tomato by fair.ninjaLEGAL / PRIVACY
Privacy Policy
DRAFT v13, 2026-10-08 — not reviewed by a lawyer. Fill in every
[PLACEHOLDER].
Effective date: [DATE] · Version: [3]
The short version
- Without an account, your data stays on your device. We can't see it.
- With an account, we store what you choose to sync plus what an account needs to work.
- We use your content only to provide the service to you. No selling, no ads, no profiling, no AI training on your content. Any new use of your content requires your consent first.
- We use only cookies that are strictly necessary for signing in. No trackers, no analytics cookies.
- You can get a copy of your data on request and delete your account yourself, at any time.
- Contact: info@fair.ninja.
1. Controller
4TH DIMENSION SP. Z O.O., ul. Heleny Marusarzówny 15A/10, 80-288 Gdańsk, Poland, KRS 0001042349, NIP 9571159715 ("we", "us") is the controller of your personal data. Contact: info@fair.ninja or post to the address above. We have not appointed a data protection officer, as the law does not require one for our processing.
2. Data on your device
Our Apps are local-first: your data is stored on your device whether or not you have an account.
Without an account, we receive only what any website or app download involves (such as your IP address and device type when the App is fetched or checks for updates). We do not link it to you or keep access logs that identify you, unless Service Details says otherwise.
Your device's operating system may include App data in its own backups (for example Android backup to your Google account). That is processing by your platform provider under your agreement with them, not by us. Any local diagnostic logs that are not part of the technical diagnostics described in §3 stay on your device unless you choose to send them to us.
3. Data we process when you have an account
| Category | Examples | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Account | E-mail, sign-in data, user ID in the service, display name; devices and sessions (incl. IP address) | Running and securing your account, contacting you | Art. 6(1)(b) contract; Art. 6(1)(f) security | Account lifetime; sessions for a limited period (see Service Details) |
| Your Content | Everything you store or sync through the Apps, including files, settings and Connected Tools configuration, plus the technical data needed for sync | Providing Hosted Services: sync, storage, backups, export, integrations | Art. 6(1)(b) | Until you delete it or your account, or 30 days after your balance runs out (Terms §7.6) |
| Wallet and payments | Chips balance and usage, gifts between accounts, purchases and payment references | Billing Hosted Services, fulfilling purchases and refunds, accounting | Art. 6(1)(b); Art. 6(1)(c) tax and accounting law | Account lifetime; payment records for the statutory period, also after account deletion |
| Communication | Messages to us, complaints, our replies | Support, complaints, defending claims | Art. 6(1)(b); Art. 6(1)(f) | Until claims are time-barred |
| Logs and abuse prevention | Technical logs, pseudonymous identifiers, irreversible hash of deleted accounts | Maintenance, diagnosing and securing the Services, preventing abuse of promotional chips | Art. 6(1)(f) | Short periods (see Service Details) |
| Technical diagnostics | Error reports with stack traces, performance metrics (such as load times), pseudonymous identifiers of your account, device and space, the app route and status of failed requests — never the content of your tasks or notes | Keeping the Apps working | Art. 6(1)(f) legitimate interest | Per the Grafana Cloud plan in force: […] |
We collect technical diagnostics automatically, without an in-app switch to turn it off; you can object to this processing under §11 by writing to info@fair.ninja (Art. 21 GDPR). Our processor for technical diagnostics is Grafana Labs (Grafana Cloud); its processing location is in Service Details.
Only your e-mail address and sign-in identity are required to open an account. Everything else follows from how you use the Services.
We do not collect payment card numbers, government IDs, precise location, biometrics, contacts, or microphone/camera data, and we do not use advertising identifiers.
If we add a new category of processing (for example opt-in error reporting from the App), we update this policy and Service Details before it starts.
4. Payments
Chips are sold on our website through Stripe Managed Payments (seller: currently Sold through Link, LLC) and, where available, in the Apps through the Apple App Store or Google Play (seller: Apple or Google) (Terms §8.1). The seller collects your payment and billing details on its own checkout page and processes them as an independent controller under its own privacy policy, including for taxes, fraud prevention and payment support. It tells us which account bought which pack, the amount, the status and reference numbers, so that we can credit your chips.
5. Connected Tools and AI assistants
When you authorise a Connected Tool, we give it access to the data covered by the permissions you granted. What it receives is then processed by its provider as a separate controller under that provider's policy. We do not see your conversations with an AI assistant, only the requests it sends to us. You can revoke access at any time.
6. Cookies and local storage
We use only cookies and similar technologies that are strictly necessary to provide the service you asked for, such as keeping you signed in and protecting your session. They do not require consent (Art. 5(3) ePrivacy Directive; in Poland, the Electronic Communications Law).
The Apps store your data and a random device identifier in your device's storage so they can work offline and sync. Sign-in and payment pages of third-party providers may set their own cookies on their own domains under their own policies.
If we ever want to use non-essential cookies or analytics that require consent, we will ask first.
7. Recipients
We do not sell or rent personal data. We share it only with:
- processors acting on our instructions under data processing agreements, in these categories: hosting and infrastructure, authentication, payments, logging and monitoring, backup storage, e-mail delivery. The current list, with locations, is in Service Details and is updated whenever it changes;
- authorised Connected Tools (§5);
- people you share content with or who open a link you shared (Terms §10.6);
- another user you send chips to or receive chips from, who sees your user ID in the service in the transfer;
- authorities, where the law requires it; we tell you if we are allowed to;
- a successor that takes over the Services, with notice to you and the option to leave first.
8. Transfers outside the EU
Some processors may process data outside the EU, notably in the United States. We then rely on an adequacy decision (such as the EU-US Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses. You can request a copy of the relevant safeguards at info@fair.ninja.
9. Retention and account deletion
We keep data only as long as needed for the purposes above; the criteria are in §3 and the current periods in Service Details.
When you delete your account, after any grace period your content, devices, sessions and authorisations are deleted and your account record is anonymised. We keep only: records required by tax and accounting law; the irreversible abuse-prevention hash (§3); a minimal audit record of the deletion; and backups, which expire on their normal schedule.
10. Security
We use appropriate technical and organisational measures, including encryption in transit (HTTPS), access control, isolation of each account's data and regular backups. Your synced content is not end-to-end encrypted: our servers can read it, because sync, export and Connected Tools require it. If a breach is likely to result in a risk to you, we notify the supervisory authority within 72 hours and, where the risk is high, you without undue delay.
11. Your rights
You have the right to access, rectify, erase, restrict and port your data, to object to processing based on our legitimate interests, and to withdraw consent at any time without affecting earlier processing. You can delete your account yourself in the account portal. For anything else, write to info@fair.ninja from your account's e-mail address. We reply within one month, extendable by two months for complex requests.
You may complain to the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or to the authority in your EU country of residence.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.
12. Children
You can create an account if you are at least 13. If we find out that a younger child has an account, we delete it. Parents and guardians with questions can write to info@fair.ninja.
13. Changes
We update this policy before changes to how we process data take effect, show the date and a changelog below and announce material changes in the app.
Changelog
| Version | Date | Change |
|---|---|---|
| 4 (draft) | 2026-10-08 | Data table made generic (independent of individual apps); security wording limited to measures in place. |
| 3 (draft) | 2026-09-30 | Generic rewrite; exact lists moved to Service Details. |
Generated from the repository's docs/legal/privacy-policy.md. Questions: see section 1.