Today Privacy Policy
Effective from: 11 October 2026
This policy explains what data the Today app collects, why, where it is stored and what your rights are. We try to collect only what the app needs to work.
1. Who is responsible for your data
The data controller is:
Jakub Lisiak, sole trader
Tax ID (NIP): PL7292745761, REGON: 522911909
Postal address: ul. Traktorowa 63A/5, 91-111 Łódź, Poland
Email: today.social.app@gmail.com
For anything related to your personal data, write to the email address above.
2. What data we collect
Account
- email address and password (the password is stored in encrypted form; nobody can see it),
- name or nickname, and username,
- confirmation that you are at least 16 (we check your date of birth when you sign up, but we do not store it),
- the app language you chose,
- the date your account was created.
Profile (optional, only if you choose to add it)
- profile photo,
- place,
- bio.
Content you add
- memories: photos, captions, the day they belong to, and whether they are visible to everyone or only to you,
- comments, likes on memories and likes on comments,
- the people you follow and the people who follow you,
- people you have blocked,
- reports you send about content or people (the reason and an optional description).
Technical data
- data needed for signing in and account security, processed by the sign-in service provider (e.g. time of last sign-in, IP address when signing in),
- settings stored only on your phone: language and appearance (light / dark).
What we don't do
- we don't show ads,
- we don't sell your data or share it with advertisers,
- we don't track you across other apps or websites,
- we don't use analytics or tracking tools; we count the app's statistics ourselves, as totals, from the data described above,
- we don't collect your phone's location, your contacts, or any photos other than the ones you choose.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, showing your profile, memories, comments and follows | performance of a contract, i.e. using the app under the Terms (Art. 6(1)(b)) |
| Automatically checking photos for nudity, adult content, violence and graphic content before other people see them | our legitimate interest in a safe community and compliance with the Terms (Art. 6(1)(f)) |
| Security, preventing abuse, handling reports and blocks | our legitimate interest in a safe community (Art. 6(1)(f)) |
| Overall statistics to improve the app (e.g. how many people come back after a week, what share of people post a memory each day). We count them once a day from account creation dates and posted or skipped days, and save only totals, nothing about any one person | our legitimate interest in developing the app (Art. 6(1)(f)) |
| Answering messages, complaints and requests | performance of a contract and our legitimate interest (Art. 6(1)(b) and (f)) |
| Meeting legal obligations (e.g. a request from an authorised public body) | legal obligation (Art. 6(1)(c)) |
4. Who can see your data
Other Today users (signed in) can see:
- your name or nickname, username, profile photo, place and bio,
- memories marked "Visible to everyone", with their captions, likes and comments,
- your comments under other people's memories,
- your followers and following lists.
Other Today users may live in any country, including outside the European Union.
Memories marked "Only me" are visible only to you. People you block can't see your content in the app.
Technical service provider. The app runs on Google Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google stores and processes data only on our instructions, under a data processing agreement. To check photos automatically we use Google Cloud Vision: the photo is analysed in the European Union, and Google does not keep it after the check or use it for any other purpose.
Public authorities, only when the law requires it.
We don't share your data with anyone else.
5. Where your data is stored
- Profiles, memories, comments and other content, photos, and server functions: Google's data centre in Warsaw, Poland (region `europe-central2`).
- Sign-in data (email, password in encrypted form): the Firebase Authentication service, which may also process data in the United States. Such transfers rely on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) and on standard contractual clauses approved by the European Commission.
6. How long we keep your data
- As long as you have an account. You can delete a memory, comment, like, your profile photo or your whole account at any time.
- Deleting your account (Settings → Delete account) immediately deletes your profile, memories and their photos, comments, likes (including likes on comments), follows, blocks and username.
- Backups of the database are made daily (kept for 14 days) and weekly (kept for 28 days), so deleted data may remain in a backup for up to about 5 weeks. We use backups only to restore the app after a failure.
- Reports (reports you sent and reports about you) are kept for 12 months from when they are sent and then deleted automatically. This lets us investigate abuse, even after an account is deleted.
7. Your rights
You have the right to:
- access your data and get a copy of it: in the app, Settings → Download my data gives you a ZIP file with all your photos and your data; the file is deleted automatically after 7 days,
- rectify your data (you can change most of it yourself in Settings → Edit profile),
- erase your data (Settings → Delete account, or email us),
- restrict processing,
- data portability: the same file contains your data in a common, machine-readable format (JSON) and your photos (JPEG),
- object to processing based on legitimate interest,
- lodge a complaint with a data protection authority, in Poland the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the authority in your own EU country.
To use your rights, email today.social.app@gmail.com. We'll reply within one month. We may ask you to confirm that the request comes from the person the account belongs to (e.g. by writing from the email address linked to the account).
8. Age
Today is for people who are at least 16 years old. If we learn that an account was created by someone younger, we will delete it.
9. Security
Connections to our servers are encrypted. Access to data is limited by security rules: other people can't change your data, and they can't see your "Only me" memories in the app. Despite our efforts, no security is 100% perfect. If a breach happens that could put you at risk, we will tell you.
10. Changes to this policy
If we change this policy in an important way, we will let you know in the app before the changes take effect. The current version is always available in the app (Settings) and at todayritual.com/privacy.
11. The "Tell me on 1 January" list (todayritual.com)
This part is for people who signed up on todayritual.com to hear when the app launches. You don't need a Today account to sign up.
- What data: your email address, the language of the page, when you signed up and confirmed, and the version of the consent text. To prevent abuse, we also keep a hash of the IP address the sign-up came from for about an hour, never the IP address itself.
- Why: we send one email asking you to confirm, and one email on the day the app launches (planned for 1 January 2027). We send nothing else and don't link the address to an account in the app.
- Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the consent box and confirming with the link in the email. You can withdraw it at any time with the unsubscribe link in the email or by writing to us. Withdrawing consent does not affect anything done before.
- How long: an unconfirmed address is deleted automatically after 7 days. A confirmed address is kept until the launch email is sent, and then the whole list is deleted. If you unsubscribe, we delete your address at once. Deleted addresses may remain in database backups for up to about 5 weeks (section 6).
- Who processes it: the list is stored in Google Firebase in Warsaw (section 5), and the emails are sent on our behalf by Brevo (Sendinblue SAS, France), under a data processing agreement.
- You have the rights described in section 7.