Privacy Policy

Polarim is operated by Ana Carolina Magalhães ("we", "our", or "us"), an individual developer based in Coimbra, Portugal. This Privacy Policy explains what information the Polarim app collects, how it is stored, and how it is used.

Polarim lets you create stamps and organize them into volumes (collections). When you create an account and use the app, we collect:

• Your email address and password, handled by our authentication provider, Firebase Authentication (or your Google account details if you choose to sign in with Google)
• The display name you enter when signing up
• Stamps you create: titles, places, dates, categories, and notes you type in
• Photos you choose to add to your stamps or profile
• Volume (collection) information, such as titles and organization of your stamps
• Your birthday, only if you choose to add it: the day and month, never the year, along with the yearly birthday badges you earn
• A record of your acceptance of these Terms of Service and this Privacy Policy, including the version accepted and the date
• Crash and error reports, and short app session events used to measure stability, collected by Firebase Crashlytics (see "Third-party services")
• Device integrity checks performed by Firebase App Check, which confirm that requests to our backend come from the genuine Polarim app (see "Third-party services")
• Purchase and subscription information, if you buy Premium, handled by RevenueCat together with the App Store or Google Play (see "Third-party services")

We do not use advertising or analytics SDKs, and we do not track you across other apps or websites. Apart from the crash reports, session events, integrity checks, and purchase information described above, we do not collect device identifiers, usage analytics, or diagnostic data.

Your information is used solely to provide the app's functionality:

• To display and sync your stamps and volumes across your devices
• To show your name and profile photo within the app
• To let you sign in with a password or with Google
• To keep a record of your consent to these documents
• If you add your birthday, to show a birthday greeting in the app on that day and to award a birthday badge once a year. Your birthday is not used for anything else.
• To find and fix crashes and errors so the app stays stable (Firebase Crashlytics)
• To protect our backend from abuse by checking that requests come from the genuine Polarim app on a real device (Firebase App Check)
• To process Premium purchases, restore them on your devices, and check whether your subscription is active (RevenueCat)

Your data is stored in two places: locally on your device (so the app works offline), and in our cloud backend (Firebase, using Cloud Firestore and Cloud Storage) so your stamps and volumes stay in sync across devices.

Photos you add are uploaded to a storage bucket associated with your account. Only your account can create, modify, or delete your own stamps, photos, and volumes. This is enforced at the database level (Firestore and Storage Security Rules), not just in the app.

We use the following third-party service providers to operate Polarim. We do not use advertising networks or analytics/tracking SDKs.

• Firebase (Google): authentication, database (Cloud Firestore), and file storage (Cloud Storage). See Google's Privacy Policy at https://policies.google.com/privacy.
• Google Sign-In: only if you choose to sign in with your Google account, in which case Google processes your sign-in on our behalf.
• Firebase Crashlytics (Google): when the app crashes or runs into an error, it sends a report with technical details: the stack trace, a short note about where in the app the error happened, your device model, operating system and app version, available memory and disk space, the time of the event, and a Crashlytics installation identifier that is random and specific to the app on your device. Error reports include only the type and code of the error, never its message, so they do not contain the content of your memories, photo links, or other personal details. Crashlytics also uses Firebase Sessions to send a short event when the app starts (a random session ID, timestamps, your device model, operating system and app version, and the Firebase installation ID), so crash rates can be measured. Reports and session events are not linked to your name, email address, or account ID. Crashlytics is active only in the released app. See https://firebase.google.com/support/privacy.
• Firebase App Check (Google): checks that requests to our database and file storage come from the genuine Polarim app running on a real device. On iOS it uses Apple's App Attest or DeviceCheck, and on Android it uses Google Play Integrity; these services exchange device attestation tokens with Apple or Google. App Check does not receive your account details, memories, or photos.
• RevenueCat: manages Premium purchases and subscriptions. When you are signed in, the app shares your Polarim account ID (a random identifier, not your email address or name) with RevenueCat so your Premium status follows your account. If you buy Premium, RevenueCat receives the purchase information from the App Store or Google Play (product, price and currency, purchase and expiration dates, and transaction identifiers and receipts), along with basic device and app information. Payments are processed by Apple or Google; we never see or store your payment card details. See RevenueCat's Privacy Policy at https://www.revenuecat.com/privacy.

Polarim asks for device permissions only for features that need them, and you can always say no. The first time you sign in, a "Before We Begin" screen explains why the app can use your photo library and camera; each permission is requested only if you tap "Allow" next to it, and you can continue without allowing either. If you skip them, the app explains again and asks when you open the form to add a memory. The app does not request location/GPS access; the "place" field on a stamp is text you type in yourself.

• Photo Library: so you can choose an existing picture for a stamp or your profile. Permission to save images to your photo library is requested only when you choose to save a memory card there.
• Camera: so you can take a new picture for a stamp.
• Notifications: requested once, right after the "Before We Begin" screen, so Polarim can show the weekly reminder. Reminders are scheduled on your device; we do not send push notifications. You can turn the reminder off at any time in Settings.

We do not sell your data, and we do not share it for advertising purposes. Your data is shared only with the service providers listed in "Third-party services" above, to the extent necessary for them to provide authentication, database, storage, crash reporting, app integrity checks, and purchase management on our behalf.

We retain your account data (stamps, volumes, photos, profile information, birthday and birthday badges, and consent records) for as long as your account is active, so the app can function and stay in sync across your devices.

When you delete your account (see "Account deletion" below), your stamps, photos, volumes, and account record are deleted immediately upon confirmation. We do not keep a backup copy after deletion, except where we are required to retain limited records by applicable law.

Firebase Crashlytics keeps crash reports and their associated identifiers (the Crashlytics installation UUID and the Firebase installation ID) for 90 days. Session events sent through Firebase Sessions follow Firebase's data retention policies. Purchase and subscription records are kept by RevenueCat, Apple, and Google for as long as needed to manage your purchases and to meet their legal and accounting obligations, including after you delete your Polarim account.

You can permanently delete your account and all associated data at any time.

Requests can be submitted from within the Polarim app (Settings → Account → Delete Account) or via the web-based request form on this site.

This action is irreversible: once confirmed, your stamps, photos, volumes, and account record are permanently and immediately removed.

Depending on where you live (including under Brazil's LGPD and the EU/Portugal's GDPR), you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can exercise most of these rights directly from within the app:

• View, edit, or delete any stamp or volume
• Change your profile photo and display name
• Add, change, or remove your birthday
• Review the Terms of Service and Privacy Policy versions you accepted
• Permanently delete your account and all associated data

For any request you can't complete in the app (for example, requesting a copy of your data), contact us through our support form and we will respond within a reasonable time.

Polarim is not directed at children and is not intended for use by anyone under 13 years of age. We do not knowingly collect personal information from anyone under 13. If we become aware that we have collected personal information from a child under this age, we will delete it promptly.

Because we use Firebase (Google Cloud) to run our backend and RevenueCat to manage purchases, your information may be stored and processed in countries other than the one you live in, including the United States. These providers maintain contractual safeguards (including Standard Contractual Clauses) for these transfers to help protect information processed on our behalf, consistent with GDPR and LGPD requirements.

We rely on Firebase Authentication for sign-in, and Firestore/Storage Security Rules to ensure that only your account can read or write your own stamps, photos, and volumes. Data in transit to and from Firebase is encrypted. That said, no method of storage or transmission over the internet is guaranteed to be 100% secure.

We may update this Privacy Policy from time to time. Material changes will require you to review and re-accept the updated policy before continuing to use the app, and the "last updated" date and version at the top of this page will reflect the change.

We process personal information on the following legal bases: performance of a contract (providing the app's core features to you, including Premium if you buy it), your consent (for example, when you accept these documents or choose to add your birthday), and our legitimate interest in keeping the app stable and secure (crash reporting and app integrity checks). If you are located in the European Union, the United Kingdom, or Brazil, applicable data protection law (GDPR or LGPD) governs how we handle your personal information, in addition to the rights described in "Your rights" above.

As an individual developer rather than a company, we act as the data controller for Polarim. Data protection questions or requests can be directed through our support form.

Questions about this Privacy Policy, or requests relating to your personal information, can be sent through our support form.