Privacy Policy

1. Data controller

The controller of your personal data is Paweł Sobkowiak (the “GadAAC” app). Contact: kontakt@gadaac.com.

2. What data we collect

The app also works without an account — in that case we do not collect any personal data on our server. Once you create an account, we process:

• Account data — your e-mail address and an encrypted password.
• Preferences and settings — the selected text-to-speech voice, tile size and mode, theme, interface language, and other settings (synced across your devices).
• Onboarding survey (optional) — who fills it in (parent / parent with child), the child’s age range, the child’s name (used only for in-app greetings), communication style, interests, motivators, and dislikes. Every field can be skipped (“I’d rather not say”).
• Custom tiles — labels, photos, and category assignments.
• Photo AAC — photos you submit for analysis and the matched symbol labels.
• Songs AAC — the title, the song lyrics, and the matched labels.
• Day plans, weekly templates, First/Then sequences — the content you create.
• Data stored locally on your device (never sent to our server) — your recent-sentence history, tile usage statistics (for suggestions), and an AI-suggestion cache; these are cleared when you uninstall the app.
• Sentences built in the app — their content is not stored by us on the server.

Special-category data. Some content (communication style, information about the child, photos) may indirectly reveal data about health or disability. We process it solely to make the app work for you, on the basis of your explicit consent (see section 4).

The app is free — we do not collect any payment data or subscription information.

3. Why we process your data

• To let you sign in and sync your settings.
• To store and display your content (custom tiles, day plans, sequences) across your devices.
• To run the AI features (symbol suggestions, Photo AAC, Songs AAC).
• To personalise the app based on the onboarding survey.
• To keep the service secure and working correctly.

4. Legal bases

• Account, sign-in, sync, and storage of your content — performance of a contract (Art. 6(1)(b) GDPR).
• AI features and the onboarding survey — consent (Art. 6(1)(a)), and for special-category data — explicit consent (Art. 9(2)(a)). You can withdraw consent at any time.
• Service security and correct operation — legitimate interest (Art. 6(1)(f)).

5. Third-party services and transfers outside the EEA

• Supabase — storage of account data, preferences, and your content. Servers in the EU.
• Google (Gemini API) — when you use the AI features, we send content to Google for analysis: in Photo AAC — your photo; in Songs — the song lyrics; in suggestions — the list of available symbols and the context of the sentence being built. Google may process this data outside the European Economic Area (in the US); the transfer relies on Standard Contractual Clauses (SCC). AI traffic goes through our proxy server (the API key stays server-side).
• ARASAAC (Centro Aragonés para la Comunicación Aumentativa y Alternativa) — pictograms loaded from the public CDN; we send only the pictogram number, no personal data. License CC BY-NC-SA 4.0.
• Firebase Hosting (Google) — hosting of the web version; may involve processing outside the EEA under Standard Contractual Clauses (SCC).

6. Device permissions

The mobile app may ask for access to the following device features:

• Photo library — to pick a photo for a custom tile or for analysis (Photo AAC).

Photos go to a private store tied to your account and are not publicly accessible — the app reads them via signed, expiring URLs.

7. Data retention

We keep your data for as long as you have an active account. You can delete your account at any time in the app (Settings → Account → Delete account); deleting your account permanently erases your data. Data stored locally is cleared when you uninstall the app. The app also works without an account — in that case we do not collect any personal data.

8. Your rights

Under the GDPR, you have the right to:

• Access your data.
• Rectify inaccurate data.
• Erase your data (the “right to be forgotten”).
• Restrict processing.
• Object to processing.
• Data portability.
• Withdraw consent at any time.

You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).

You can delete your account and its data yourself in the app: Settings → Account → Delete account. To exercise your other rights, write to kontakt@gadaac.com. You can also download a copy of your data in the app: Settings → Account → Download my data.

9. Children

GadAAC supports the communication of neurodivergent people, including children. An account is created and managed by a parent or legal guardian, who provides consent on the child’s behalf. In Poland, consent for information society services is valid on its own from the age of 16; below that, a guardian’s consent is required. We do not knowingly collect data from children without a guardian’s consent.

10. US users (CCPA)

We do not sell or share personal information as defined by the CCPA. California residents have the right to know what data is collected, to have it deleted, and to non-discrimination for exercising these rights; we handle them as described in section 8.

11. Changes to this privacy policy

We will announce significant changes by updating this page (with the date at the top). We encourage you to check back periodically.

12. Contact

Questions about privacy? kontakt@gadaac.com