Privacy Policy

This is an English translation provided for convenience. The binding version is the Polish one: Polityka prywatności (PL).

In force from 6 November 2026 (previous version: 31 October 2026)

Who is the data controller

The controller of personal data is Bartłomiej Kowalczyk, ul. Ogrodowa 23, Wołczkowo, a natural person carrying out unregistered business activity. Contact on data matters: zdawalni.support@gmail.com.

This policy applies to the zdawalni.pl (formerly skrotbm.pl) and plan.skrotbm.pl services (the “Service”).

What data we collect, why and on what legal basis

Purpose	Data	Legal basis (GDPR (RODO))
Logging in (code from an e-mail or password) and assigning purchased access	e-mail address, account identifier, password (if you set one; stored only as an encrypted hash)	performance of a contract (art. 6(1)(b))
Selling and providing paid access	date and amount of purchase, payment identifier, access end date	performance of a contract (point b)
Tax and accounting obligations	payment data	legal obligation (point c)
Operation of the Service: study progress, quiz results, selected class group	data entered or generated by you in the app	performance of a contract (point b)
My materials: processing the files you upload	text of the uploaded file (sent to the AI only for the time needed to prepare the summary; we do not store it), the finished summary, flashcards and quiz, file name and type, names of your sections	performance of a contract (point b)
Ranking and games: ranking points, year statistics, protecting the fairness of the ranking	game result, correctness and choice of answers, and time (up to 12 months), attempts in Word of the day, nickname and ranking visibility setting, class group	performance of a contract (point b) and legitimate interest: a fair ranking (point f)
Referral programme: referral code, calculating and paying out rewards, preventing abuse	code owner: full name, the code, payout details (phone number for BLIK or a bank account number with full name), the list of purchases made with their code (the owner sees only the date and status, never the buyer's data), payout dates; buyer: the code used, e-mail address and payment identifier	performance of a contract (point b), legal obligation for settlements (point c) and legitimate interest: preventing abuse (point f)
Error reports you send	content of the report or of the deadline, link to your account	legitimate interest: improving the materials (point f)
Handling messages, complaints and withdrawals	e-mail address, content of correspondence	performance of a contract and legitimate interest (points b and f)
Security and technical operation (logs, preventing abuse and sharing of access with third parties): device limit, one active session, detecting accounts used by several people	random device identifier stored in the browser, device and browser name (e.g. “iPhone · Safari”), IP address, dates and times of use, history of adding and removing devices and of session takeovers, any warning or block	legitimate interest (point f) and performance of a contract (point b)
Account security and running the Service: login and visit history visible to the administrator (detecting unauthorised access, helping with login problems)	account e-mail address, date and time of login and login method (code, password, link), dates, times and length of visits of the logged-in account, device and browser name, IP address	legitimate interest (point f)
Waiting list for a programme that is not available yet (“Other programme” form)	e-mail address, programme, year and mode of study, link source, a hash of the IP address (not the address itself, for one day, to prevent spam)	consent (point a), which you withdraw with the link in the e-mail
E-mail reminders (only if you turn them on in Settings)	e-mail address, chosen time and types of reminders, dates of your upcoming exams, number of overdue reviews and rematches, study days, history of sent reminders (without content)	consent (point a), which you withdraw in Settings or with the link in every e-mail
Checking a solution from a photo	photo of the page with your solution (downscaled in the browser, not stored by us), the task; in the database only the fact that a check took place (for the daily limit)	performance of a contract (point b)
Defending against claims and proof of consent to the immediate delivery of digital content	data necessary to demonstrate the facts	legitimate interest (point f)

Providing your e-mail address is voluntary, but without it you cannot create an account or open materials (including free ones). Card details and other data needed for payment go directly to Stripe and are not stored by us. We do not process special categories of data. We do not profile you and we do not make automated decisions about you that produce legal effects.

Ranking and games. When you play or answer questions, we record the result, whether your answers were correct, and the time (for up to 12 months), in order to calculate points and year statistics. In the ranking we show only the nickname you have chosen and your points – and only if you switch visibility on yourself; you can switch it off at any time (More → Ranking). Year statistics are aggregated and we show them only once at least 5 people are included. The class representative (starosta) can see rounds flagged as suspicious (e-mail address, game, result), in order to protect the fairness of the ranking.

Word of the day, Ladder and Boss before the test. We also record which answer you chose, in order to show the distribution of answers across the year (the “Ask your year” lifeline); the distribution is aggregated and visible only once at least 5 people are included. In Word of the day we record your attempts for the given day; we delete them after 12 months. Boss before the test counts hits from correct answers given by the whole year in the given subject; on the top list we show only the nicknames of people who have switched on visibility in the ranking themselves.

Who we share data with

We use providers that are necessary for the Service to work:

Supabase – database and login (accounts, access, study progress, reports, deadlines),
Resend – sending e-mails with login codes, reminders and waiting-list e-mails,
Stripe Payments Europe, Ltd. – payment processing; to the extent required by law (e.g. for fraud prevention), Stripe acts as a separate controller,
Anthropic PBC (USA) – processing the content of files uploaded in “My materials” (summary, flashcards, quiz); the text of the file is sent only for the time needed to prepare the summary and is not stored by us; the transfer is based on standard contractual clauses. Answers you type in practice tests (without your name or e-mail address) are sent to Anthropic PBC, the AI model provider, solely to grade them. A photo of your solution is also sent for AI assessment when you click “Check my solution from a photo” (together with the task and the answer key; we do not store the photo or the result), as well as public university documents (e.g. the syllabus and timetable) that the administrator sends to be read; such a file is deleted after 30 days at the latest,
GitHub Pages – hosting of the Service's pages,
Google (Gmail) – the zdawalni.support@gmail.com mailbox, which receives correspondence,
Microsoft (Outlook) – the former skrotbm@outlook.com mailbox, which may still receive some correspondence,
Google Fonts (fonts), jsDelivr (login library) and cdnjs (Cloudflare) (libraries for reading files and displaying formulas: JSZip, pdf.js, MathJax) – servers from which parts of the page are loaded; they see your IP address and browser data when the page loads,
domain registrar – maintaining the zdawalni.pl and skrotbm.pl domains; it has no access to user data,
public authorities and courts – only where required by law.

We do not sell data and we do not use it for advertising.

Transfers of data outside the EEA

Some of the providers listed (e.g. Anthropic, Resend, Microsoft, GitHub, Google, Cloudflare, Supabase, Stripe) may process data outside the European Economic Area, in particular in the USA. This is done on the basis of GDPR mechanisms: a European Commission adequacy decision (e.g. the EU–US Data Privacy Framework) or standard contractual clauses. You can obtain information about the safeguards by writing to the contact address.

How long we keep data

Account and progress data: until the account is deleted. You can delete your account yourself in Settings (Account → Delete account) or by writing to us. Together with the account we delete your progress, My materials, points, coins, referral code and payout details; error reports about materials remain without information about who sent them. We may delete unused accounts 12 months after access ends.
Payment data: the transaction history is kept by the payment operator (Stripe) for the period required by tax law (usually 5 years from the end of the tax year). After the account is deleted we do not keep it in our database.
Waiting list: until your programme launches or until you remove the sign-up with the link in the e-mail; unconfirmed sign-ups are deleted after 30 days.
E-mail reminders: settings until you turn reminders off or delete the account; history of sent reminders 180 days.
Photo check: the record of a check (for the daily limit) 90 days; we do not store the photo.
Correspondence and complaints: until the matter is resolved and until claims become time-barred.
Error reports: until they are dealt with.
Referral programme: the code and payout details until the code or account is deleted; records of referrals and payouts for the period required by tax law and until claims become time-barred.
Login and visit history: 12 months from the event, after which it is deleted automatically.
Game results and ranking answers: 12 months, after which they are deleted automatically.
Device list and history of its changes: for the duration of Access and up to 12 months after it ends (devices unused for 60 days disappear from the list, and their history is kept until then).
Technical logs: kept by infrastructure providers (hosting, Supabase) for the periods set in their own policies.

Your rights

You have the right to access your data and receive a copy of it, to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest (on grounds relating to your particular situation). Write to zdawalni.support@gmail.com; we will reply within one month. We may ask you to confirm your identity, e.g. by sending a message from your account address.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO) (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

Cookies and browser storage

We do not use advertising or analytics cookies or tracking tools, which is why we do not display a consent banner. The Service stores in your browser only what it needs to work: the login session, a random device identifier (for the device limit) and your settings (e.g. your selected group). We count visit statistics without cookies or external analytics tools: only how many times a day the site was opened (in total, with the chosen programme and the link source, e.g. Instagram), without data that could identify a person. So that the same browser is not counted several times a day, only the date of the last visit is kept in its storage. Account-based summaries (e.g. how many people came back after a week) are visible only to the administrator, always in groups of at least 5 people. You can delete them in your browser settings, but you will then need to log in again. The Stripe payment page uses its own cookies in accordance with Stripe's policy.

Security and minors

We use an encrypted connection (HTTPS), login with one-time codes or a password (we store passwords only as encrypted hashes; nobody can see them) and restricted access to data. The Service is intended for students; a minor should buy access with the consent of a parent or guardian.

Changes to this policy

The current version is always available on this page. We will inform users with active access of significant changes by e-mail.