Gaudebo Privacy Policy

What we collect, why, who processes it for us, and how to delete it.

Last updated: 13 November 2026

1. Controller

The controller of your personal data is Paweł Kornosz, contact: hello@gaudebo.org. We answer within 30 days at the latest.

We have not appointed a data protection officer — all matters are handled by the controller at the address above.

2. Data about faith — legal basis

Gaudebo is a Catholic app, so using it says something about your religious beliefs. Data about religious beliefs is a special category of data (Article 9 GDPR) and we process it only on the basis of your explicit consent, which we ask for when you create an account.

You can withdraw consent at any time — in account settings or by writing to us. Withdrawal does not affect the lawfulness of processing before it, and in practice it means deleting your account and the religious content tied to it.

Public content — prayers, readings, the calendar — can be browsed without an account and without consent. We then do not know who you are.

3. What we collect

Account: email address, display name (if you give one), language, country, chosen theme and accessibility settings.

Practices and progress: the practices you set up, their completions, challenges and achievements.

Journal: the text of your entries. We store it encrypted with a key we manage — which means we could technically decrypt it, and that is why we do not call it end-to-end encryption. We do not read entries and no administrative role has access to them.

Conversations with the Companion: your messages and the model’s replies.

Communities: the communities you belong to, what you publish in them, and the reports you file.

Technical: request identifier, time, error type. We do not store users’ IP addresses in application logs and we use no analytics or advertising tools.

4. Why we need it

To make the app work: show your daily plan, save completions, remember settings and send your sign-in code (basis: consent under Article 9 GDPR and performance of a contract — Article 6(1)(b)).

To keep order in communities: handling reports and blocking abuse (basis: legitimate interest — Article 6(1)(f)).

To keep the service secure: limiting sign-in attempts and detecting abuse (basis: legitimate interest).

We do not profile you, we make no automated decisions with legal effects about you, and we sell data to no one.

5. Who processes data for us

Google Cloud — servers, database and file storage. Application data is held in the Warsaw region (europe-central2).

home.pl — the mail server we use to send sign-in codes.

OpenAI — the language model behind the Companion. We send the content of your messages to it; data retention is switched off on the provider’s side, so it is not kept there or used to train models. If you do not use the Companion, nothing goes there.

ElevenLabs — speech synthesis. We send only prayer texts from our own catalogue. None of your data goes there.

Expo — delivery of mobile app updates. Technical device data is passed, not content.

We have a data processing agreement, or the provider’s standard data processing terms, with each of them.

6. Transfers outside the European Economic Area

Application data is stored in the European Union. The exception is conversations with the Companion, which may also be processed by OpenAI outside the EEA under the European Commission’s standard contractual clauses.

7. How long we keep data

Account data — until the account is deleted. After you request deletion the account is inactive, sessions are revoked immediately, and data is erased after a 7-day grace period (time to change your mind; during it you can withdraw the request by writing to us).

We keep the history of consents longer than the account itself, to the extent needed to show that consent was given and withdrawn — this is the GDPR accountability requirement.

Technical logs are kept for up to 30 days.

8. Your rights

You have the right to access your data, rectify it, erase it, restrict processing, data portability, and to object to processing based on legitimate interest. You can withdraw consent at any time.

To exercise any of these, write to hello@gaudebo.org. You can also delete your account yourself — in the app under Settings, or on the website after signing in.

You also have the right to lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or with the authority in your country of residence.

9. Cookies

On the website we use only essential cookies: the session cookie (after you sign in) and cookies remembering language, theme and accessibility settings.

We use no analytics or advertising cookies, so we do not ask for consent to them — there is nothing to consent to.

10. Children

Gaudebo is intended for people aged 16 and over. We do not knowingly collect data from younger people. If we learn that an account belongs to someone under 16, we will delete it.

11. Changes to this policy

We announce changes in the app and on this page, and for significant changes by email. The date of the last change is at the top of the document.