Privacy Policy
This policy explains what personal data GoodCatch collects, why, how long we keep it and what you can do about it. It covers the GoodCatch apps for Android and iOS and this website.
In short
- We collect only what GoodCatch needs to work: your account, the country and currency you shop in, the products you track and, if you subscribe to GoodCatch Smart or GoodCatch Pro, records of that purchase.
- There are no ads, no analytics or tracking tools, and we never sell your data.
- Your data is stored with Google Firebase. Google Play and Apple handle payments; we never see your card details.
- You can delete your account at any time, in the Android app or by emailing us.
1. Who we are
GoodCatch is developed and run by KOLOBAKA (“we”, “us”). We are the controller of the personal data described in this policy. You can reach us about anything in it at nograveoff@gmail.com.
2. Data we collect
Your account
- Email address and name. You enter them when you create an account, or Google shares them when you choose “Continue with Google”. They are kept by Firebase Authentication and in your GoodCatch profile.
- Password. If you sign up with email, your password goes to Firebase Authentication, which stores it only in hashed form. We can't see it.
- User ID. Firebase Authentication gives your account a random identifier that ties your GoodCatch data together.
- Google profile photo. If you sign in with Google, Google also shares the web address of your profile photo. The app shows the photo in Settings, loading it from Google.
- Account details. How you sign in (email or Google), whether your email address is verified, when you created your account and last signed in, and when your profile was created and last changed.
Where you shop
- Country and currency. You choose the country whose stores GoodCatch shows you and the currency you want to see prices in. Both are saved in your profile. The country is approximate, country-level location: GoodCatch doesn't use GPS or your precise location.
- How we suggest your country. To preselect a country, the Android app looks at the country of your mobile network, then of your SIM card, then the region in your device's language settings; the iOS app uses the region in your device's settings. This happens on your device, and only the country you confirm is saved.
- App language. If you choose a language for GoodCatch, your device keeps that choice. We don't receive it.
Products you track and your searches
- Tracked products. For each product you track we save its ID, the country of its catalogue and when you started tracking it. If you track more products than your plan allows, that date also decides which of them are checked: the ones you've tracked the longest. When you stop tracking a product, this record is deleted.
- Searches. When you search the catalogue, the app sends a word from your search to our database (Cloud Firestore) to find matching products. We don't save your searches or add them to your account.
GoodCatch Smart and GoodCatch Pro purchases
The paid plans, GoodCatch Smart and GoodCatch Pro, are sold by Google Play and Apple's App Store. They take the payment, and we never receive your card, bank or billing details. To give your account the plan you paid for, we handle:
- An account ID for the store. When you buy a paid plan, the app gives the store an identifier made from your user ID with SHA-256, a one-way function. It lets the store's records show which GoodCatch account the purchase belongs to without telling the store your user ID or email address.
- Purchase reports. When the app sees a purchase of a paid plan, it saves a report of it to your account: the store, the product (Smart or Pro), the store's purchase token (Google Play) or original transaction ID (App Store), and when it was reported. They let us check the purchase with the store.
- Subscription records. When we check a purchase with the store, we record which paid plan your account has (Smart or Pro), whether it's billed monthly or yearly, which store and which purchase it comes from, when the paid period ends, whether it will renew, and any change of plan you've scheduled for the next renewal.
Technical data
- Sign-in security. When you sign up or sign in, Firebase Authentication processes your IP address and your device's user agent to protect accounts and prevent abuse.
- Data on your device. The app keeps your sign-in session and a copy of your GoodCatch data on your device, so it opens quickly and works offline. On Android, these are left out of device backups and transfers to a new phone.
- When you contact us. Your email address, what you write to us and our replies.
- This website. Firebase Hosting serves these pages and processes visitors' IP addresses to deliver them, to detect abuse and to give us statistics about visits. The pages set no cookies and contain no scripts, analytics or trackers.
What we don't collect
GoodCatch contains no advertising, analytics or crash-reporting tools and doesn't use your device's advertising ID. It doesn't collect your precise location, contacts, photos, files, messages, phone number, payment details or health information.
3. How we use it and our legal bases
We use your data only for the purposes below. Data protection law in the European Economic Area (EEA), the United Kingdom and Switzerland requires a legal basis for each. We name the bases of the GDPR; the UK GDPR and Swiss law have equivalent ones:
- Contract (Art. 6(1)(b) GDPR): we need the data to provide GoodCatch to you under our Terms of Use.
- Legitimate interests (Art. 6(1)(f) GDPR): we need the data for an interest of ours, named in the table, that doesn't override your rights. You can object to this use.
- Legal obligation (Art. 6(1)(c) GDPR): the law requires us to process the data.
| Purpose and data used | Legal basis |
|---|---|
| Create your account, sign you in, keep you signed in, and send verification and password reset emails Data: Email address, name, password, user ID, account details | Contract |
| Show your country's catalogue, prices in your currency, the products you track and search results Data: Country, currency, tracked products, search words | Contract |
| Sell and provide GoodCatch Smart and GoodCatch Pro: tie each purchase to your account, unlock your plan on your devices and check purchases with the store Data: Account ID for the store, purchase reports, subscription records | Contract |
| Prevent fraud and abuse and keep GoodCatch secure, for example making sure a subscription is used only by the account it was bought for Data: Account ID for the store, purchase reports, subscription records, IP address and user agent | Legitimate interests: protecting GoodCatch and its users |
| Keep records the law requires, such as accounting and tax records Data: Subscription records, where required | Legal obligation |
| Answer your messages and requests, including requests about your data Data: Email address, your messages | Legitimate interests: helping you; for requests about your data, legal obligation |
| Establish, exercise or defend legal claims Data: The records the claim concerns | Legitimate interests: protecting our rights |
Your account details are needed to use GoodCatch: without them we can't create your account or show you a catalogue. We don't use your data for advertising, don't build marketing profiles and don't make decisions about you by purely automated means that have legal or similarly significant effects.
4. Who we share it with
- Google, through Firebase, as our processor. Firebase Authentication runs sign-in, Cloud Firestore holds GoodCatch's database and Firebase Hosting serves this website. Google processes this data only on our instructions, under the Firebase Data Processing and Security Terms. Read more in Privacy and Security in Firebase.
- Google Play and Apple. They sell GoodCatch Smart and GoodCatch Pro, take payment and manage your subscription as independent controllers under their own privacy policies (Google, Apple). The app gives them the account ID described above.
- Google, when you sign in with Google. Google confirms who you are and shares your name, email address and profile photo with GoodCatch. Your Google Account itself is covered by Google's Privacy Policy.
- Authorities and legal claims. We disclose data when the law requires it, or where needed to establish, exercise or defend legal claims or to protect the rights and safety of our users or others.
- A new owner. If GoodCatch is transferred to another developer, your data may be transferred with it and stay covered by this policy. We'll tell you before that happens.
We don't sell your personal data, don't share it for targeted advertising and don't give it to data brokers.
5. Where it is stored
GoodCatch's database (Cloud Firestore) is stored by Google in its eur3 (Europe) location. Firebase Authentication, Firebase Hosting, Google Play and Apple may process data in other countries, including the United States.
When data from the EEA, the United Kingdom or Switzerland is transferred to a country whose data protection hasn't been recognised as adequate, it's protected by safeguards the law recognises. Google relies on the European Commission's Standard Contractual Clauses, which are part of its data processing terms, and on its certification under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. Google Play and Apple transfer data under their own privacy policies.
6. How long we keep it
| Data | How long we keep it |
|---|---|
| Your account, profile (name, email address, country, currency) and purchase reports | Until you delete your account. |
| Tracked products | Until you stop tracking the product or delete your account. |
| Subscription records | While your account exists. Deleting your account in the app doesn't delete them: they stay under your former user ID, without your name or email address, until we no longer need them for accounting, tax, a dispute or fraud prevention; then we delete them. |
| Search words | We don't store them. |
| Sign-in IP addresses and user agents | A few weeks, in Firebase Authentication's logs. |
| IP addresses of visitors to this website | A few months, in Firebase Hosting's logs. |
| Your emails to us | As long as we need them to deal with your request and to keep a record that we did. |
| Copies in Google's backups | Google removes deleted data from its systems, backups included, within 180 days at most. |
| Data on your device | Your sign-in session until you sign out; the offline copy until you uninstall the app or clear its storage. |
7. Your rights
If you're in the EEA, the United Kingdom or Switzerland, and in many other places, you have the right to:
- Access your personal data and get a copy of it.
- Rectification: have inaccurate data about you corrected.
- Erasure: have your data deleted.
- Restriction: have us limit how we use your data, for example while we check a concern you raised.
- Portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another provider where that's technically feasible.
- Objection: object, on grounds relating to your situation, to processing based on our legitimate interests.
- Complaint: complain to a data protection supervisory authority, in particular where you live or work or where you think your rights were infringed. Find yours in the list of EEA authorities or, in the UK, at the Information Commissioner's Office. We'd appreciate the chance to sort out your concern first.
To use these rights, email nograveoff@gmail.com from your GoodCatch account's email address. We may ask you to confirm that the account is yours. We answer within one month; if a request is complex, we may extend this by up to two more months and will tell you why. It's free unless a request is clearly unfounded or excessive.
In the app you can stop tracking products at any time, and in the Android app you can delete your account yourself.
Wherever you live, you can ask us for a copy of your data or ask us to correct or delete it, and we won't treat you differently for asking. We don't sell or share personal information as those terms are defined in US state privacy laws such as California's.
8. Deleting your account
You can delete your account at any time: in the Android app, open the Settings tab and tap Delete account. If you use the iOS app, which can't delete accounts yet, or can't use the app, email us. Delete your GoodCatch account explains both ways and what is deleted and kept.
Deleting your account doesn't cancel a GoodCatch Smart or GoodCatch Pro subscription: cancel it in Google Play or the App Store.
9. Children
GoodCatch is meant for people aged 13 and over and isn't directed at children. We don't knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, contact us and we'll delete it.
10. Security
- Everything the app exchanges with our servers is encrypted in transit (HTTPS), and Google encrypts the database and sign-in data at rest.
- Our database's security rules let each account read and change only its own data. Catalogue prices and subscription records can be written only by our backend.
- Passwords are stored by Firebase Authentication only in hashed form.
- Access to GoodCatch's Firebase project is limited to the people who need it to run GoodCatch.
No system is perfectly secure. If a breach affects your personal data, we'll inform you and the authorities as the law requires.
11. Stores' websites and images
When you open an offer, its web page opens in your browser, and that website's own privacy policy applies. GoodCatch doesn't tell the website who you are.
Product images are loaded from the websites that host them. Like any website, they see your IP address and basic information about your device when it fetches an image.
12. Changes to this policy
We may update this policy when GoodCatch or the law changes. We'll change the date at the top and, for significant changes, tell you in the app or by email before they take effect.
13. Contact us
KOLOBAKA
Email: nograveoff@gmail.com