1. Controller and contact

The controller for data related to this website, contact, and the DOBIERO app is:

  • JMSOFT Jarosław Maladyn
  • sole proprietorship
  • Polish tax ID: 6443323082
  • ul. Sielecka 24/48, 41-200 Sosnowiec, Poland
  • Contact and support email: support@dobiero.com

The controller has not appointed a Data Protection Officer. Privacy and support questions can be sent to the email address above.

2. Scope of this policy

This policy covers the public dobiero.com website, correspondence about DOBIERO, and the DOBIERO mobile app for Android and iPhone. The app is not yet available in app stores. This policy will be checked again against the exact signed artifacts before distribution.

3. How the app uses location

After you knowingly grant permission, DOBIERO uses current precise location to check on your phone whether a nearby app or service may be useful. A background session lasts up to 45 seconds, or up to 150 seconds at a large venue on iPhone. Up to three additional attempts are possible, 1, 2 and 5 minutes after the previous attempt, for up to 40 seconds each. After you move away from the monitored area, one reading lets the app move that area; a failed reading may be retried up to three times, after 1, 2 and 5 minutes. Android shows a separate silent message during the short service, and iOS may show a location indicator. The system may delay or skip an attempt. While the app is open on screen, location keeps the list current. A geofence signals a local check, not proof of a visit.

  • place matching, ranking, and the reminder decision happen on the device
  • DOBIERO does not send precise location to its own server, advertisers, or analytics tools
  • the Release app does not create a coordinate or travel log; it retains limited current state and short-lived markers described below
  • the app creates no user account and has no backend of its own and no telemetry
  • another app or store opens only after a deliberate user tap
  • on Android, whenever Home, the notification, or the widget refreshes, including in the background, the app checks locally for each current suggestion whether that supported app is installed in order to show “Open” or “Get”; it does not list all installed apps, does not store or transmit the result, and ranking does not depend on it

The app uses location based on your consent (Article 6(1)(a) GDPR), given on the in-app location explanation screen with its Continue button and in the system permission dialog. Consent is voluntary: without it, automatic reminders stay off and the rest of the app works. It also covers storing the data described in section 4 on your phone. You can withdraw it at any time by revoking location permission in your phone settings, turning off reminders, or using “Delete local data”; withdrawal does not affect the lawfulness of earlier processing. The controller decides the purpose and means of location use in the app but does not receive this data.

Supported places include shopping centres and retail parks, fuel and charging stations, motorway service areas, car parks, shops, cafés and quick-service restaurants, cinemas, fitness clubs, and parcel points. DOBIERO does not support places that could reveal information about health, religion, political opinions, or sex life, such as pharmacies, medical facilities, or places of worship.

Geofences and readings are handled by the phone's system services: Google Play services on Android and iOS Location Services on iPhone. They work according to your phone settings and Google's or Apple's terms, and keep the areas registered by DOBIERO, including a private area around the last accepted reading, until they are removed. DOBIERO does not pass visit history or matching results to these services.

4. Data that stays on the device

Only data needed for current operation may remain on the device:

  • permission state, settings, and muted items
  • one active visit context, the current suggestion, and a limited check-attempt counter, without coordinates
  • opaque identifiers of regions from a completed visit, valid for 15 minutes after it ends, which prevent another alert when the same stay continues; they contain no coordinates; legacy cooldowns and duplicate-prevention markers are retained separately
  • a limited widget projection without coordinates or URLs; on iPhone it has no installed-app information, and on Android the widget and notification show only the current “Open” or “Get” label, which the app does not save
  • one latest redacted diagnostic code without coordinates; test-only Android Debug has three additional logs (up to 8 MiB, 12 MiB, and 64 KiB), where entries in the 8 MiB and 12 MiB logs older than 7 days, and in the 64 KiB log older than 24 hours, are removed on the next write, without location, place names, services, or visit identifiers, and event codes are also written to the test device's system logcat; test-only iOS Debug may locally record measurements for 7 days, up to 64 MiB; these histories are never transmitted or backed up and are not compiled into the Release app

Settings and muted items remain until changed, removed with “Delete local data,” or the app is uninstalled. Yes/no markers about permission requests are removed the same way, but on Android markers for permissions the phone still withholds remain until the app is uninstalled or local data is deleted again after the permission is granted. The current snapshot expires no later than two hours after the last good reading, visit-continuation records expire 15 minutes after the visit ends, and legacy cooldowns and markers expire no later than seven days. Expired data is no longer used for app decisions; its stored record may be physically removed at the next state read or update, when the system allows the app to run.

5. The dobiero.com website

The website has no accounts, forms, analytics cookies, advertising pixels, or tracking tools. It is delivered using Cloudflare Workers Static Assets, and the public data-release files (the database derived from OpenStreetMap, its checksum file, and its licence notice) are read from a private Cloudflare R2 bucket by one small Cloudflare Worker. The Worker does not store or log requests, and the bucket holds only public data files, with no personal data of users. Cloudflare provides DNS, HTTPS, CDN, and network protection and may automatically process an IP address, request date and time, requested URL, browser type, and technical data needed to deliver the website and protect it from abuse.

This processing is based on the controller’s legitimate interest in providing the website securely and reliably (Article 6(1)(f) GDPR). The controller does not enable Cloudflare Web Analytics, raw HTTP request log retention, or Workers Logs. Cloudflare automatically creates aggregated operational metrics, such as request counts and response statuses, which may be available for up to three months. The controller does not use them to profile users. This period concerns metrics availability, not all network data handled by the provider. Disabling logs available to the controller does not mean Cloudflare processes no network data; its scope and retention criteria are described in Cloudflare’s privacy policy.

6. Contact and service providers

If you contact us, the controller and Google Workspace process addressing data, message content, and attachments to deliver the message, respond, and handle the request. Ordinary inquiries and support are handled on the basis of the controller’s legitimate interest in responding (Article 6(1)(f) GDPR). Article 6(1)(b) GDPR applies only where the matter actually concerns performing a contract or taking steps before entering into one at your request. Data-subject rights requests are handled to comply with legal obligations (Article 6(1)(c), in conjunction with Articles 12–22 GDPR). Providing data is voluntary; without the information needed to contact you or understand the matter, we may be unable to respond. Correspondence is kept until the matter is closed and then at most until the end of the calendar year in which 3 years have passed since it was closed, so that we can respond to a later complaint or claim; longer only where a legal provision requires it. Deletion from the mailbox does not mean immediate deletion from all provider systems; its recovery and retention mechanisms also apply.

Cloudflare and its subprocessors provide the website, release data files (R2), DNS, CDN, and security, while Google and its subprocessors provide Google Workspace email. They may process data globally, including outside the EEA, under the accepted Cloudflare DPA and Google CDPA. Transfers rely on an applicable adequacy decision or Standard Contractual Clauses. To obtain information about the safeguards for a specific transfer and how to receive a copy, contact support@dobiero.com.

Current subprocessor lists are published by Cloudflare and Google Workspace.

DOBIERO does not transfer precise location or visit history from the app to the controller.

7. Control and deletion

  • location and notification permissions can be revoked in phone settings
  • reminders can be disabled in the app
  • “Delete local data” removes DOBIERO’s private state, geofences, and current surfaces; on Android it keeps only markers for permissions the phone still withholds, because without them the app could not tell that it should open settings after a permanent denial
  • the app has no server copy of local data; its private snapshot, widget projection, working catalog copy, app settings, and diagnostic histories described above are excluded from backup, on iPhone through a marker that Apple describes as guidance for the system rather than a guarantee; this exclusion does not cover copies of correspondence and data held by website and email providers

8. Your rights

For data actually processed by the controller, you may request access, rectification, erasure, and restriction of processing under the conditions in the GDPR. Portability applies to data you provided that is processed automatically on the basis of consent or a contract (Article 20 GDPR). You have the right to object to processing based on legitimate interests on grounds relating to your particular situation. Requests can be sent to support@dobiero.com or the controller’s postal address. The controller has no copy of data that exists only on your phone and cannot retrieve or delete it remotely; the local controls described above are provided for this purpose. We respond without undue delay, generally within one month; if the GDPR permits an extension, we will inform you of it and the reason within that period.

You may also lodge a complaint with the President of the Polish Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland. Current contact details and methods are published by UODO.

9. Security and changes

Text version prepared on 12 October 2026. The website uses HTTPS. The app limits stored state, contains no service credentials, and validates external links. We may update this policy when law, providers, or product behavior changes. We will announce material changes on the website at least 14 days before they take effect and, where they concern the app, also in the app. Minor corrections, such as typos or addresses, take effect immediately with a new text version date.

10. Contact

support@dobiero.com