The data controller responsible for your personal data is:
LimitWaste Sp. z o.o.
ul. Wspólna 19, 25-003 Kielce, Poland
NIP: 5272905462 · REGON: 384349430 · KRS: 0000803658
Email: hello@fivly.app
Website: fivly.app
As a Poland-based company operating within the European Union, we process personal data in compliance with the General Data Protection Regulation (GDPR) and applicable Polish data protection laws.
When you use the App, we automatically create an anonymous account and collect the following:
If you choose to link your account, we receive limited data from the authentication provider:
Account linking is entirely optional. The App is fully usable with an anonymous account.
We store your selected news categories (such as world, business, technology, AI, and markets) to personalize your content experience.
To provide features like streaks and personalized recommendations, we collect:
For users with premium subscriptions, we receive from RevenueCat:
We do not receive or store your payment card details, billing address, or other financial information. All payment processing is handled by the Apple App Store or Google Play Store.
We use Amplitude for analytics. The following user properties are tracked:
Events tracked include interactions with app lifecycle, onboarding, brief reading, audio playback, paywall, archive, settings, and navigation. Events include contextual properties (e.g., story count, brief date, category selected) but do not include content of stories you read.
The App stores limited data locally on your device:
This data remains on your device and is not transmitted to our servers unless noted otherwise.
We use the information we collect for the following purposes:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Provide and operate the Service (deliver briefs, audio, personalization) | Performance of contract (Art. 6(1)(b)) |
| Manage your account and authentication | Performance of contract (Art. 6(1)(b)) |
| Process and manage subscriptions | Performance of contract (Art. 6(1)(b)) |
| Send push notifications for daily briefs | Consent (Art. 6(1)(a)) |
| Analyze usage to improve the Service | Legitimate interest (Art. 6(1)(f)) |
| Track reading history and streaks | Performance of contract (Art. 6(1)(b)) |
| Ensure security and prevent abuse | Legitimate interest (Art. 6(1)(f)) |
| Comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
We use the following third-party services to operate the App. Each processes data as described below:
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Backend infrastructure, database, authentication, and file storage | All user data described in Section 2 |
| RevenueCat | Subscription management and entitlement tracking | User UUID, purchase data from App Store / Google Play |
| Amplitude | User behavior analytics | User UUID, event data with properties (see Section 2.7) |
| Firebase / FCM | Push notification delivery | Device token, notification content |
| Google Fonts | Font loading for the App | Standard HTTP request data (IP address, user agent) |
The following services are used exclusively on our backend for content generation. No user data is transmitted to these services:
Your data is primarily stored and processed using Supabase infrastructure. Data may be transferred to and processed in countries outside the European Economic Area (EEA) where our third-party service providers operate. Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.
We implement industry-standard security measures to protect your data:
While we take reasonable precautions to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:
When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (such as resolving disputes).
As a user, particularly if you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:
To exercise any of these rights, please contact us at hello@fivly.app. We will respond to your request within 30 days.
The App is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected data from a child under 16, please contact us at hello@fivly.app and we will take steps to delete such data promptly.
The Fivly mobile app does not use browser cookies. However, we use the following technologies:
If you access our website at fivly.app, standard web technologies including Google Fonts may process basic HTTP request data such as your IP address.
Fivly uses artificial intelligence to generate news summaries and audio narrations. This processing occurs entirely on our backend servers:
No user personal data is sent to these AI services. Only news content is processed. The resulting AI-generated content is stored on our servers and delivered to you through the App.
Some of our third-party service providers are located outside the EEA, including in the United States. When your data is transferred outside the EEA, we ensure compliance with GDPR through appropriate safeguards such as:
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:
We encourage you to review this Privacy Policy periodically. Your continued use of the App after changes take effect constitutes acceptance of the updated policy.
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including:
We do not sell your personal information. To exercise your California privacy rights, please contact us at hello@fivly.app.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
For GDPR-related inquiries, we aim to respond within 30 days of receiving your request.