This policy explains which of your personal data PrayWave processes, why, how long we keep it, whom we entrust it to and what rights you have. We describe what the Service really does. When we change how the Service works, we will change this policy too.
The controller of your data is Sławomir Jakubowski, residing at ul. Szczęśliwa 12, Gowino, Poland (the Administrator). For any matter concerning your data, you can write to hello@praywave.app. The Administrator has not appointed a data protection officer.
PrayWave is the successor of intencje.pl, which was run by the same Administrator. The terms Service and Content mean the same as in the Terms of Service. Content is everything you add or send in the Service, in any form and in any feature, including one added later.
- We do not sell your data, we do not show ads and we do not use analytics or tracking tools.
- To create an account, all you need is an e-mail address. You give the rest of your data only if you want to.
- Your published Content, for example intentions, testimonies and comments, as well as the fact that you pray for someone's intention, are visible to others, including people without an account.
- The server, the database and the backups are in Poland. Only the data needed for push notifications leaves the European Economic Area (section 7).
- You can delete your account yourself in the settings, and your Content with it.
3. Data about faith and health
Simply using PrayWave says something about your faith. Your Content, for example intentions and testimonies, also often concerns the health or the life of you and your loved ones. These are special categories of data (Art. 9 GDPR).
You publish Content such as intentions, testimonies and comments so that others can read it and pray with you. We process it because you make it public yourself (Art. 9(2)(e) GDPR). Publish only what you want to share with everyone. When you write about another person, do not give details by which they can be recognized, unless they have agreed to it. Moderation removes such details when it notices them.
We process such data in Content you do not publish, for example in an intention waiting for moderation or in a private message, only to provide the service you ask for. Only moderation or the people you send it to can see it.
We process your e-mail address, the date your account was created, the dates of your last sign-in and last activity, and the IP address and the name of the browser or device from your last visit. You sign in with a code sent by e-mail. The code is valid for a short time, and we store only its hash in the database. We delete expired codes every night and used codes after 7 days.
Each sign-in creates a session. With the session, we store the IP address and the name of the browser or device. A session that is not used expires after 30 days. We delete expired sessions after 7 days and sessions ended by signing out after 30 days.
You may create an account if you are at least 16 years old. Purpose: creating and maintaining your account. Legal basis: the contract, that is the Terms of Service (Art. 6(1)(b) GDPR). We keep account data until the account is deleted.
In your profile, you can give a name, a “Bio”, your town, country, parish and language, and add a profile picture and a background picture. Other users can see your name, bio, town, country, language and pictures. If you choose a parish, we show you on the list of members of that parish, which people without an account can see too. We do not show your e-mail address to other users.
You crop the picture you choose on your device, and only the cropped image, saved as JPEG, reaches the server. We keep profile data until you change it or delete your account. Legal basis: the contract (Art. 6(1)(b) GDPR).
We process your Content, in particular intentions, testimonies, comments on your own intentions, thanks for prayers and private messages, as well as your activity in the Service, for example which intentions you pray for, your favorites, reports and blocks of other users. The list of people praying for an intention is public.
Some Content, for example new intentions, testimonies and comments, is checked by the Administrator or by moderators appointed by him before we show it to others. Only the participants of a conversation can see private messages.
We translate some Content, for example intentions, comments and testimonies, automatically into the other six languages of the Service. It is translated by a language model running on the Administrator's computer, which the server reaches over an encrypted connection. The model receives only the text, without any data about the author. Your Content does not go to outside artificial intelligence providers.
We keep Content until you delete it or delete your account. Legal basis: the contract (Art. 6(1)(b) GDPR), and for data about faith and health, section 3.
We store your notification settings and the notifications in the Service. A notification shows who did something and where, for example the name and picture of a person who prays for your intention and the title of that intention. We keep notifications in the Service until your account is deleted.
We send e-mails from hello@praywave.app through our own mail server in Poland. We send sign-in codes and the notifications and digests of new intentions you choose in the settings. We send the newsletter with news about PrayWave by e-mail or as a push notification, only in the channels you turn on in the settings. New accounts have both channels turned off. Accounts moved from intencje.pl kept their newsletter setting from intencje.pl, where their owners agreed to receive the newsletter. You can turn off notifications, digests and the newsletter in the settings or with the link in the footer of each message.
Push notifications in the phone app go through Google's Firebase Cloud Messaging service and, on an iPhone, also through the Apple Push Notification service. These services receive the identifier of your device and the content of the notification. Push notifications in the browser are delivered by the service of your browser's maker, which receives the subscription address, while the content is encrypted. We ask for permission to send notifications only when you want to turn them on. We deactivate a device registration when you sign out and delete it after 30 days without use.
Legal basis: the contract (Art. 6(1)(b) GDPR), and for the newsletter your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time by turning the newsletter off in the settings or with the link in the footer of each message.
To protect the Service and its users, we record events: sign-ins, failed sign-in attempts, exceeded limits and blocks. An event contains the IP address, the account identifier, sometimes the browser name and a fragment of the Content it concerns. We keep the event log for 365 days. We keep attempt counters and IP address blocks for no longer than 24 hours.
Legal basis: our legitimate interest in the security of the Service (Art. 6(1)(f) GDPR).
When an error occurs in the Service, a report goes to the Sentry system, which runs on our server in Poland. A report may contain the IP address, the account identifier and name, the page address, the type of browser and device, the steps taken just before the error and entries from the application logs, including the e-mail address. When an error occurs on the website, the report also contains a recording of what happened on the screen. Text and images on the screen are masked in it, except for published Content. We keep reports for 90 days.
Legal basis: our legitimate interest in the Service working properly (Art. 6(1)(f) GDPR).
The server logs every request: the IP address, the time, the page address, the browser name and the address of the page you came from. Application logs also contain the account identifier, and some entries the e-mail address. The mail server logs the sender's and the recipient's e-mail addresses and the time of every message. We keep server, application and mail logs for 90 days. Legal basis: our legitimate interest in the security and proper operation of the Service (Art. 6(1)(f) GDPR).
The Service uses one cookie, named praywave_signed_in. It only tells the server that a signed-in session is active on this device, so that we can show you the right start page straight away. It contains no identifier and expires after 400 days or when you sign out.
We store your session data on your device. In the phone app, we keep it in the system's secure storage. We also store your settings, such as language, theme and text size, and which hints have already been closed. The website keeps its own files so that it works faster and offline.
We do not use advertising or analytics cookies. All this data is necessary for the Service to work, so we do not ask for consent to store it.
On the parish map, you can ask for parishes near you. Your phone or browser then asks for permission to use your location. Your position stays on your device and we do not send it to the server. Access to photos or the camera is needed only when you choose a picture for your profile.
The Administrator moved accounts from intencje.pl to PrayWave together with the e-mail address, name, registration date, bio, town, parish, pictures, notification settings, intentions, prayers and testimonies. Legal basis: our legitimate interest in continuing to provide the service to you under a new name (Art. 6(1)(f) GDPR).
Every night and before every update of the Service, we copy the database to the same server in Poland. We keep the 14 most recent nightly copies and the 5 most recent copies made before updates. Data you delete disappears from the backups when they are replaced by newer ones.
When you write to the Administrator, we process your e-mail address and what you write in order to answer you. We keep your messages sent to hello@praywave.app and our replies for 90 days from the last message in the matter and then delete them. Legal basis: our legitimate interest in answering your message (Art. 6(1)(f) GDPR).
You can delete your PrayWave account yourself in the phone app or on the praywave.app website: open Settings, choose Delete account and confirm it with the code we send you by e-mail. You can also ask us by e-mail at hello@praywave.app to delete your account. In that case, write from the address your account was created with.
We delete, immediately and permanently, the account and everything that belongs to it: the account and profile data, all your Content and your activity in the Service, for example intentions, testimonies, comments, prayers, thanks, messages, favorites, reports, blocks, pictures, sessions and notification registrations. Together with your Content, other people's Content that belongs to it disappears too, for example prayers for your intentions or the other side's messages in your conversations.
After the account is deleted, only the traces described in section 4 remain, each for its own time: entries in the event log (365 days), error reports (90 days), server, application and mail logs (90 days), correspondence with the Administrator (90 days from the last message in the matter) and backups (until replaced by newer ones). Notifications other users have already received keep your name as it was when the notification was sent.
- OVH Sp. z o.o., based in Wrocław: rents us the server in Poland on which the whole Service, the database, e-mail, error reports and backups run.
- Google: the Firebase Cloud Messaging service delivers push notifications to the app.
- Apple: the Apple Push Notification service delivers push notifications to iPhones.
- The maker of your browser (for example Google, Mozilla, Apple or Microsoft): delivers push notifications in the browser.
Other users can see your published Content and your profile. We disclose data to public authorities only when the law requires it. You download the app from the Apple or Google store, which process your data under their own rules.
Google, Apple and some browser makers may process data in the United States. The transfer is based on the European Commission's decision on an adequate level of data protection (EU-US Data Privacy Framework) or on standard contractual clauses approved by the European Commission.
You have the right to:
- access your data and get a copy of it;
- rectify data that is inaccurate;
- erase your data;
- restrict processing;
- data portability for the data you give us;
- object to processing based on our legitimate interest;
- withdraw consent at any time, without affecting what we did before you withdrew it;
- lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
You can correct your profile and delete your account yourself in the settings. For anything else, write to hello@praywave.app. We will answer within one month.
Giving an e-mail address is necessary to create an account. All other data is voluntary.
The Service's security measures work automatically. When many failed sign-in attempts come from one IP address or someone tries to use another person's session, the Service blocks that address for an hour or a day and, in the most serious cases, deactivates the account. If you think a block is a mistake, write to the Administrator, who will look into it personally.
When the way the Service processes data changes, we will change this policy and announce it in the Service or by e-mail. The date of the last change is shown at the top of this page.