🔒 Privacy Policy

Last updated: November 12, 2025

This document describes how the FALLENS DEALS application collects, uses, and protects your personal data in accordance with GDPR regulations and data protection laws.

📱 About the Application

FALLENS DEALS is a mobile application for Android that allows users to discover and share discount codes for airsoft shops in the Czech Republic and Slovakia. The application also allows you to follow favorite influencers and shops, receive push notifications about new discount codes, and get local notifications when approaching shops.

📋 Data We Collect

To provide our services, we collect the following data:

🔐 Account Data (during registration and use)

• Email address – required for login and communication
• Password – we store only the password hash using a secure hashing algorithm, never the password itself
• Display name – name visible to other users in the application
• Avatar – optional profile picture (if you upload one)
• Role – user, influencer, or administrator (for managing features)
• Verification status – whether your email is verified and whether you have a verified influencer profile

📍 Location Data (optional)

• Approximate device location – for geofencing (local notifications when approaching a shop)
• IMPORTANT: Location is used ONLY locally on your device and is NOT sent to our servers
• The application downloads a list of shops and their locations from the server, but your current location remains only on your device
• Geofencing works using Android Geofencing API, which detects zone entry locally
• You can deny consent for location use at any time in the application or Android settings

📱 Device Data

• Firebase Cloud Messaging (FCM) token – for sending push notifications (only if you consent to notifications)
• Platform – Android (for technical support)
• Device model – optionally for technical support and problem diagnosis
• Device hash – anonymous identifier (SHA-256 hash) for voting on codes without linking to your account
• Android Account Manager – for storing login credentials in Android Account Manager (optional)

📊 Application Usage Data

• Favorite codes – codes you have saved to favorites
• Followed influencers and shops – for content personalization and push notifications
• Code votes – whether a code works or not (anonymously using device hash, without account link)
• Voting history – for duplicate checking and time limits (anonymously)
• Code usage – number of codes used to display rating prompt (locally on device)
• Push notification interactions – whether you opened a notification (for campaign statistics)

📈 Analytical and Diagnostic Data

• Firebase Analytics – anonymous statistics about application usage (screen opens, features, etc.)
• Firebase Crashlytics – information about errors and application crashes to improve stability (stack trace, application state)
• Server logs – anonymous API request logs for diagnostics and security

📝 Data When Submitting Content

• Submissions – when submitting a new code or shop: email (optionally), owner name, images, evidence
• reCAPTCHA score – for spam protection (anonymous score, not personal data)
• Problem reports – if you report a code or content: reason for report, optionally your notes

🎯 How We Use Your Data

• ✅ Providing services – displaying discount codes, personalizing content according to your preferences
• ✅ Push notifications – notifications about new codes from followed influencers and shops (only if you consent)
• ✅ Geofencing – local notifications when approaching a shop (works only on your device, without sending location to server)
• ✅ Authentication – login using email and password, optionally biometric verification (fingerprint/face – locally on device)
• ✅ Improving the application – analyzing errors and usage for fixes and feature improvements
• ✅ Communication – responses to your questions, support requests, email notifications (password reset, email verification)
• ✅ Security – protection against spam, abuse, and unauthorized access

🔒 Data Protection

• 🔐 Password encryption – passwords are stored as hash using a secure algorithm, never as plain text
• 🔐 HTTPS/TLS – all communication between the application and server is encrypted using TLS
• 🔐 Flutter Secure Storage – sensitive data (JWT tokens) are stored in encrypted storage
• 🔐 Biometric verification – optional login using fingerprint or face (data remains only on your device, never sent)
• 🔐 Android Account Manager – login credentials are stored in Android Account Manager (Android's encrypted storage)
• 🔐 Limited access – only authorized employees have access to data for technical support and management
• 🔐 Regular security checks – we regularly check and update security measures

📤 Sharing Data with Third Parties

We share your data only with the following services necessary for the application to function:

• Google Firebase – for push notifications (FCM), usage analytics (Analytics), and crash reporting (Crashlytics)
• Google reCAPTCHA – for spam and abuse protection when submitting content

These services have their own privacy policies and comply with data protection standards including GDPR. Firebase data is stored in the EU or in accordance with international data protection standards.

IMPORTANT: We do not share your data with advertising networks, we do not sell it to third parties, and we do not use it for marketing purposes without your consent.

👶 Children Under 13

🗑️ Your Rights Under GDPR

You have the following rights regarding your personal data:

• 📋 Right of access – you can request a copy of your personal data that we have
• ✏️ Right to rectification – you can edit your data in the application settings or request correction from us
• 🗑️ Right to erasure – you can request deletion of your account and all related data
• 🚫 Right to withdraw consent – you can deny consent for location use, push notifications, or marketing emails at any time
• 📦 Right to data portability – you can request export of your data in a structured format
• ⏸️ Right to restriction of processing – you can request restriction of processing of your data
• 📧 Contact us – for any questions or to exercise your rights, contact us at: mediel@fallens-airsoft.cz

⏰ Data Retention Period

• We retain your personal data as long as your account is active and you use our services
• After account deletion, data is deleted within 30 days (except for anonymous analytical data)
• Anonymous analytical data (Firebase Analytics) may be retained longer for statistical purposes
• Server logs are retained for the period necessary for security and diagnostics (usually 90 days)
• Legal obligations may require longer retention of some data (e.g., accounting records)

🌍 Transfer of Data to Third Countries

Your data is primarily stored on servers in the European Union. Some third-party services (Google Firebase) may process data in the USA or other countries, but always in accordance with international data protection standards and GDPR (Standard Contractual Clauses).

🔄 Changes to Privacy Policy

We may update these policies from time to time to reflect changes in our services or legal requirements. We will inform you of significant changes through the application or by email.

We recommend regularly checking this page for current information about the protection of your data. The date of the last update is indicated in the header of this document.

📧 Contact

If you have any questions regarding this privacy policy, processing of your personal data, or wish to exercise your rights, please contact us:

MedielSoft
Email: mediel@fallens-airsoft.cz
Web: https://www.medielsoft.cz

We will respond to your request within 30 days in accordance with GDPR.