Privacy policy

What data we process

• Google sign-in: the email address and name from your Google account. We never see your password or anything else on your Google account.
• Good Moment Card: the history of stamps you've collected and rewards you've claimed (date and time), tied to your account.
• Technical data: anonymous pageview counts per page (just the path and the day, no IP address or device identifier) and a cookie that keeps you signed in.

Why we process your data, and on what legal basis

• Running the Good Moment Card - counting stamps and rewards at your request (GDPR Art. 6(1)(b) - performance of a contract / action taken at your request).
• Keeping you signed in, so you don't have to log in on every visit (same basis).
• Card security - e.g. detecting copied or replayed stamp codes - and anonymous traffic analysis (GDPR Art. 6(1)(f) - our legitimate interest).

Who we share data with

Google LLC - as our sign-in provider (OAuth), only to the extent needed to verify your identity when you log in. In that role Google is an independent data controller - see Google's own privacy policy for details.

Our hosting provider, which runs the website and database - only for the technical operation of the service.

We don't sell your data or share it with third parties for marketing purposes.

How long we keep it

• Account and stamp history: for as long as your account is active - until you ask us to delete it.
• Sign-in session cookie: up to 180 days since your last login, then it expires on its own.
• Anonymous pageview counts aren't tied to any person, so they can't be matched to you or deleted on request.

Your rights

You have the right to access your data, correct it, have it deleted, restrict its processing, receive a copy in a portable format, and object to processing based on our legitimate interest.

You can delete your account and its entire stamp history at any time by emailing kontakt@niezleziolko.cafe - we'll remove it within 14 days at the latest.

You also have the right to lodge a complaint with the Polish data protection authority (UODO, uodo.gov.pl) if you believe we're processing your data unlawfully.

Cookies

The site uses one cookie strictly necessary for the service: nz_s, which keeps you signed in to the Good Moment Card (valid up to 180 days, not readable by browser scripts). During the Google sign-in flow itself we also set a short-lived nz_oauth cookie, which disappears after 10 minutes.

We don't use advertising or third-party analytics cookies (e.g. Google Analytics, Facebook Pixel) - which is why the site doesn't show a cookie consent banner: under EU ePrivacy rules, consent isn't required for cookies strictly necessary to provide the service you're actively requesting by signing in.

We count site traffic fully anonymously, without cookies and without any way to link it to a specific person.

Changes to this policy

As the site evolves, this policy may change. The current version is always available at this address, and the last-updated date is at the top of the page.