nicewords-legal

Privacy Policy

Nice Words (“we”, “us”, “our”) operates the Nice Words mobile application (the “App”). This Privacy Policy explains what personal data we collect, how we use it, and your rights regarding your data.

Effective date: August 9, 2026 Last updated: August 9, 2026

1. Owner and Data Controller

Aleksandra Lisek 03-982 Warsaw, Poland

Contact email: contact.nicewords@gmail.com

We are not required to appoint a Data Protection Officer (DPO) under GDPR Art. 37, as we do not meet the criteria that would trigger such appointment. Data protection inquiries should be sent to the contact email above.

2. Types of Data Collected

We collect the following categories of personal data:

Account data — email address, display name, profile picture (if provided via Google/Apple sign-in), user identifier.

User-generated content — affirmation groups, custom badges, custom tasks, daily task completions, application settings and preferences.

Device and usage data — device model, operating system version, application version, language, time zone, crash reports, performance metrics, in-app interactions (“Usage Data”).

Advertising identifiers — Apple IDFA (iOS) or Google Advertising ID (Android), collected only with user consent via the platform’s ATT/UMP consent flow.

Purchase data — subscription status, purchase history, product identifiers. No card or payment details are ever handled by the App; all payments are processed by Apple or Google.

Push notification tokens — device tokens used to deliver notifications, only if the user grants notification permission.

Whether provision of data is mandatory

3. How We Use Your Data

We process personal data for the following purposes:

For users in the EU / EEA, we process personal data under the following legal bases:

Users outside the EU/EEA

For users outside the EU/EEA, we process personal data based on your consent (given by creating an account and continuing to use the App) and the performance of the contract between us. Where applicable local laws provide additional bases or requirements (e.g., LGPD in Brazil, CCPA/CPRA in the United States), we apply those alongside — see the dedicated sections below.

Specific legitimate interests we pursue

Where we rely on legitimate interest as a legal basis, our specific interests are:

You have the right to object to processing based on legitimate interest — see Section 7 below.

Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

5. Recipients of Personal Data (Third-Party Sub-Processors)

We share personal data with the following categories of recipients, acting as processors on our behalf under Data Processing Agreements pursuant to GDPR Art. 28:

We do not share personal data with any recipients other than those listed above and their sub-processors.

Each service processes data according to its own privacy policy.

Firebase (Google LLC / Google Ireland Limited)

Firebase services are provided by Google LLC for users outside the EU/EEA and by Google Ireland Limited for users in the EU/EEA. Google is certified under the EU-US Data Privacy Framework. All Firebase services use the following privacy policy: https://firebase.google.com/support/privacy

Firebase Authentication — user login and account management (Registration and authentication).

Firebase Cloud Firestore — cloud database for user data (Hosting and backend infrastructure).

Firebase Cloud Functions — serverless backend for scheduled notifications and webhooks (Hosting and backend infrastructure).

Firebase Cloud Messaging — push notification delivery.

Google Analytics for Firebase — pseudonymous usage analytics.

Firebase App Check — anti-abuse verification of app authenticity.

RevenueCat, Inc.

Subscription and in-app purchase management (Access to third-party service accounts / Payment management).

Google AdMob (Google LLC / Google Ireland Limited)

Mobile in-app advertising (Advertising), shown to free-tier users only.

Sentry (Functional Software, Inc.)

Application error and crash reporting (Infrastructure monitoring).

Google Sign-In (Google LLC / Google Ireland Limited)

Optional authentication via Google account (Registration and authentication).

Sign in with Apple

Optional authentication via Apple ID.

6. Data Retention

7. Your Rights

You have the right to:

To exercise these rights, contact us at contact.nicewords@gmail.com. We respond within 30 days. In exceptional cases involving complex or numerous requests, we may extend this period by up to two additional months, informing you of the reason for the delay within the initial 30-day window (as permitted by GDPR Art. 12(3)).

You can delete your account directly in the App: Settings → Account → Delete Account.

Right to lodge a complaint

If you believe our processing of your personal data violates GDPR, you have the right to lodge a complaint with a supervisory authority. For users in Poland:

Urząd Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warsaw, Poland Website: https://uodo.gov.pl Phone: +48 22 531 03 00

EU/EEA users may also lodge a complaint with the supervisory authority of their habitual residence, place of work, or the place of the alleged infringement.

8. Users in the United States

This section applies to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and Montana.

Notice at Collection (CCPA/CPRA)

We collect the following categories of Personal Information as defined by California law:

Category Examples Purpose Retention
Identifiers email, user ID Account & service Account lifetime + 30 days
Internet/electronic activity app interactions, device info Analytics, functionality Up to 14 months (Google)
Commercial information subscription status, purchase history Subscription management 7 years (tax)
Geolocation (coarse) approximate location from IP Advertising (free tier) Ad session only

We do not collect Sensitive Personal Information as defined by CPRA.

Sale and Sharing

Global Privacy Control (GPC)

We honor Global Privacy Control (GPC) signals where technically feasible. If your device transmits a GPC signal, we treat it as an opt-out of Sharing.

Your rights

You have the right to:

To exercise these rights: contact.nicewords@gmail.com

Authorized agents

You may designate an authorized agent to submit CCPA/CPRA requests on your behalf. To process such requests, we will require:

Send authorized-agent requests to contact.nicewords@gmail.com with the subject line “AGENT REQUEST”.

9. Users in Brazil (LGPD)

For users in Brazil, we process personal data (“Dados Pessoais”) pursuant to Lei Geral de Proteção de Dados (Federal Law No. 13,709/2018 — LGPD).

We process your data based on:

Your rights (LGPD Art. 18)

You have the right to:

Data Protection Officer (Encarregado)

We are not required to appoint a DPO under LGPD given our operation size. For data protection inquiries, contact contact.nicewords@gmail.com.

Complaint

You may lodge complaints with the Brazilian data protection authority: ANPD (Autoridade Nacional de Proteção de Dados) at https://www.gov.br/anpd

10. Children’s Privacy

Nice Words is not intended for children.

Parents who believe their child has provided us with personal data may contact us at contact.nicewords@gmail.com and we will delete the data.

11. International Data Transfers

Your data may be transferred to and processed in countries outside the EU/EEA, including the United States.

For transfers to the United States, we rely on:

  1. EU-US Data Privacy Framework certification — Google LLC is certified: https://www.dataprivacyframework.gov/list
  2. Standard Contractual Clauses (SCCs) — as backup, and for transfers not covered by DPF

Our processors have committed to appropriate safeguards. However, we acknowledge that data protection laws in the United States may not be equivalent to those in the EU. If the DPF is invalidated or a processor loses its certification, we will rely on SCCs and, if necessary, transition to processors that provide equivalent protection.

You may request a copy of the applicable transfer mechanism by contacting us.

12. Security

We implement appropriate technical and organizational measures to protect your data:

Data breach notification

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay via the email address associated with your account, as required by GDPR Art. 34, and notify the competent supervisory authority within 72 hours as required by Art. 33.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified through the App and/or by email. The “Last updated” date at the top reflects the most recent revision.

14. Contact

For any privacy-related questions or to exercise your rights:

Aleksandra Lisek Email: contact.nicewords@gmail.com