1Who is responsible for your data
The data controller, in GDPR terms, is Andrii Shkurupii, a private individual living in Poland. Contact: moodplanner.app@gmail.com.
Your data is processed under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), whatever country you live in.
This policy explains what data MoodPlanner processes, why, and for how long. The conditions of use are separate — see the Terms of Service.
2The short version
We collect only what the app cannot work without: your account, your mood entries and your events. There is no advertising, no analytics, no trackers and no third-party ad SDKs in the app — we do not know how you use it, because we never measure it. What you write, your moods, notes and event titles, is stored encrypted, and so are your date of birth and your profile picture.
3What we process
3.1 Your account
| Data | Where it comes from | What it is for |
|---|---|---|
| Name | you enter it when signing up | showing you to yourself and to group members |
| Date of birth | you enter it when signing up | deciding your role: child or adult |
| you enter it, or Google supplies it | signing in, and contacting you about the account | |
| Password | you enter it | signing in |
| Google identifier | from Google, if you sign in with Google | linking that sign-in to your account |
| Profile picture | you choose it, optional | showing you in member lists |
| Record of your consent | the app, when you accept these texts | showing that you agreed, to which version, and when |
| A parent's or guardian's name and email | a parent enters them, for an account under 16 | showing who agreed for the child, and contacting them about it |
| Record of your consent to a group seeing your entries | the app, when you create or ask to join a group | showing that you agreed, for which group, and when |
The password itself is not stored — only a BCrypt hash of it, from which the password cannot be recovered. The date of birth, the profile picture and a parent's name and email are stored encrypted (AES-GCM).
3.2 What you create
- moods for a day, and the notes attached to them;
- events: title, date and time, and whether they are personal or a group's;
- groups you created, and your membership of other people's groups;
- the members whose entries you chose to hide;
- reports you send about another member or one of their entries: the reason, anything you add, and which entry.
Moods, their notes and event titles are stored encrypted on the server (AES-GCM).
3.3 Technical data
- Sign-in tokens. A short access token lives 15 minutes, a refresh token 7 days. The server clears dead tokens every 6 hours.
- IP address. The server counts requests from one address to defend against password guessing. Those counters live only in memory and disappear about an hour after the last request. They are never written to the database and never tied to an account.
3.4 What we do not collect
We do not collect location, the list of installed apps, contacts, advertising identifiers, usage history, or device data beyond what delivering a notification requires. The project contains no analytics or advertising SDK of any kind.
4Why we process it, and on what basis
| Purpose | Data | Basis (GDPR) |
|---|---|---|
| Creating your account and letting you in | name, email, password, Google ID | performance of a contract, Art. 6(1)(b) |
| Deciding the child or adult role | date of birth | performance of a contract, Art. 6(1)(b) |
| Storing and showing your entries, syncing across devices | moods, events, groups | performance of a contract, Art. 6(1)(b) |
| Showing your entries to your group's members | moods, notes, name, picture | name and picture: performance of a contract, Art. 6(1)(b); moods and notes: your explicit consent, Art. 9(2)(a), asked when you create or join the group |
| Letting a group's owner recognise who asks to join | your name and email, shown to the owner of the group you ask to join | performance of a contract, Art. 6(1)(b) |
| Showing you insights about your diary | moods and event titles | your explicit consent, Art. 9(2)(a); worked out on your device |
| Hiding a member's entries from you | whom you hid | performance of a contract, Art. 6(1)(b) |
| Handling reports about members and entries | who reported whom, the reason, what was added, which entry | legal obligation, Art. 6(1)(c): Art. 16 of the EU Digital Services Act; legitimate interest in keeping groups safe, Art. 6(1)(f); for the entry itself, the explicit consent its author gave, Art. 9(2)(a) |
| Sending the daily reminder | reminder settings held on the device | consent, Art. 6(1)(a) — switchable off |
| Exporting events to Google Calendar | event titles and times | consent, Art. 6(1)(a) — switched on separately |
| Protecting the server from password guessing | IP address | legitimate interest, Art. 6(1)(f) |
| Keeping a record of your consent | the version you accepted and when | legal obligation, Art. 6(1)(c): Art. 7(1) requires us to be able to show it |
| Keeping a record of a parent's agreement, for an account under 16 | the parent's name and email, the version agreed to, and when | legal obligation, Art. 6(1)(c): Arts. 7(1) and 8(2) require us to be able to show it |
| Keeping a record of your consent to a group seeing your entries | which group, the version agreed to, and when | legal obligation, Art. 6(1)(c): Art. 7(1) requires us to be able to show it |
A mood entry may count as health data, a special category under Art. 9 GDPR. We process it on the basis of your explicit consent, which the app asks for in a box of its own before you first use it. You can withdraw it by deleting the entries or the account. For an account under 16, a parent or guardian gives that consent too — see section 5.
Insights. The Insights screen looks for patterns in your diary: which days of the week, and which recurring events, go with better or worse moods. It follows fixed rules rather than artificial intelligence and works entirely on your device: nothing it finds is sent to our server or to anyone else, and it makes no decisions about you.
5The age of our users
The app is for people aged 13 and over. We deliberately collect no data from anyone younger: the server checks the date of birth and refuses to register them — at ordinary sign-up, at sign-in through Google, and if the date is edited in the profile after the fact.
Under 16, a parent or guardian agrees as well. Sixteen is the age of digital consent in Poland and the highest any EU country may set (Art. 8 GDPR), so we apply it everywhere. When an account under 16 first opens the app, the app asks for the phone to be handed to a parent or guardian, who enters their name and email and confirms that they are the child's parent or legal guardian and agree to the processing of the child's mood entries, including showing those the child writes in a group to its members. Until a parent has agreed, the server accepts no mood entries from the account.
We keep the parent's name and email, encrypted, with the child's account — to show who agreed and to contact them about it — and delete them with the account. A parent can withdraw the agreement by deleting the account or by writing to us. We cannot check that the person confirming really is the child's parent: the app refuses the account's own email address as the parent's, and confirming falsely breaches the Terms of Service.
The "child" role covers minors aged 13 to 17 and limits what they can do in groups: they may join one but not create one. It makes no difference to the data we process, which is the same for everybody.
If you believe a child under 13 has created an account anyway, write to moodplanner.app@gmail.com and we will delete it together with all of its data.
6Who can see your data
The members of your groups. This is the most important thing to understand. An active member of a group can see your moods and notes for each day within that group, your monthly summary, your name and your profile picture. Personal entries made outside any group are not visible to anyone else.
Before you create a group or ask to join one, the app asks you, in a box of its own, to agree that the group's members will see what you write in it; without that agreement the server neither creates the group nor sends the request. You withdraw it by leaving the group: your entries move into your personal history, the group no longer sees them, and the record of the agreement is deleted. Above the mood picker, the calendar always says whether an entry will be seen by your group or only by you. For an account under 16, the parent's agreement covers this as well.
The owner of a group also sees the email address of everyone who asks to join it, so they can tell who is asking. Members never see each other's addresses.
You can hide a member: their moods, notes, events and monthly summary stop appearing for you, and they are not told. You can also report a member or one of their entries. A report reaches only us, and the member is not told who sent it.
Us. Andrii Shkurupii has access to the database, solely for support, fixing faults and handling reports, which means reading a report and the entry it is about.
Google. If you sign in with Google, Google tells us your identifier, your email and whether it is verified. If you turn on calendar export, the titles and times of your events reach Google Calendar, in a separate calendar the app creates. What Google does with them is governed by the Google Privacy Policy.
The export goes straight from your device to Google: our server takes no part in it and never sees your calendar. The app asks only for the calendar.app.created permission, so it can see and change nothing but the calendar it created. To keep that calendar up to date, the app stores on the device only the identifiers of the calendar and of the events in it, and the address of the connected account.
MoodPlanner's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Hosting. The server and the database run on a virtual server we rent from OVHcloud in Zurich, Switzerland. OVHcloud (our contract is with OVH Sp. z o.o., Wrocław, Poland) hosts them as our processor under a data processing agreement (Art. 28 GDPR) and processes the data only to keep that server running, on our instructions. Nobody else administers it.
We do not sell your data and do not pass it to ad networks, data brokers or anyone else. We would disclose data to authorities only where the law expressly requires it.
7How long we keep it
| Data | Period |
|---|---|
| Account and your entries | as long as the account exists |
| Members you hid | until you show them again, or either account is deleted |
| Reports | until we handle them, then six months; at once if either account is deleted |
| Access token | 15 minutes |
| Refresh token | 7 days; dead ones cleared every 6 hours |
| IP counters | up to an hour, in memory |
| Everything, after account deletion | removed from the live database immediately |
| Backups | overwritten within 30 days |
8How we protect it
- Connections to the server are HTTPS only.
- Passwords are hashed with BCrypt and never stored in the clear.
- Mood entries, their notes, event titles, what you add to a report, date of birth, profile picture and a parent's name and email are encrypted on the server (AES-GCM).
- On the device, the profile picture is encrypted with a key held in the Android Keystore, and sign-in tokens live in encrypted storage.
- Android's backup to your Google account copies only the app's theme and language. Your diary, sign-in and consent records stay on the device and on our server.
- The app itself can be locked behind a passcode and biometrics, under Privacy.
- The server rate-limits requests to its sensitive endpoints.
No system is perfectly secure. We take reasonable measures; we cannot promise the impossible.
9Your rights
Whatever country you live in, GDPR gives you the right to:
- know what of your data we hold, and receive a copy;
- correct inaccurate data — name, email and picture are editable in the profile;
- erase your data — see section 10;
- restrict processing, or object to it;
- take your data in a machine-readable form;
- withdraw consent — turn off reminders or disconnect the calendar without losing anything else;
- complain to a supervisory authority — to ours, the President of the Personal Data Protection Office in Poland (uodo.gov.pl), or, in the EEA, to the authority of the country where you live or work.
To exercise any of these, write to moodplanner.app@gmail.com. We answer within 30 days.
10Deleting your data
The same thing as a page of its own, which is what Google Play links to — Deleting your account.
Delete the account in the app: Profile → Settings → Account settings → Account → Delete account.
That removes your profile, picture, events, moods, group memberships, tokens, the records of what you agreed to and, for an account under 16, the parent's details. Groups you created are deleted with the account. The other members' moods in those groups are not lost — they move into their authors' own personal history.
If you cannot reach the app, write to moodplanner.app@gmail.com from the address on the account.
11Transfers outside the EEA
We are based in the European Union, and the server is in Switzerland, which is outside the European Economic Area. The European Commission has decided that Switzerland ensures an adequate level of data protection (Decision 2000/518/EC, confirmed in its 2024 review of adequacy decisions), so keeping your data there rests on that decision (Art. 45 GDPR) and needs no further safeguards.
If you sign in with Google or turn on calendar export, the relevant data may also be processed by Google outside the EEA, under the European Commission's standard contractual clauses.
12Changes to this policy
We may update this policy. The version date at the top always shows the current one; anything substantial we will announce in the app.
This policy is published in Ukrainian and English. If the two versions differ, the Ukrainian one prevails.
13Contact
moodplanner.app@gmail.com — questions, rights requests, and parents' requests about a child's account.