Privacy Policy

App: Tredori (app.tredori)

Effective date: 1 July 2026

Last updated: 1 July 2026

1. Summary (the short version)

Tredori is built to be private by design. In plain terms:

• Everything you create in the app — your Areas, Paths, Steps, Rituals, Traces, Chronicle, notes and attachments — is stored locally on your device.
• If you turn on iCloud, that content is synced only to your own private iCloud (CloudKit) database, which is tied to your Apple Account. The developer cannot see, read, or access it.
• There are no third-party analytics, no advertising SDKs, no trackers, and no data brokers. Nothing about your behaviour is sent to the developer or sold to anyone.
• Purchases are handled entirely by Apple. The developer never receives or stores your payment details.
• You can export all your data at any time, and you can permanently erase all of it from within the app.

If you read nothing else, read this: the developer of Tredori operates the app in a way that means, under normal use, no personal data about you is transmitted to or held by the developer.

2. Who is responsible for your data (Data Controller)

The person responsible for the app (the "data controller" under the GDPR and similar laws) is:

• Marcin Kwaśniewski, an individual (a natural person, not a company), residing in Poland.
• Contact: hello.marcin.apps@outlook.com
• Provider identification (Impressum): the developer's trader contact details, including postal address, are published on the App Store product page under Apple's trader information. For any request, email is sufficient: hello.marcin.apps@outlook.com.

Tredori is an independent app made by a single individual, not a corporation. This Policy explains what data is and is not involved when you use the app, and your rights in relation to it.

Because the developer designed Tredori so that your content stays on your device and in your private Apple account, for most purposes the developer is not the party in control of your content — you are, together with Apple, who provides the storage and payment infrastructure.

3. What data is involved, where it lives, and why

3.1 Content you create in the app ("Your Content")

This includes: Areas (identities), Paths, Milestones, Steps (tasks), Rituals, Traces, the Chronicle, your display name and chosen icon, your "Dorobek" score, Inbox items, and any files, photos or notes you attach.

• Where it is stored: locally on your device, in the app's private storage. If you enable iCloud sync, it is also stored in your private CloudKit database (iCloud.app.tredori.tredori), inside your own Apple Account.
• Who can access it: you. And, as your infrastructure provider, Apple (subject to Apple's own privacy terms). The developer cannot.
• Legal basis (GDPR): you are the party who determines and controls this content. To the extent the developer is considered a controller of the technical means that store it, the basis is the performance of the contract to provide you the app (Art. 6(1)(b) GDPR) and your consent to iCloud sync, which you give through Apple's iCloud settings.

3.2 Device permissions you may grant

Tredori only asks for a permission when you use a feature that needs it, and only uses it for that feature:

You can review or revoke any of these at any time in the iOS Settings app. Revoking a permission simply disables that feature.

3.3 On-device diagnostic counters (never leave your device)

To understand where the app's own onboarding and purchase flow could be improved, Tredori keeps a few anonymous counters on your device (for example, "onboarding completed", "paywall seen"). These:

• contain no personal data and no content from your tasks;
• are stored only on your device (in local app storage and the device's diagnostic log);
• are never transmitted to the developer or any third party.

They exist purely so the app can function and so you (or the developer, if you voluntarily send a diagnostic report) can understand the app's behaviour. They are removed when you erase your data or delete the app.

3.4 Purchases and subscriptions

Tredori offers an optional subscription, Tredori+, sold through Apple's in-app purchase system (StoreKit).

• Apple processes the entire transaction. The developer never receives, sees, or stores your name, card number, billing address, or Apple Account ID.
• The app receives from Apple only an anonymous confirmation of whether you currently have an active entitlement to Tredori+. This is used solely to unlock features and is validated on-device.
• Apple's handling of your purchase is governed by Apple's Privacy Policy (https://www.apple.com/legal/privacy/).

3.5 If you contact support

If you email hello.marcin.apps@outlook.com, the developer will receive your email address and whatever you choose to write. This is used only to answer you.

• Legal basis (GDPR): the developer's legitimate interest in responding to your request (Art. 6(1)(f)), or taking steps at your request (Art. 6(1)(b)).
• Support correspondence is kept only as long as needed to resolve your matter and any reasonable follow-up, and then deleted.

4. What the developer does not do

To be unambiguous, the developer:

• does not use Google Analytics, Firebase, Meta/Facebook SDK, or any other third-party analytics or advertising tool. There are zero third-party tracking SDKs in the app;
• does not track you across apps or websites, and displays no ads. Apple's App Tracking Transparency is not triggered because no tracking occurs;
• does not sell, rent, or "share" your personal information (as those terms are defined under the California CCPA/CPRA or any similar law). Because no such data is collected by the developer, there is nothing to sell;
• does not build advertising or behavioural profiles about you;
• does not use your content to train any machine-learning or AI model.

Tredori's PrivacyInfo manifest, published with the app, declares no tracking and no collected data types, consistent with the above.

5. Data sharing and international transfers

The developer does not share Your Content with anyone. The only third parties involved are the infrastructure providers you already rely on:

• Apple Inc. — provides iCloud storage, push notifications, and in-app purchase processing. Apple acts as your storage/payment provider under Apple's own privacy terms. Where Apple stores or transfers data internationally, it does so under its own safeguards.

Because the developer does not itself receive or export Your Content, the developer does not carry out any international transfer of your personal data. Any cross-border movement of your iCloud content or purchase data is performed by Apple under Apple's contractual safeguards (including, where applicable, the EU Standard Contractual Clauses).

6. How long data is kept (retention)

• Your Content is kept for as long as you keep it in the app. You control it. It is deleted when you delete it, when you erase all data (Section 8), or when you delete the app (local copy) — and, for iCloud copies, when the deletion syncs to your iCloud.
• On-device counters are kept until you erase your data or delete the app.
• Support emails are kept only as long as needed to handle your request.

The developer holds no separate server-side copy of your content and therefore keeps no independent retention of it.

7. Security

• Your Content stays within Apple's security boundary: on-device storage protected by your device passcode/biometrics and iOS Data Protection, and — if enabled — your private, access-controlled CloudKit database protected by your Apple Account credentials.
• The app contains no third-party network endpoints that receive your content.
• No system is perfectly secure, but by keeping data on your device and in your own Apple account, Tredori removes the single biggest risk in most apps: a central developer-controlled database that can be breached. There isn't one.

Please protect your device with a passcode/Face ID/Touch ID and secure your Apple Account (ideally with two-factor authentication).

8. Your rights and how to exercise them

Because your data lives on your device and in your own iCloud, you can exercise most rights directly and instantly, without asking anyone:

• Access & data portability — In the app you can export all your data to a structured, machine-readable JSON file (this satisfies GDPR Art. 15 and Art. 20). Use the "Export data" option in Settings.
• Erasure ("right to be forgotten") — In the app, Settings → Farewell permanently and irreversibly erases all your data, locally and (via sync) from your iCloud. This satisfies GDPR Art. 17 and Apple's account-deletion requirement.
• Rectification — Edit or correct any of your content at any time directly in the app (GDPR Art. 16).
• Restriction / objection — You control all processing yourself; you can stop it by disabling iCloud, revoking permissions, or erasing data (GDPR Art. 18 & 21).
• Withdraw consent — Turn off iCloud sync in iOS Settings, or revoke any device permission, at any time (GDPR Art. 7(3)).

For the limited data the developer may actually hold (i.e. a support email you sent), you can exercise these rights by writing to hello.marcin.apps@outlook.com. The developer will respond within the timeframe required by applicable law (under the GDPR, without undue delay and within one month).

Regional rights

• EU / EEA (GDPR): You have all the rights above and the right to lodge a complaint with your national supervisory authority (in Poland: Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl). No automated decision-making or profiling under Art. 22 takes place.
• United Kingdom (UK GDPR): The same rights apply; you may complain to the Information Commissioner's Office (ICO), ico.org.uk.
• Switzerland (FADP): You have equivalent rights of access, correction, and deletion.
• California (CCPA/CPRA): You have the rights to know, delete, correct, and to opt out of "sale"/"sharing." The developer does not sell or share personal information and does not collect it centrally. Exercising these rights will not result in discrimination.
• Australia (Privacy Act 1988 / Australian Privacy Principles): Equivalent access and correction rights apply. You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC), oaic.gov.au.
• Canada (PIPEDA): Equivalent rights apply; you may complain to the Office of the Privacy Commissioner of Canada (OPC), priv.gc.ca.
• Brazil (LGPD): Equivalent access, correction, and deletion rights apply; the supervisory authority is the ANPD (gov.br/anpd).
• Other jurisdictions: Equivalent access, correction, and deletion rights are honoured through the same in-app tools and the support contact above.

9. Children's privacy

Tredori is intended for adults and is not directed to children. The developer does not knowingly collect personal data from children under the age of 16 (or the minimum age of digital consent in your country, and under 13 for purposes of the U.S. COPPA). Because the developer does not collect content data at all, no such data is knowingly gathered from anyone. If you believe a child has used the app in a way that raises a concern, contact hello.marcin.apps@outlook.com.

10. Health / wellbeing disclaimer

Tredori is a personal-organisation and journaling tool inspired by Wabi-Sabi principles and designed to be gentle for people who identify with ADHD traits. It is not a medical device, not a diagnostic tool, and not a provider of medical, psychological, or therapeutic services. Any content in the app is not health data collected or processed by the developer, and nothing in the app should be treated as medical advice. See also the Terms of Service.

11. Changes to this Policy

If this Policy changes, the developer will update the "Last updated" date and, for material changes, provide notice within the app. Continued use after an update means you accept the revised Policy. Previous versions are available on request.

12. Contact

Questions about privacy, or to exercise your rights:

Marcin Kwaśniewski

Email: hello.marcin.apps@outlook.com

This Policy is provided in English, Polish, German and French. In case of any discrepancy, the version in the language you selected in the app applies to you; where required by mandatory local law, that law prevails.