TachoPomoc

TachoPomoc Privacy Policy

Last updated: 28 October 2026 (version 2026-10-28: anonymous app usage counters, section 3.12; assistant entries kept on the device for 126 days)

Language: Polski · Українська · English

This policy describes how we process data in connection with: (A) using the TachoPomoc mobile app and (B) using the tachopomoc.pl website, serving business customers (code packages for companies) and the partner programme.

1. Who is the data controller

The controller of personal data is Michał Sondej, running a sole proprietorship, Polish tax ID (NIP) 578-317-82-18, REGON 541736370, place of business: Elbląg (Poland). We provide the full postal address on request sent to the contact address below.

Contact on all matters concerning personal data: [email protected]. We have not appointed a data protection officer (there is no obligation to do so).

2. In a nutshell

• The app does not require an account. Its content (scenarios, rules, message dictionary, “Something's up?”, the “Working time assistant” module, the driver profile with deadlines, data imported from a driver card file) works offline and is stored only on your device - we do not send it anywhere.
• The app connects to the internet only to: download industry news and current driving ban data, handle an in-app purchase, check a referral code, activate a company (fleet) code, receive messages from TachoPomoc (push notifications - you can turn them off) or - if you choose to - send feedback about the app. It also sends anonymous usage counters, without a device identifier (section 3.12). Details in section 3.
• The tachopomoc.pl website does not use cookies or analytics tools (section 7).
• The app does not show ads. We advertise it on Facebook and Instagram - only if you agree, the app shares install and purchase information with Meta so that our ads reach drivers (section 3.11). Without your consent nothing is sent to Meta. We do not make automated decisions about you.
• The “Request a quote” form on the business page collects company contact details solely to prepare a quote and a contract (section 4).
• The exception is the printout check: a photo of a printout that you take yourself is sent to Anthropic (Claude model) to be read and is not stored anywhere (section 3.10).

3. Mobile app - what data and why

3.1. In-app purchases

To handle the full access purchase (one-time or subscription) we use Google Play Billing and the RevenueCat service. The following are processed: an anonymous app user identifier generated by RevenueCat, the purchase transaction identifier and history, the store country, device type and system version, and the IP address (RevenueCat uses it to determine the approximate country). The data is used to link the purchase to your installation and to restore purchases. Payment is handled by Google Play - we have no access to your card details. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and accounting obligations (Art. 6(1)(c) GDPR). RevenueCat policy: revenuecat.com/privacy.

3.2. Partner referral code

If you enter a referral code or install the app from a partner link, the app: (a) checks that the code is valid with a request to tachopomoc.pl (we send only the code itself, none of your data), (b) passes the partner code to RevenueCat as an installation attribute so that a commission can be assigned to the partner if you make a purchase. We do not link this to your identity. Legal basis: our legitimate interest - settling the partner programme (Art. 6(1)(f) GDPR).

3.3. Company (fleet) code

If you activate a company code, the app sends to tachopomoc.pl: the code itself and a technical device identifier (an irreversible cryptographic hash of the Android identifier - we do not send the raw identifier). On the server we store: the code, the device identifier hash, an IP address hash and a pseudonymous customer identifier in RevenueCat (derived from the company code). This is used solely to assign the licence and enforce the device limit per code (protection against unauthorised code sharing). Legal basis: performance of the contract with the company that bought the package (Art. 6(1)(b) GDPR) and our legitimate interest in limiting abuse (Art. 6(1)(f) GDPR).

3.4. Industry news

The app downloads a publicly available news file from tachopomoc.pl with an ordinary GET request. Our hosting provider (Cloudflare) may briefly process your IP address in standard security logs at the edge of its network. We do not store that address or link it to your installation. The most recently downloaded news is stored locally on the device (to show something offline). News summaries are prepared automatically by an AI model from Anthropic based on content from industry portals (including 40ton.net, truckfocus.pl) - the news content is processed, not your data. In the Ukrainian and English versions the same model translates the summaries. Each news item links to the original article at the source.

3.4a. Driving bans - data updates

While you use the app (no more often than every 12 hours, when internet access is available), the app downloads a publicly available file with the current driving ban calendar from tachopomoc.pl - with an ordinary GET request, without any data about you, your settings or the countries you selected. The same applies as for news: Cloudflare may briefly process the IP address in security logs; we do not store it. The downloaded file is stored locally on the device. Selected countries, vehicle class and reminder times stay only on the device (section 3.5). When preparing driving ban data we use, as an aid, an AI model from Anthropic that analyses public pages of authorities - not your data; we approve every change manually before publishing.

3.5. Data stored only on the device

• Settings: the selected tachograph model, interface language, completed tutorial, favourite scenarios, confirmation that you have read the terms and the policy (date and document version), Start screen layout, notification settings, driving ban settings (tracked countries, vehicle class, reminder times), the list of notifications in the notifications panel.
• Working time assistant: activity entries (type of activity, times, an optional note you enter) and the activity log. The module automatically deletes entries older than 126 days (about 4 months - needed for average working time and rest compensation).
• Driver profile: expiry dates of the periodic qualification (code 95), driver card, driving licence, medical and psychological examinations, ADR certificate and the date of the last card download. You enter them yourself or - with your consent - we read them from a card file you load into the app yourself. They are used solely for local reminders.
• Driver card import: if you load a driver card file (.ddd and related), the app analyses it only on the device and saves the import history: card number, import date and recorded activities (type, start and end). The name and date of birth from the file are used only for the preview before import and are not saved in the history. The file itself is not copied or sent. The history is not deleted automatically - you can delete it at any time with the bin icon on the “Card history” screen. The infringement report (text or PDF) is created on the device and goes only where you send or save it yourself.
• Backup: if you save a backup of the assistant and profile data yourself, a file is created on your device. You decide where to save it or whom to give it to - we do not receive it.
• GPS trip in the assistant (optional): while a trip is on, the app reads the phone's location and speed to recognise driving and stops. We do not store the position or send it anywhere - the log keeps only time segments (driving, break). Location is used only during an active trip, and you always see a persistent notification then. In manual mode (the default) you start the trip yourself. In automatic mode, if you choose it, the app uses the system activity recognition (Google Play Services) to notice that you are in a vehicle and then starts the trip by itself - also in the background, when the app is closed (this needs the "allow all the time" location permission). Without that permission it only shows a notification asking whether to start the trip. Activity information is used only on the device; we do not store or send it. You can turn automatic mode off in the trip settings and withdraw the location and physical activity permissions in Android settings.
• “Something's up?”: an information section. It does not call for help, does not use location, and does not access contacts or the network.

We do not send this data anywhere and have no access to it. It is deleted when you uninstall the app. Based on it, the module schedules local notifications on the device (these reminders are created on the device and do not pass through any server), which requires notification permission in Android - you can withdraw it in the device settings.

3.6. Voice search

If you use voice search, the app uses the speech recognition built into the system and requests that it runs on the device (without sending the recording to a cloud speech recognition service). If your device does not support offline mode for the selected language, the feature may be unavailable. The recognised text is used only to fill in the search field and is not sent to our servers. The feature requires microphone permission, which you can withdraw in the device settings.

3.7. Fonts

The app includes font files in its own package and does not download them from external servers.

3.8. App feedback (“Rate the app”)

If you use the “Rate the app” module, we send to our server: a rating on a 1-5 scale, the answer to “is the app useful”, items ticked from ready-made lists (“what is missing”, “what to improve”), the app version number, platform and language, and - if you tick it - how you heard about the app. The “Comment” field is optional and free-form - please do not enter personal data in it (name, registration number, phone). You may optionally give an e-mail address - we use it only to reply to your report (e.g. to ask about the problem or let you know about a fix); the legal basis is then your consent given by providing the address (Art. 6(1)(a) GDPR), which you can withdraw by writing to us. Instead of your IP address we store only its irreversible hash (to limit the number of submissions). The form does not require logging in or giving your identity. Legal basis: our legitimate interest in developing the app (Art. 6(1)(f) GDPR). We keep feedback for up to 12 months and do not share it with anyone. If you give 4 or 5 stars, after sending the feedback the app may show the Google Play system rating dialog - this is handled entirely by Google; we receive no data from it.

3.9. Messages from TachoPomoc (push notifications)

From time to time we send short messages: about important rule changes, new features or important matters concerning the app. We do not use this channel for advertising by other companies. For delivery we use Firebase Cloud Messaging (Google). The app registers with it and receives from Google a device identifier for notifications (token), and then joins recipient groups: all users, app language and version type (free / full). We send each message to a whole group - we do not receive or store the token or any data that would identify your device, so we cannot send a message to a specific person. Received messages are also added to the list in the app's notification panel (on the device only). Legal basis: our legitimate interest in informing users about the app (Art. 6(1)(f) GDPR). You can turn the messages off with the “Messages from TachoPomoc” switch in the app's notification settings (the app then leaves all groups) or in the Android system settings.

3.10. Printout check from a photo

When you take a photo of a tachograph printout in the “Printout check” module (or pick one from your gallery), the app crops it on the device (Google document scanner, without sending the image to Google) and sends it through our server to Anthropic, whose AI model reads the activities and totals. The printout contains, among other things, your name, driver card number, vehicle registrations, mileage and working hours. We do not store the photo or the reading result - the result goes only to the app on your device and disappears when you close the screen. Anthropic processes the photo as our processor, solely to read it, does not use it to train models and deletes it under its retention rules for data sent via the API (up to 30 days). On our server we store only a counter of used checks linked to the anonymous RevenueCat purchase identifier (to enforce the limit) and the total daily cost of readings (no data about you). We check your plan (one-time purchase, subscription, company licence) with RevenueCat. Legal basis: performance of a contract - providing a feature you use (Art. 6(1)(b) GDPR).

3.11. TachoPomoc ads on Facebook and Instagram (consent only)

We advertise the app on Facebook and Instagram. For the ads to reach drivers who actually use the app, Meta needs to know that an ad led to an install or a purchase. We share this only if you give your consent (a separate, unticked box on the terms screen, or the “TachoPomoc ads on Facebook” switch in Profile). Consent is not required to use the app. Without it the app does not connect to Meta and we share nothing with it.

With your consent, Meta Platforms Ireland Ltd. receives: information that the app was opened and installed (via the Meta SDK in the app), information about a purchase or renewal - type, amount, currency (sent on our behalf by RevenueCat), the device advertising ID (Android Advertising ID), an anonymous install ID generated by the Meta SDK, IP address, device model and OS version. We do not share the content you use in the app, driver profile data, driver card data, GPS trips or printout photos.

Meta uses this data to measure and target our ads and, as a separate controller, also for its own purposes described in the Meta Privacy Policy. For collecting and transmitting the data to Meta we are joint controllers with Meta (Meta Business Tools Terms with the Controller Addendum) - you may exercise your rights with us or with Meta. Legal basis: your consent (Art. 6(1)(a) GDPR; for access to information on your device - Art. 399 of the Polish Electronic Communications Law). You can withdraw consent at any time in Profile: the app then turns off the Meta SDK and removes the Meta ID from our purchase system. You can also reset or delete the advertising ID in Android settings.

3.12. Anonymous usage counters

The app counts which modules are opened (one device counts at most once per module per day), where the purchase screen was opened from and whether a purchase followed. Only aggregate numbers with the date are sent to the server, e.g. "Assistant: 1" - without a device identifier, account, location or anything you enter. We do not store IP addresses; to protect the server against abuse we keep only a hash of the IP address for 24 hours. Purpose: to know which features to develop and what helps people decide on the full version. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

4. The tachopomoc.pl website, business customers and partners

4.1. “Request a quote” form (for companies)

We collect: company name, tax ID, e-mail address, phone, fleet size, the package of interest and the message, as well as an IP address hash (to limit form abuse). We use this data - including a named e-mail or phone of the contact person - solely to prepare a quote, for business contact, to conclude and perform the contract and to issue an invoice. Legal basis: steps prior to entering into a contract and its performance (Art. 6(1)(b) GDPR), accounting obligations (Art. 6(1)(c) GDPR) and our legitimate interest in business contact and securing the form (Art. 6(1)(f) GDPR). Providing the data is voluntary but necessary to prepare a quote. We do not share the content of the enquiry with any third parties.

4.2. Company codes - server side

Company code activations are described in section 3.3. On the server we store the company name (for a batch of codes), the code, the device identifier hash, the IP address hash, a pseudonymous customer identifier and activation dates. The admin panel shows this data only to us, to manage licences and detect abuse.

4.3. Partner programme

Creator applications. If you apply to the partner programme (the form on the “for creators” page or by e-mail), we process: the name and address of the Channel, e-mail address, tax ID, company name, the message, the proposed identifier in the link and the recorded accepted version of the Partner Programme Terms; to limit form abuse - an IP address hash. Purpose: considering the application and concluding and settling participation in the programme. Legal basis: steps prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in handling the application (Art. 6(1)(f) GDPR). Applications that did not lead to cooperation are deleted after 12 months.

For partners (people and companies recommending the app) we process: name, e-mail address, tax ID, company name, the agreed commission rate, the accepted version of the Partner Programme Terms, settlement and payout data. The referral link tachopomoc.pl/go/<code> counts clicks only in aggregate (a daily counter per code) - without the IP address, without cookies and without identifying the person clicking - and redirects to Google Play. When a purchase is made with a given code, RevenueCat sends us a notification (webhook), from which we store: the event identifier, partner code, pseudonymous customer identifier, event type, store, amount, currency and date - in order to calculate the commission. Legal basis: performance of the contract with the partner (Art. 6(1)(b) GDPR), accounting obligations (Art. 6(1)(c) GDPR) and our legitimate interest in settling the programme (Art. 6(1)(f) GDPR).

4.4. “I want an iOS version” poll

The button stores only an aggregate vote counter. To limit repeated voting, we temporarily (up to 24 hours) store a hash of your IP address. Legal basis: our legitimate interest in a reliable poll result (Art. 6(1)(f) GDPR).

5. Data recipients and transfers outside the EEA

We use the following providers (processors or separate controllers), to whom we entrust or disclose data to the extent necessary for the stated purposes:

Some providers are based in the USA. Transfers of data outside the European Economic Area take place on the basis of safeguards provided for in the GDPR - in particular standard contractual clauses and, where the provider participates in the Data Privacy Framework, on that basis. We will provide a copy of the safeguards on request. Otherwise, data may be disclosed to entities authorised by law (e.g. tax authorities).

Provider policies: RevenueCat, Cloudflare, Google, Anthropic, Meta.

6. How long we keep data

7. Cookies and browser local storage

The tachopomoc.pl website does not use cookies or any analytics or tracking tools. The only thing stored in your browser is a technical flag indicating that you have already voted in the iOS poll - it contains no identifier and is not sent anywhere.

8. Automated decisions and profiling

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you. If you agree to share data with Meta (section 3.11), Meta may use it to tailor the ads it shows you - this has no legal effects on you.

9. Your rights

You have the right to: access your data and obtain a copy, rectification, erasure, restriction of processing, data portability (for data processed on the basis of a contract or consent and by automated means), and to object to processing based on our legitimate interest (Art. 6(1)(f) GDPR) - on grounds relating to your particular situation. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before the withdrawal.

Send requests to [email protected]. You also have the right to lodge a complaint with a supervisory authority - the Polish President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or the data protection authority in your EU country of residence.

10. Data security

We apply technical and organisational measures appropriate to the risk - including encryption in transit (HTTPS), restricted access to the admin panel, and pseudonymisation of device identifiers and IP addresses. However, no transmission or storage of data is 100% secure and we cannot fully guarantee it.

11. Children

The app is aimed at professional drivers and is not intended for children under 18. We do not knowingly collect data from such persons.

12. Changes to the policy

We will announce material changes in the app update notes, and on the first launch after a change the app will ask you to confirm again that you have read the documents. The current version of the policy is always available at this address.

TachoPomoc is not a product of Continental AG / VDO or Stoneridge Electronics. Tachograph model names are trademarks of their respective owners.