EVoStickers
Privacy Policy
Effective as of 2026-11-01. This policy explains how personal data is processed in the EVoStickers Android app, the web app at evostickers.app and the services behind them (together the "Service"). The terms of use are on the page Terms.
1. Who is responsible
The controller of your personal data is Mateusz Janicki, an individual developer who publishes the Service under the name EVoApps as an unregistered activity (działalność nierejestrowana, art. 5 of the Polish Entrepreneurs' Law), address ul. Opacka 23/62, 80-330 Gdańsk, Poland, e-mail contact@evostickers.app. Write to this address for any question about your data or to exercise your rights.
2. What we process, why, and on which legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Your EVo account and sign-in (e-mail and password, Google or Apple), password-reset e-mails | E-mail, name, sign-in method, account id. If you sign in with Google or Apple, they tell us your e-mail address and name | Contract, Art. 6(1)(b) |
| Your EVoStickers profile and plan | Account id, e-mail, name, when the profile was created and changed, the number of saved stickers, the storage your attachments use, whether you have Pro and until when, graphics packs you own | Contract, Art. 6(1)(b) |
| Proof that you accepted these terms and this policy | Account id, the versions you accepted, when (our server's time), in which app and on which platform (Android, iOS, web, desktop) | Our legal obligation and legitimate interest in proving the agreement, Art. 6(1)(c) and (f) |
| Saved stickers ("My stickers") and keeping them in sync between your devices | What you put on a sticker: its name, layout, texts, time fields, QR code contents, frames and the paper it prints on, with the times it was created and changed | Contract, Art. 6(1)(b) |
| Attachments behind a sticker's QR code (Pro) | The files you upload (photos, PDF, text, audio, video), their names, types and sizes, the sticker they belong to and the upload time | Contract, Art. 6(1)(b) |
| Contents of your stickers (what is in a box, jar or drawer) | The items you list: name, quantity and unit, place, note, best-before and use-by dates, who added them and when | Contract, Art. 6(1)(b) |
| Households (only when you start or join one) | The household's name, its members' account ids, names and e-mail addresses and their roles, invitations (the invited e-mail address, who invited, when they expire) | Contract, Art. 6(1)(b) |
| Expiry reminders (only when you turn them on) | Your reminder settings (time, quiet hours, days ahead, time zone, language), a push token for each device you turned them on on, the dates your stickers printed and what we already reminded you of | Consent, Art. 6(1)(a) - turn them off at any time in Settings > Reminders |
| Public share links (only when you create one) | The link's random token, the sticker it belongs to, the time it was created | Contract, Art. 6(1)(b) |
| Payments and subscriptions | Account id, purchase and subscription records (product, store, purchase date, end date, trial or paid period); card details are handled only by Google Play or Stripe, never by us | Contract, Art. 6(1)(b); keeping billing records: legal obligation, Art. 6(1)(c) |
| Support requests (when you write to contact@evostickers.app) | Your e-mail with its subject, text and attachment names; your name and e-mail address stay only in our mailbox. The text is recorded as a support ticket without your e-mail address, with e-mail addresses and long numbers (phones, account numbers, PESEL) in it removed | Our legitimate interest in answering you and fixing reported problems, Art. 6(1)(f), or the contract, Art. 6(1)(b), if you use EVoStickers. A person reads and answers every message; nothing is answered automatically |
| Security, preventing abuse, keeping the Service working | App integrity checks through Firebase App Check (Google Play Integrity in the Android app, reCAPTCHA Enterprise in the web app, which evaluates the browser and how the page is used), technical logs with the account id, IP address in server logs | Our legitimate interest in a secure service, Art. 6(1)(f) |
Providing account data is needed to use the Service. EVoStickers shows no ads and currently uses no usage statistics (analytics) and no crash reporting. We don't make decisions about you based solely on automated processing, and we don't sell your data.
3. Photos, attachments and share links
- AI pictures (only when you use "Create with AI"): the description you type and the chosen style are sent to Google's Gemini API, which draws the pictures; Google processes them as our processor and does not use them to train its models. We store your descriptions and the pictures in your account (your latest 50) so you can use them again, and count your credits. Please don't type names, addresses or other personal data into a description - the app refuses e-mail addresses and phone numbers. Descriptions are checked automatically for content we don't allow (terms, section 7).
- Photos on a label stay on your device: the app stores a scaled-down copy there and syncs only a reference to it, not the photo. They are removed from the device when you sign out.
- Attachments (Pro) are uploaded to our storage and are private: only you can open them, signed in. A sticker's QR code is private by default; scanned by anyone else, it shows nothing.
- A public share link is made only when you choose it for a sticker. Anyone who has the link or scans its QR code sees the sticker's name and its attachments (names, sizes and the files, through links that work for 15 minutes) and, only if you turn it on for that sticker, the names, quantities and dates of its contents (never notes or places). Such pages are not indexed by search engines. You can revoke the link at any time: it stops working at once, but copies someone already downloaded stay with them. Please don't attach other people's personal data to a public link unless you are allowed to share it.
3a. Households and reminders
- A household (Pro): everyone in it sees and edits the household's stickers, their contents, attachments and reminders, and sees the members' names and e-mail addresses. Your stickers join when you join and are yours alone again when you leave or are removed. An e-mail invitation stores the invited address until it is accepted, cancelled or expires (7 days).
- The household's stickers belong to the household and depend on its owner's account. When a member deletes their EVoStickers data, the household stickers they made are deleted with it. When the owner deletes their data, every sticker of the household is deleted for all members, whoever made it, with its contents and attachments; the household goes on, empty, with the member who joined first as its owner. The app warns the owner before they confirm. Stickers a member keeps outside the household are not affected.
- Push reminders are off until you turn them on and your device or browser allows notifications. We then keep a push token for that device (Firebase Cloud Messaging, Google) and send at most one reminder a day at the time you chose, never in your quiet hours. Turning them off, signing out or deleting your data removes the device's token.
4. Bluetooth, USB, camera, microphone and location
Printing happens on your device; we don't receive what you print. Bluetooth connects the app to label printers (in the web app through the browser's Web Bluetooth); the Android app can also use printers connected by USB. On Android 11 and older the system requires the location permission for Bluetooth scanning; the app does not collect your location. Photos and files are picked with your system's picker; the camera opens only when you choose "Take a photo" to scan text.
Scan text and dictation. "Scan text" reads text from a photo you take or choose. In the Android app the text is recognised on your device by Google's ML Kit (its model comes with Google Play services); in the web app by tesseract.js in your browser - the reader and its language data are downloaded from our own website on the first scan, like the rest of the app. The photo and the text are not sent to us or anyone else, and the photo isn't kept. "Dictate" uses the microphone only while its window is open and listening; nothing is recorded or stored by the app. On Android the speech is turned into text by your phone's speech recognition, on the device where the phone has the offline language (Android 12 and newer); otherwise your phone's speech service (usually Google's) may process the audio. In the web app the browser's speech recognition is used, and Chrome, Edge and Safari may send the audio to Google, Microsoft or Apple to recognise it - under their privacy terms, not ours. The words come back only into the field you dictate into.
5. Storage on your device and in the browser
The app keeps what it needs to work on your device: the sign-in session (in the web app, with "Remember me" off, only until the browser is closed), with "Remember me" on the e-mail address you signed in with, a copy of your stickers and their sync state, your photos (in the web app in the browser's IndexedDB), the paper and printer you chose and downloaded graphics packs and fonts. Signing out removes your stickers and photos from the device. The web app sets no advertising or analytics cookies; Google's reCAPTCHA (App Check, above) may set a security cookie needed to protect the Service. When you buy Pro on the web, the checkout is a page of RevenueCat and Stripe, which apply their own rules.
6. Who receives the data (processors)
We use these service providers, bound by data processing agreements, only for the purposes above:
- Google (Google Ireland Ltd. / Google LLC): Firebase - authentication (including Google sign-in), database and file storage (stored in Warsaw, Poland), Cloud Functions (Warsaw), hosting, Cloud Messaging (push reminders), App Check with Play Integrity and reCAPTCHA Enterprise; Gemini API (AI pictures, only when you use them); Google Play (Android purchases).
- RevenueCat (RevenueCat Inc., USA): managing subscriptions and purchases.
- Stripe (Stripe Payments Europe Ltd., Ireland, with Stripe Inc., USA): web payments.
- For support requests: Cloudflare (Cloudflare, Inc., USA) receives and forwards the e-mail, it is stored in our mailbox at Google (Gmail), and its text, without your e-mail address, is recorded as a ticket in a private repository at GitHub (GitHub, Inc., USA), where Claude by Anthropic (Anthropic Ireland, Ltd. / Anthropic PBC, USA) helps us categorise it and draft a reply or a fix.
If you choose Sign in with Apple, Apple (Apple Distribution International Ltd.) confirms your identity to us under its own privacy policy. People you give a public share link to receive what that link shows (section 3). Authorities receive data only where the law requires it.
7. Transfers outside the EEA
Some providers above process data in the USA. Such transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
8. How long we keep data
- Profile, saved stickers and settings: until you delete them or your EVoStickers data.
- Attachments: until you delete them, the sticker they belong to or your EVoStickers data. When Pro ends, your stickers and attachments are kept; you just can't add more past the free limit.
- Contents and households: until you remove them, the sticker, leave the household or delete your EVoStickers data. Invitations: until accepted, cancelled or 7 days old.
- Reminder settings and push tokens: until you turn reminders off, sign out on that device or delete your data; tokens a device no longer accepts are deleted at the next reminder. Prints with a printed date are kept until that date has passed (otherwise 90 days).
- Share links: until you revoke them or delete the sticker or your EVoStickers data.
- Billing records: as long as tax and accounting law requires (in Poland generally 5 years from the end of the year).
- Technical logs: for the retention period of Google Cloud Logging (30 days by default).
- Support requests: up to 12 months after the matter is closed, unless we need them longer to establish or defend legal claims.
- Recovery copies: deleted data and files can remain in our providers' recovery copies for up to 7 days before they expire.
9. Your rights
You have the right to access your data and receive a copy, to rectify it, to have it erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest.
- Copy of your data: write to us and we will send it to you.
- Delete your data: Settings > Delete my EVoStickers data (you confirm it by signing in again), or an e-mail to us. This deletes your saved stickers, their contents, attachments, share links, reminder settings and push tokens and your EVoStickers profile; you leave your household (if you own it, every sticker of the household is deleted for all its members and the household passes, empty, to the member who joined first - see 3a), and items you added to others' stickers stay with them without your account id, and your customer record at RevenueCat. It does not cancel a running subscription in Google Play or on the web: cancel it there (see the Terms).
- One EVo account for the EVoApps apps: EVoStickers, EVoShift and EVoLabels are all provided by us (EVoApps), and one EVo account (e-mail and password, Google or Apple sign-in) can sign you in to each of them. Each app keeps its own data and profile; EVoStickers doesn't see your data in the other apps, nor they yours here. Deleting your EVoStickers data keeps your sign-in if another EVoApps app still has a profile for it; otherwise the sign-in is deleted too. If your sign-in is deleted elsewhere, your EVoStickers data is deleted with it. A new password or sign-in method you set applies to all these apps.
We answer requests within one month. You can also lodge a complaint with the supervisory authority: in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority in your country of residence.
10. Security
Data is encrypted in transit and at rest by our providers; access is restricted by tested database and storage rules, so that only you can read your stickers and files. Files are never public: a share link only hands out short-lived links to them. If a breach affects your data in a way that is likely to result in a high risk, we will inform you without undue delay.
11. Children
The Service is not directed at children. We don't knowingly collect data from children under 16 without their parent's consent; if you believe a child has given us data, contact us and we will delete it.
12. Changes
We will update this page when the processing changes and show the new effective date; material changes will also be announced in the app.