Privacy policy
Tadapool is a shared record for group gifts. This policy explains, in plain language, what personal data Tadapool collects, why, where it lives, and what your rights are. It covers the Tadapool app for iOS and Android and the tadapool.com website.
Who is responsible for your data?
Tadapool is operated by Vitalii Koretskyi, an individual developer based in Andorra. For anything in this policy, write to the address at the end — you will get an answer from a person, not a ticket queue.
Andorra's data-protection law — Qualified Law 29/2021, of 28 October, on personal data protection (LQPD) — mirrors the EU's GDPR, and the European Commission recognises Andorra as providing an adequate level of data protection. Where this policy cites the GDPR, the equivalent Andorran provisions apply alike.
What does Tadapool collect, and why?
| Data | Why we process it | Legal basis | Kept for |
|---|---|---|---|
| Account details — your name, email address and username | To create and operate your account, and so friends can add you by username | Performance of a contract (GDPR Art. 6(1)(b)) | Until you delete your account |
| Sign-in — email sign-in, or your Google or Apple account identifier | To authenticate you | Performance of a contract | Until you delete your account |
| Pool content — pool names, occasions, dates, currencies, targets; contribution records and their amounts; notes; gift ideas and votes; payment instructions an organiser chooses to publish | To provide the shared record that is the product | Performance of a contract | Until it is deleted in the app, or until account deletion |
| Friend records — the usernames of friends you connect with, and “held money” records you both confirm | To provide the friends and balances features | Performance of a contract | Until deleted, or until account deletion |
| Push notification token | To deliver invitations, nudges and updates you have asked for | Consent — the notification permission on your device | Until you sign out, disable notifications or uninstall |
| Crash reports (Google Crashlytics) — crash traces, device model, OS version, an installation identifier | To find and fix bugs | Legitimate interest | 90 days |
Two things Tadapool deliberately does not collect: your contacts — friends are added by username, never by uploading your address book — and your location.
Does Tadapool handle my money or payment details?
No. Tadapool never touches the money. There is no wallet, no card on file and no payment processing. When you record a contribution, you are writing down a number — the actual payment happens directly between you and the organiser, by whatever means you already use. Tadapool never sees card numbers, bank credentials or payment-account details. Amounts in the app are entries you and other members typed in, and Tadapool does not verify them.
What can other people see?
Every pool is invite-only. Only its members can see the pool — the occasion, the target, the member list, contribution records, notes, gift ideas and votes, and any payment instructions the organiser publishes. Nothing in a pool is public. Three details worth knowing:
- You can hide your contribution amount from other members; the pool's organiser can always see it.
- If a pool is shared by link, anyone who opens that link joins as an invited member — so treat a pool link like an invitation, because it is one.
- Friends you connect with see your username and the “held money” records you both confirm.
Where is my data stored?
App data — your account and pool content — is stored in Google Firebase, on Google Cloud infrastructure in the European Union. Crash reports are processed by Google and may be processed in the United States. Data is encrypted in transit.
Who else receives my data?
Tadapool does not sell personal data, does not share it for advertising, and runs no ads. Data is disclosed only to processors — companies that process it on Tadapool's behalf, under contract:
- Google — Firebase: authentication, database and crash reporting; Google Play services for push notifications on Android
- Apple — push notifications on iOS
- Vercel — website hosting and cookieless website analytics
- Microsoft — Clarity website analytics, only if you accepted analytics cookies on the website
Beyond processors, data would be disclosed only if the law genuinely requires it, or as part of a transfer of the service itself — in which case this policy would continue to apply and you would be notified.
Does my data leave my country?
Sometimes — Google, Apple, Microsoft and Vercel are international companies, and some processing happens in the United States. Transfers are protected by the mechanisms the GDPR provides: European Commission adequacy decisions (including the EU–US Data Privacy Framework, under which Google and Microsoft are certified) and, as a fallback, Standard Contractual Clauses. Transfers between the EU/EEA and Andorra are covered by Andorra's adequacy decision.
How long do you keep my data?
The table above lists a period for each kind of data. The rule behind it: content is kept while your account exists, because keeping the shared record is the service; diagnostic data is kept only for the short window listed; and when you delete your account, data associated with it is deleted. Records inside pools that other members still use — for example, a contribution record in someone else's active pool — are retained in that pool, no longer linked to your deleted account.
How do I delete my account and data?
In the app: Profile → Delete account. Or email us from the address on your account and it will be done manually. Your account is deactivated immediately and permanently erased within 30 days.
What about the website?
The tadapool.com website measures visits in two ways. Vercel Web Analytics is cookieless and stores nothing on your device — visitors are a request hash discarded within 24 hours. Microsoft Clarity stores cookies, so it runs only if you choose Accept all in the consent banner; withdrawing consent is one click in the footer of any page. Both are described fully in the cookie policy: Cookie policy
What are your rights?
Wherever you live, you can ask what data Tadapool holds about you, ask for it to be corrected or deleted, receive a copy in a portable format, object to or restrict processing, and withdraw any consent you gave — without it affecting your use of the app. Write to the address at the end; requests are answered within one month.
You also have the right to complain to a supervisory authority:
- EU/EEA and the United Kingdom — your national data-protection authority (GDPR / UK GDPR)
- Andorra — the Andorran Data Protection Agency (APDA, www.apda.ad)
- United States — depending on your state, state privacy laws grant rights to know, delete, correct and opt out of the sale or sharing of personal data. Tadapool sells no data and shares none for advertising, so there is nothing to opt out of — but the other rights are honoured on request.
- Brazil — rights under the LGPD; the authority is the ANPD
- Canada — access and correction rights under PIPEDA; the authority is the OPC
- Australia — access and correction rights under the Privacy Act; the authority is the OAIC
How old do I have to be?
Tadapool is for adults: you must be 18 or older to create an account. Tadapool does not knowingly collect data from anyone under 18; if you believe someone under 18 has an account, write to us and it will be removed.
Will this policy change?
If the app starts processing new kinds of data, this policy changes first, and material changes are announced in the app before they take effect. The date at the top always tells you when it was last touched.
Contact
Vitalii Koretskyi · Andorra
hello@tadapool.com