Privacy policy

Who we are

Tangiby is run by Denys Oleksiienko, an individual entrepreneur (FOP) registered in Ukraine, vul. Patriotiv Ukrainy 163, Nikopol, Ukraine. We are responsible for your personal data (the "controller") when you use the Tangiby app or the website tangiby.app. You can reach us using the details or the form on the Contact page. Email: support@tangiby.app.

What we collect

Your email address and password (stored hashed), the assets, warranties, maintenance records and custom fields you enter, and the documents you upload.

When you turn on notifications, the app stores a push token for that device so we can deliver your reminders, with the app's language and the phone's time zone so they arrive in your language at 9:00 local time. When you sign out, this phone stops receiving reminders, and the token is deleted from our servers when the app can reach them. Otherwise it is removed once the push service reports it is no longer valid, or when the phone is next used to sign in. When you turn notifications off in your phone's settings, the token is deleted the next time you open the app. The token is also deleted with your account.

In more detail:

• Account: your email address, a hash of your password (never the password itself), the account creation date, and the date and version of your acceptance of the terms and acknowledgement of the privacy policy.
• Your records: what you enter about your things, such as names, categories, brands and models, serial numbers and phone IMEIs, purchase dates, prices and sellers, warranties and insurance dates, service records and their costs, meter readings, maintenance rules, reminders, notes and custom fields.
• Your files: the photos and PDFs you upload, such as receipts and warranty cards. They can contain personal data, for example your name and address on an invoice.
• Preferences: your notification settings and the app language.
• Subscriptions: the store (Apple or Google), the plan, its status and when it ends, and the identifiers the store gives the purchase. We do not receive your payment details.
• Contact messages: the email address, the optional name and the message you send through the contact form.
• Technical data: your IP address, used for a moment to limit repeated sign-in attempts and protect the service, and the request records that our hosting providers keep for security and troubleshooting.

How we use it

To provide the app: show your records, send reminders you asked for and keep your account secure. We do not sell your data.

In detail, and the legal basis for each under the GDPR:

• Running the service you signed up for (performance of our contract with you): your account, storing and showing your records and files, search, the dashboard and statistics, reminders, and the emails that belong to your account (welcome, password reset codes, password changed, account deletion).
• Push notifications (your consent): only after you allow them on your phone. You can stop them in the app or in your phone’s settings. Turning off a notification category stops that category; turning off system permission stops all pushes. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Checking and applying your subscription with Apple or Google (performance of our contract with you).
• Keeping the service and your account secure, preventing abuse and fixing errors (our legitimate interest in a safe, working service).
• Answering your messages (our legitimate interest in replying to you, or steps you asked for before signing up).
• Meeting applicable legal obligations (legal obligation). Separately, recording your acceptance of the terms and acknowledgement of the privacy policy (our legitimate interest in documenting the agreement and providing evidence in disputes); this is not blanket consent to data processing.

What we do not do

We do not sell or rent your data, show advertising, use advertising or analytics trackers, build profiles of you, or make automated decisions that have legal or similar effects on you. Your content is not used to train AI models.

Receipt scanning is not available yet. Before it is, we will update this policy to explain what it processes.

Where it is stored

Records are kept in a managed database. Uploaded documents are stored privately and are opened only through short-lived links.

Notifications are delivered through Expo's push service, Apple and Google, which receive the text of the reminder, including the asset's name and what is due.

We use the following providers to operate the service. Their role depends on the service they provide; where they act as processors, applicable data-processing terms govern that processing:

• Supabase: the database that holds your account and records.
• Cloudflare (R2): private storage for the files you upload.
• Railway: runs the server behind the apps.
• Vercel: hosts the website.
• Resend: sends our emails.
• Expo, Apple and Google: deliver push notifications.
• Google (Gmail): receives and stores support correspondence when our support mailbox is hosted there.

Apple and Google

When you buy Premium, Apple or Google handles the payment as an independent company under its own privacy policy. We receive only what we need to confirm the subscription.

International transfers

Our providers and their subprocessors may process data in countries other than yours, including the United States. Applicable law may require safeguards before an international transfer. Depending on the recipient and destination, these may include standard contractual clauses or an applicable adequacy decision; the EU-U.S. Data Privacy Framework applies only to eligible certified recipients. Contact us for details of the destinations and safeguards applicable to your data and how to obtain a copy.

Your choices

You can edit or delete your records at any time. You can delete your account in the app or at /delete-account on this site. To ask about your data, contact us using the details on the Contact page.

Cancel your subscription in the App Store or Google Play before requesting account deletion to avoid further charges. App Store subscriptions are not cancelled by deleting a Tangiby account. We cancel Google Play subscriptions only during final account deletion, after the 30-day recovery period; renewal charges may occur before then.

Your rights

Depending on applicable law and the conditions for each right, you may request access, correction, erasure, restriction of processing, objection, or a portable copy of your data. You can withdraw consent without affecting the lawfulness of processing before withdrawal. Edit or delete records in the app, or contact us for other requests. We respond within one month where the GDPR applies; for complex requests it allows an extension of up to two further months, with notice and reasons within the first month. Other applicable statutory deadlines remain unaffected.

You can complain to the competent data protection authority, including the Ukrainian Parliament Commissioner for Human Rights in Ukraine, or the authority where you habitually live or work where the GDPR applies. You do not need to contact us before making a complaint.

How long we keep data

We keep account data while your account exists. A deletion request starts a 30-day recovery period. Signing in before then cancels deletion. After that period, we automatically process deletion of the account, records and files from active systems. Provider failures can delay completion; we retry failed attempts. Contact us if deletion has not completed or if you need to exercise your right to erasure separately.

Database backups expire under the configured backup retention schedule rather than immediately with the account. Service logs are retained for security and troubleshooting according to the relevant provider’s retention settings. These copies can therefore remain after deletion from active systems. Contact us for the applicable retention periods. Contact correspondence is kept while needed to resolve your request and any related dispute, then deleted; it is not automatically removed by account deletion.

A password reset code expires after 15 minutes; expiry does not by itself mean that its database record has been deleted. Push tokens are removed as described above. The stores retain their own purchase records under their own policies, independently of Tangiby account deletion.

Security

Everything travels over encrypted connections. Passwords are stored only as strong one-way hashes. Files are kept in private storage and opened only through short-lived links. On your phone, your sign-in is kept in the system’s secure storage; on the web, in a cookie that page scripts cannot read.

No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

Cookies and local storage

The website uses only cookies it needs to work: one that keeps you signed in, and one that remembers your language for a year. It uses no analytics or advertising cookies, so it does not ask for cookie consent. The apps and the website also keep a few settings on your device, such as whether you have seen the welcome tour.

Children

The service is not meant for anyone under 16. If we learn that a child under 16 has created an account, we will delete it.

Changes to this policy

The date at the top shows the current version. If we make a significant change, we will tell you in the app or by email before it takes effect.