In short: your data (routines, habits, mood, diary) lives only on your device. We run no accounts and collect no personal data on servers. We use Google Analytics (with consent) and Google ads — AdSense on blog pages, AdMob in the iOS app from version 24. Deleting the app permanently deletes your data.
1. Data controller
The data controller for the Protocols web service and iOS app is Zordon Intelligence Sp. z o.o., located in Łódź, Poland (KRS: 0001190915, NIP: 7252358503, REGON: 542545843). Contact: hi@zordonintelligence.pl.
2. Scope
This policy covers both versions of the product: the Protocols web app (browser) and the native Protocols iOS app (App Store). Both operate on a local-first architecture and never transmit your content to our servers.
3. Local-first: where your data lives
Your routines, day schedules, completed habits, friction scores, mood logs and diary entries are stored exclusively on your device: in the web version inside your browser’s local storage (LocalStorage), and on iOS inside the app’s sandbox (SwiftData). This content constitutes wellness-related information — which is precisely why it never leaves your device. We do not use the HealthKit framework or any system health APIs.
4. What we do NOT collect
We collect and process no personal data on servers: there are no user accounts, no application telemetry, and we do not request access to your location, contacts, photos, microphone or camera. We also do not receive payment details — any App Store transactions are handled by Apple. Advertising and analytics are described in sections 15 and 16.
5. Cookies & necessary storage
The web version uses strictly necessary local storage (localStorage) to keep your preferences (EN/PL language), your built routines and completion history — no cookies are set for this. Optional cookies come from Google: analytics (Google Analytics 4) and advertising (Google AdSense) — set only after you give consent (sections 15 and 16). You can clear this data at any time in your browser settings.
6. Data retention & deletion
Your data exists only on your device until you choose to remove it. Web: clear the site data in your browser settings or use the in-app reset option. iOS: deleting the app from your device permanently removes all stored content (SwiftData). There is no server copy to delete.
7. User accounts
The app has no account system — you never register, log in, or hand us identifying data. In line with Apple’s App Store Review Guideline 5.1.1(v), we disclose: because no accounts exist, in-app account deletion does not apply; uninstalling the app performs a complete deletion of your data.
8. Sharing & third parties
We do not sell, rent or share your data with third parties for marketing. Static files of the web app are delivered by a hosting provider (Vercel Inc.), which only serves files and has no access to your routine content. Any App Store purchases are processed by Apple Inc. under Apple’s own terms. On the web and in the iOS app we use Google advertising and analytics services (sections 15 and 16) — we never share your Protocols data (routines, habits, mood, diary) with them.
9. International transfers
Because your data never leaves your device, no transfer to third countries or international data transfer takes place.
10. Security
Local data is stored in the app’s isolated sandbox, protected by the security mechanisms of iOS (device encryption) and your browser. Since data is never transmitted, there is no transport interception risk. We recommend using your device passcode / Face ID.
11. Children’s privacy
Protocols is not directed at children under 13 (or the equivalent minimum age under local law) and we do not knowingly collect any data from children. The product is a general-audience product.
12. Your rights (GDPR)
You have the right to access, rectify, erase, restrict processing of, port, and object to the processing of your data. Because you store the data yourself on your own device, you exercise these rights directly — at any moment you can view, edit, or permanently delete it. Where our intervention is required, write to hi@zordonintelligence.pl. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Poland) or your local supervisory authority.
13. Changes to this policy
Last updated: September 10, 2026. We may update this policy to reflect significant functional changes (for example, introducing optional sync — which we do not currently plan without your consent). The current version is always available on this page and, for the iOS app, in the release notes.
14. Contact
Privacy questions: Zordon Intelligence Sp. z o.o. — hi@zordonintelligence.pl. We usually reply within 1–2 business days.
15. Google Analytics (analytics)
With your consent we use Google Analytics 4 (measurement ID: G-23LQSE6Y3K), provided by Google LLC / Google Ireland Ltd, to understand aggregate site usage (pages visited, approximate country, device type, referral sources). Analytics is enabled only after you give consent — via the “Accept analytics cookies" button in the cookie banner or your previously saved choice. Cookies used: _ga and _ga_* (retained up to 2 years). You may withdraw consent at any time (“Only necessary" or by clearing cookies in your browser) — analytics stays disabled until you explicitly accept. Google’s processing is governed by Google’s Privacy Policy. Your Protocols data (routines, habits, mood) is never shared with Google — analytics receives page-view events only.
16. Advertising (Google AdSense and AdMob)
The web version (blog pages only) and — from version 24 — the iOS app display Google ads. We use Google AdSense on the website and Google AdMob in the iOS app (Google LLC / Google Ireland Ltd). Ads are non-personalised by default; in the iOS app we do not use the advertising identifier (IDFA) and never request App Tracking Transparency permission. Third-party vendors, including Google, may use cookies to serve ads based on your prior visits to this and other websites. Google’s use of advertising cookies enables it and its partners to serve ads based on your visits to this site and/or other sites. You can opt out of personalised advertising in Google Ads Settings (https://www.google.com/settings/ads) and at https://www.aboutads.info. Users in the EEA and UK are shown a TCF-compliant consent form; without consent we serve non-personalised ads only. Ads have no access to your Protocols data — routines, habits, mood and diary stay on your device. Ads are never shown on onboarding, settings, paywall, action timer or empty-state screens.
