Privacy

Who is responsible for your data

The controller of your personal data, in the meaning of the General Data Protection Regulation (GDPR, in Poland: RODO), is:

Paweł Szczabel
ul. Wygonowa 51/2A, 45-402 Opole, Poland
NIP 9910361892
forpeace.contact@gmail.com

There is no obligation to appoint a Data Protection Officer for a service of this size, and none has been appointed. Write to the address above for anything in this policy.

What is public

Three things are visible to anyone, including people who are not signed in. Your city appears on the peace map as a marker with a count of how many people pledge hours there. Your display name and country appear in the live list while you are praying, and are included in the invitation others receive when you begin. The coverage grid shows how many people hold each hour of the week, without identifying any of them.

You can turn all of this off in Settings. With map presence disabled, your marker is removed, your name never appears in the live list, the invitation others receive when you begin carries no name or country, and you are counted only in anonymous totals.

Information we collect

• Account information, including your email address, verification status, and authentication records.
• Profile information, including your display name, selected city or metro area, approximate city-centre coordinates, country code, time zone, locale, and your notification and map preferences. We do not request GPS or a street address.
• Your prayer schedule: the weekday, start and end time, and time zone of each hour you pledge, and the record of each prayer you start and end. The service does not ask for or store the content of your prayer.
• Notification information, including push subscription endpoints, browser-provided device details, delivery attempts, and delivery results.
• Technical and security information needed to operate, diagnose, and protect the service.

Why we may use it, and on what legal basis

• To run your account and the watch — creating your account, storing the hours you pledge, computing the coverage grid, and starting and ending prayers. This is necessary to provide the service you asked for (Article 6(1)(b) GDPR).
• To send push notifications — reminders before your hours and invitations when someone else begins. These run on your consent, given when you enable them, and you can withdraw it at any time in Settings or in your browser (Article 6(1)(a) GDPR).
• To show you publicly — your display name, country and city marker. This too runs on your consent, given by leaving map presence on, and withdrawing it takes effect immediately (Article 6(1)(a) GDPR).
• To keep the service safe and working — rate limits, abuse prevention, diagnosing faults, and protecting against fraudulent sign-ups. This rests on our legitimate interest in a service that functions and is not abused (Article 6(1)(f) GDPR).
• To meet legal duties — where accounting or tax law requires a record to be kept, including in connection with donations (Article 6(1)(c) GDPR).

Providing your data is voluntary, but an email address and a display name are needed to have an account at all. There is no automated decision-making and no profiling that produces legal or similarly significant effects.

Notifications

Reminders before your own hours are sent only while reminders are enabled. Invitations to join someone else who has begun praying are sent only while invitations are enabled, are capped by the daily limit you choose in your own calendar day, and are further limited so that no more than one arrives in any thirty-minute period. You are never sent an invitation while you are already praying. An invitation names the person who started only when they have map presence enabled; otherwise it says that somebody has begun and nothing more.

Donations

Supporting forPEACE is voluntary and unlocks nothing. The checkout is operated by Easytools sp. z o.o., al. Rzeczypospolitej 10/46, 02-972 Warszawa, KRS 0001002028, NIP 9512554309, which handles the order and the payment in the name and on behalf of the controller named at the top of this policy. Card payments are processed by Stripe.

The app is never told that a donation happened, or by whom. That is a property of how the feature is built rather than a promise: the Donate button is an ordinary link to Easytools’ checkout page, and there is no webhook, no interface, and no record anywhere in this service that could connect a payment to an account. Nobody who gives is marked, listed, or treated differently anywhere in the app, and no page could reveal who gave, because nothing here knows.

That is not the same as saying the donation is anonymous. Your card details go to Stripe and are never seen by us. But the details you enter at the checkout, such as your name and email address, are held in the Easytools and Stripe accounts belonging to the controller named above, who can see them there as the recipient of the donation and who is the controller of that data. Easytools processes it on that controller’s behalf; Stripe additionally acts as its own controller for payment processing, fraud prevention, and its own legal duties. Receipts come from Easytools.

Donation records are kept for as long as accounting and tax law requires them to be kept, and are not used for anything else. In particular, they are never matched against your forPEACE account, because there is nothing in the service to match them to.

Who else processes your information

We use the following providers. Except where noted, they process data on our behalf as processors, under written terms, and only on our instructions.

• Convex — the database and authentication behind the app. It holds your account, profile, schedule, and notification records.
• Vercel — hosting and delivery of the website, and anonymous traffic measurement through Vercel Web Analytics, which does not use cookies and does not build a profile of you.
• Resend — the delivery of account email only: your sign-up verification code and password reset code. Resend receives your email address and the contents of those messages. It is not used for marketing, and forPEACE sends no newsletter.
• Mapbox — city search and map display. Mapbox may receive your search terms, IP address, and technical request information under its own terms.
• Easytools — the donation checkout, operated on our behalf, holding what you enter there.
• Stripe — processing of donation card payments, also as its own controller for payment processing, fraud prevention, and its own legal duties.

We do not sell personal information and we do not share it for advertising. Information may also be disclosed where the law requires it.

Transfers outside the European Economic Area

Several of the providers above are established in the United States, so your information may be processed outside the EEA. Those transfers are made on the safeguards set out in the providers’ own data processing terms, which include the European Commission’s Standard Contractual Clauses where they apply. Ask at the address above if you would like more detail on a particular provider.

How long we keep it

• Your account, profile, schedule, and prayer history — until you delete your account, which you can do yourself at any time.
• Notification delivery records — deleted with your account.
• Anonymous city, country, and coverage totals — kept without a fixed expiry, because they identify nobody. Deleting your account removes your contribution to them, so the numbers go down.
• Records that law requires us to keep, including accounting records connected with donations — for the period that law prescribes, and no longer.

Deleting your account

Settings has a Delete my account button. It removes your profile, your email address and the account behind it, your devices, your schedule and your prayer history, gives back every hour you had pledged, and stops your city being counted on the map. It takes effect immediately and cannot be undone. You do not need to ask anyone.

Your rights

Under the GDPR you have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected, and incomplete data completed;
• have your data erased;
• restrict how we process it;
• receive the data you gave us in a portable, machine-readable form;
• object to processing that rests on legitimate interests, including on grounds relating to your particular situation;
• withdraw a consent at any time, without affecting anything done on that consent before you withdrew it.

Many of these you can exercise yourself in Settings, immediately and without asking: change your name or city, turn map presence off, turn notifications off, or delete the account outright. For anything else, write to forpeace.contact@gmail.com. We answer within one month, and will say so if a request needs longer.

If you think your data is handled wrongly, you may lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland (https://uodo.gov.pl).

Cookies and similar technology

forPEACE uses a session cookie to keep you signed in, and local browser storage for your notification and installation preferences. These are necessary for the service to work and are not used for advertising or for tracking you across other sites. The analytics described above set no cookie.

Security and who may take part

We use reasonable administrative and technical safeguards, but no online service can guarantee absolute security. forPEACE sets no age limit of its own. If you are a parent or guardian and want an account removed, write to the address above and we will delete it.

Changes and contact

We may update this policy and will post a new version and effective date. For privacy questions or requests, write to forpeace.contact@gmail.com or visit Support.