Privacy policy
How the Napar website and app process data.
Draft. Operator and website hosting details have been completed. The app’s production AI infrastructure, providers, retention and data transfers still require verification before that service launches.
1. Data controller and contact
The data controller for Napar services is Krzysztof Guz, address: ul. Czechowska 3/23, 20-072 Lublin, Poland. For privacy matters, contact krzysztof.guz@me.com. This policy covers naparapp.com and the Napar app features described below.
2. Using the website
The website has no user accounts, order form, newsletter, ads, marketing pixels or analytics tools. Search and filters run in your browser; queries are not sent to the operator. We currently set no first-party cookies or localStorage data. Fonts are system fonts; images and scripts are served by the website’s server.
During a connection, the hosting provider may process technical request data, including IP address, time, requested page and browser information. Hosting provider: Google Firebase Hosting. Log retention: according to Google Firebase Hosting documentation, IP address data is retained for several months (https://firebase.google.com/support/privacy).
3. Local app data
Favourite plants and infusions, language choice and app settings are stored on your device. The pilot AI server’s access token is stored in the system Keychain. The app currently has no proprietary account system or advertising profile. We do not send favourites to the app server.
4. Photos and identification
Offline mode analyses selected photos on your device. AI mode requires separate confirmation before sending selected photos to the configured server and analysis provider, OpenAI. Each analysis can include up to three photos. The app creates reduced JPEG images without location metadata. The selected response language and technical request authorisation are also sent.
The app server does not store photos in a persistent database or log their content or tokens. Requests are processed to provide answers; the pilot’s technical usage counters run in process memory. This does not mean zero retention by OpenAI or hosting infrastructure. Before production launch, provider terms, retention and safeguards for transfers outside the EEA must be specified. Do not send photos of people, documents or content unrelated to the plant.
5. App Store purchases
Apple handles payments and purchase settlement. The app operator does not receive card numbers. StoreKit provides information needed to verify Napar Club entitlement, such as product ID, verified transaction status, renewal or revoked access. Apple’s data processing is also governed by its policies and your account settings.
6. Purposes and legal bases
Data needed for a requested service is processed to provide it under GDPR Article 6(1)(b). Contact, handling requests and technical website security may rely on the operator’s legitimate interest, Article 6(1)(f). Legally required processing relies on Article 6(1)(c). Where processing relies on consent, it can be withdrawn without affecting the lawfulness of earlier processing.
7. Recipients and retention
Data may be received by infrastructure providers needed to operate the service, Apple for purchases, and OpenAI when online analysis is selected. Local data remains until deleted in the app or according to the device system’s behaviour. Correspondence is retained as needed to handle enquiries and possible claims. Specific providers and retention periods for the production AI server and hosting must be completed before those services launch.
8. Your rights
Within the limits of applicable law, you may request access, rectification, erasure, restriction or portability, and object to processing based on legitimate interests. You may complain to the President of Poland’s Personal Data Protection Office. To exercise your rights, write to krzysztof.guz@me.com.
We do not use scanning to make decisions with legal or similarly significant effects on you. Identification results are informational. Providing a photo is voluntary; without it, that photo cannot be analysed.
9. Links and changes
Visits to the App Store or other external sites are governed by those services’ policies. If Napar’s operations change, this policy will be updated before the new processing begins. This version was prepared on 21 September 2026.
Source for information on your rights: GDPR. The technical information reflects the app and server code in the Napar project.