settings. Users will be informed of a change to the policy in the same way as of a change to the terms of use (§ 10 of the terms of use): by updating the text in the App’s Settings, a notice in the App the next time it is launched, and publishing the new version at the public URL where the legal documents are made available (https://codedriven.pl/realizacje/dietabis/polityka-prywatnosci/).