← Home

Privacy Policy

Last updated: October 2, 2026

1. Data controller

The controller of your personal data is Paweł Sobkowiak (the “GadAAC” app). Contact: kontakt@gadaac.com.

2. What data we collect

The app also works without an account — in that case we do not collect any personal data on our server; the only things we receive are the anonymous usage statistics described below (which you can turn off) and any feedback you choose to send us. Once you create an account, we process:

  • Account data — your e-mail address and an encrypted password.
  • Preferences and settings — the selected text-to-speech voice, tile size and mode, theme, interface language, and other settings (synced across your devices).
  • Onboarding survey (optional) — who fills it in (parent / parent with child), the child’s age range, the child’s name (used only for in-app greetings), communication style, interests, motivators, and dislikes. Every field can be skipped (“I’d rather not say”).
  • Custom tiles — labels, photos, and category assignments.
  • Photo AAC — photos you submit for analysis and the matched symbol labels.
  • Songs AAC — the title, the song lyrics, and the matched labels.
  • Day plans, weekly templates, First/Then sequences — the content you create.
  • Feedback (optional, also without an account) — the message you send us from the app (Menu → Feedback), its type (bug / idea / other), a reply e-mail address if you choose to give one, and technical context (app version, platform, interface language). When you are signed in, the message is linked to your account so that we can reply.
  • Data stored locally on your device (never sent to our server) — your recent-sentence history, tile usage statistics (for suggestions), and an AI-suggestion cache; these are cleared when you uninstall the app.
  • Sentences built in the app — their content is not stored by us on the server.
  • Anonymous usage statistics (all users, unless turned off) — events such as “a tile was tapped” or “a sentence was played”, with no content: no tile names, no sentence text, no search queries, no account identifiers. Events carry a random identifier that is not linked to your account, plus coarse technical context (app version, platform, device and browser type, operating-system version, device language, interface language) and an approximate location (at most country, region, and city — never a precise position) derived from the IP address when the event is received; the IP address itself is not stored with events. This also includes technical error and crash reports when the mobile app, web app, or website malfunctions (the type of failure and the place in our code where it happened — never the content of your communication). You can turn this off in the app at any time: Menu → Privacy. The gadaac.com website collects the same kind of anonymous statistics (page views and clicks on links to the app) — without cookies and without storing anything in your browser, and we honor your browser’s “Do Not Track” setting.

Special-category data. Some content (communication style, information about the child, photos) may indirectly reveal data about health or disability. We process it solely to make the app work for you, on the basis of your explicit consent (see section 4).

The app is free — we do not collect any payment data or subscription information.

3. Why we process your data

  • To let you sign in and sync your settings.
  • To store and display your content (custom tiles, day plans, sequences) across your devices.
  • To run the AI features (symbol suggestions, Photo AAC, Songs AAC).
  • To personalise the app based on the onboarding survey.
  • To keep the service secure and working correctly.
  • To understand which features are used and improve the app (anonymous usage statistics).
  • To answer feedback and fix reported problems.

4. Legal bases

  • Account, sign-in, sync, and storage of your content — performance of a contract (Art. 6(1)(b) GDPR).
  • AI features and the onboarding survey — consent (Art. 6(1)(a)), and for special-category data — explicit consent (Art. 9(2)(a)). You can withdraw consent at any time.
  • Service security and correct operation — legitimate interest (Art. 6(1)(f)).
  • Anonymous usage statistics — legitimate interest (Art. 6(1)(f)): improving the app. The events contain no communication content and are not linked to your account, and you can disable collection at any time in the app (Menu → Privacy).

5. Third-party services and transfers outside the EEA

  • Supabase — storage of account data, preferences, and your content. Servers in the EU.
  • Resend — sending account e-mails (sign-up confirmation, password reset, e-mail address change); we pass on your e-mail address and the message content. E-mails are sent from servers in the EU (Ireland); the provider is Resend, Inc. (US), so data may be processed outside the EEA under Standard Contractual Clauses (SCC).
  • Google (Gemini API) — when you use the AI features, we send content to Google for analysis: in Photo AAC — your photo; in Songs — the song lyrics; in suggestions — the list of available symbols and the context of the sentence being built. Google may process this data outside the European Economic Area (in the US); the transfer relies on Standard Contractual Clauses (SCC). AI traffic goes through our proxy server (the API key stays server-side).
  • ARASAAC (Centro Aragonés para la Comunicación Aumentativa y Alternativa) — pictograms loaded from the public CDN; we send only the pictogram number, no personal data. License CC BY-NC-SA 4.0.
  • Firebase Hosting (Google) — hosting of the web version; may involve processing outside the EEA under Standard Contractual Clauses (SCC).
  • PostHog — anonymous usage statistics (PostHog EU Cloud, servers in the EU — Frankfurt). The provider is PostHog Inc. (US); the data stays in the EU, and the data processing agreement includes Standard Contractual Clauses (SCC) as a safeguard.

6. Device permissions

The mobile app may ask for access to the following device features:

  • Photo library — to pick a photo for a custom tile or for analysis (Photo AAC).

Photos go to a private store tied to your account and are not publicly accessible — the app reads them via signed, expiring URLs.

7. Data retention

We keep your data for as long as you have an active account. You can delete your account at any time in the app (Settings → Account → Delete account); deleting your account permanently erases your data. Data stored locally is cleared when you uninstall the app. The app also works without an account — in that case we do not collect any personal data beyond feedback you choose to send us. Feedback is kept until it has been handled; messages linked to an account are deleted with it, and you can ask us to delete a message sent without an account at the address in section 12.

8. Your rights

Under the GDPR, you have the right to:

  • Access your data.
  • Rectify inaccurate data.
  • Erase your data (the “right to be forgotten”).
  • Restrict processing.
  • Object to processing.
  • Data portability.
  • Withdraw consent at any time.

You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).

You can delete your account and its data yourself in the app: Settings → Account → Delete account. To exercise your other rights, write to kontakt@gadaac.com. You can also download a copy of your data in the app: Settings → Account → Download my data.

9. Children

GadAAC supports the communication of neurodivergent people, including children. An account is created and managed by a parent or legal guardian, who provides consent on the child’s behalf. In Poland, consent for information society services is valid on its own from the age of 16; below that, a guardian’s consent is required. We do not knowingly collect data from children without a guardian’s consent.

10. US users (CCPA)

We do not sell or share personal information as defined by the CCPA. California residents have the right to know what data is collected, to have it deleted, and to non-discrimination for exercising these rights; we handle them as described in section 8.

11. Changes to this privacy policy

We will announce significant changes by updating this page (with the date at the top). We encourage you to check back periodically.

12. Contact

Questions about privacy? kontakt@gadaac.com