Sekretne Historie
Wersja polska

Privacy Policy – Sekretne Historie (Secret Stories)

Version 1.16 · effective from 20 October 2026

Change from version 1.15: options when cancelling a VIP Subscription bought on the Website – an offer to stay (once per person), a pause in the Subscription and undoing a cancellation or a pause, each confirmed by e-mail – and one message about a day before a cancelled VIP Subscription ends, with the option to resume it (sections 3, 4 and 10). Version 1.15 added total counts of hearts and of read Chapters of each Novel on the Website and in the App and the heart at the end of a Chapter (the first heart in the App creates an Anonymous Account, just like the first purchase). Version 1.14 added e-mails about the Novels and offers to people without an active VIP Subscription, ordinary notifications about the Novel you read after a VIP Subscription ends and treating addresses reported by SendGrid as unsubscribed. Version 1.13 added information about the referral programme in e-mails and the rules on who is shown the programme as a Referrer. Version 1.12 added the "Poleć znajomym" referral programme. In version 1.11 notifications in the App became ordinary notifications (no offers, your phone's permission is enough), and from version 1.0.3 of the App the notification token is linked to the Account. Version 1.10 added messages about the free App (up to 4) for everyone without a VIP Subscription who gave an e-mail address at an order on the Website.

This is an English translation of the Polish Privacy Policy (https://sekretnehistorie.pl/privacy). In the event of any discrepancy, the Polish version prevails.

This policy explains how we process the personal data of people who use the website https://sekretnehistorie.pl (the "Website") and the mobile app "Secret Stories: Books & Audio" (the "App"), together the "Service". The Website and the App are a single service and use the same accounts. Capitalised terms have the meaning given to them in the Terms of Service (https://sekretnehistorie.pl/terms/en). We process data in accordance with Regulation (EU) 2016/679 (the "GDPR").

1. Controller

The controller of your personal data is GOTOIT SP. Z O.O., ul. Słoneczna 9A, 55-080 Smolec, Poland, KRS 0001010915, NIP 8961620558, REGON 524066068 ("we", "us").

2. Contact

For any matters relating to personal data, you can contact us by e-mail at novels@gotoit.pl, or in writing at our registered address. We have not appointed a data protection officer.

3. What data we process

  • Account data – your e-mail address (if provided) and your Account identifier, including the identifier of an Anonymous Account. If you sign in to the Website with a Google account, we receive your e-mail address and basic profile data from Google (e.g. name, profile picture), which the sign-in system stores. When you sign in to the App with a Google account or with Apple, the only data from Google or Apple that we store is your e-mail address and, for Sign in with Apple, also the user identifier assigned by Apple and an Apple token needed to revoke access when the Account is deleted (section 5).
  • Order form data – the e-mail address entered when ordering on the Website (also when the order was not paid for), the selected product, and the Novel and Chapter from which the order was started.
  • Purchase data – order and purchase history (product, price, date, purchase channel and method), Coin balance, unlocked Chapters, VIP Subscription status.
  • Payment metadata – e.g. transaction ID and status, type of payment method, subscription identifier. We do not process card numbers or bank login details – payment details are processed directly by Stripe, Tpay, Apple or Google.
  • Activity in the Service – information about reading and listening to Chapters (e.g. Chapters opened, reading progress, use of the player) and about the progress of orders, linked to a random identifier of the browser or App installation.
  • Technical data – IP address, country derived from the IP address, user agent (browser and operating system type), device type and platform (Website, iOS, Android). To prevent abuse (e.g. to limit login attempts) we store the IP address only as a cryptographic hash.
  • Advertising identifiers (Website only) – campaign parameters (UTM), the Meta ad click identifier (fbclid) and identifiers from Meta cookies (_fbp, _fbc).
  • Correspondence – the content of messages you send us, e.g. complaints.
  • Reason for cancelling the VIP Subscription – if you choose to give one when cancelling: the reason you pick and the comment you type. They go to our team (section 8, Telegram) and, for a Subscription paid by card, also to Stripe.
  • Options when cancelling a VIP Subscription bought on the Website – if instead of cancelling you choose the offer to stay, a pause or resuming the Subscription: the type of option, when and where it was chosen (Website or App), the reduced amount and the number of cheaper renewals, the length and end of the pause; to give the offer to stay only once per person – the e-mail address and its normalised form (lower case, without a "+" suffix, for Gmail without dots). For a Subscription paid by card we pass Stripe the discount on the next renewals or the date until which it does not charge (the pause).
  • Reading and listening progress on the Account – the last Chapter opened in each Novel, your place in that Chapter and your place in the recording, if you use the App on an Account (including an Anonymous Account).
  • Counts of hearts and read Chapters – a record of which Chapters were opened in a browser (with the random browser identifier from our own statistics) or in the App on an Account, including an Anonymous Account (with the Account identifier, based on the reading progress saved on the Account), and likes of Chapters with the heart at the end of a Chapter – on the Website (with the browser identifier or, when signed in, the Account identifier) and in the App (with the Account identifier) – together with the time of the like, needed for the per-minute limit on likes. The record contains no e-mail address. We show only total numbers for a whole Novel (e.g. "♥ 8 943 👁 43 210" – hearts and read Chapters), never who read or liked a Chapter. To prevent abuse, we do not count automated programs and we limit the number of Chapter opens and likes from one browser, one Account and one IP address (we do not store the IP address for this).
  • Notification token – if your phone allows the App to send notifications: the device identifier assigned by Apple's or Google's notification service (token), platform, App version, the notification types (new Chapters, new Novels), the Novels read on that device, whether the iPhone delivers notifications quietly, the identifier of the Account (including an Anonymous Account) you use the App with (from version 1.0.3) and, if consent to notifications about what's new was given in the App up to version 1.0.2, the date and wording of that consent. We do not store an e-mail address with the token.
  • Data for the messages about the Novels and offers – if your e-mail address was given at an order on the Website and you have no active VIP Subscription: a record of which messages we sent and when (without the e-mail address), your usual reading time (the hour worked out from your sessions on the Website and the reading-progress records of the App), whether a sign-in link in one of our messages was clicked, the offers sent to that address (the type of offer, the e-mail address, the validity period and whether it was used) and information from Twilio SendGrid that the address rejects messages, reported them as spam or unsubscribed from them. To choose what to write about we use purchase data (e.g. the date a VIP Subscription ended, the Coin balance) and activity statistics (the furthest Chapter read and the Chapter of an order), without collecting new data.
  • Referral programme data – your referral code and, if you invite someone or use an invitation: who invited whom, when and how (link, code, Google Play), the status of the referral and the rewards given (Coins, VIP days); to check the conditions – whether the invited person read the first Chapter to the end (from reading statistics or reading progress in the App) and made a first purchase; to prevent abuse – cryptographic hashes of the e-mail address, of the browser or App installation identifier and of the IP address. If you have a referral code, we also keep hashes of the browser and App installation identifiers and of the IP addresses you use while signed in (at most 20, from the last 30 days), to recognise an invitation of a second account of yours. Until the referral qualifies (for no longer than 30 days) we also keep the random identifier of the browser or App installation the invitation was used from. The Referrer sees only the number of invitations, qualified referrals and rewards – not the e-mail addresses of the people invited. To decide whether to show you the programme as a Referrer, we check whether you have a paid purchase that was not refunded in full and, if not, since when you have been using the Service (the first session on the Website or in the App, the creation of the Account, the first order) and on how many different days the purchase offer was shown (the purchase sheet in the App, a locked Chapter, the checkout or paywall on the Website); for this we use purchase data and activity statistics linked to your Account, e-mail address and browser or App installation identifier, without collecting new data. Once the conditions are met, we record the date and the reason (a purchase, or using the Service without buying) with your referral code – from then on you can refer without being checked again. If we write to you about the programme in an e-mail after a purchase before you have an Account, we keep this record with the order form data (with the e-mail address) and copy it to your referral code once you create an Account with that address.

4. Purposes and legal bases

PurposeLegal basis
Providing the services and your Account: sign-in, supplying Digital Content, handling Coins and the VIP Subscription, making purchases available on the Website and in the App, deleting the AccountArt. 6(1)(b) GDPR – performance of a contract
Accepting and fulfilling orders and payments, including recurring payments and refundsArt. 6(1)(b) GDPR – performance of a contract
Options when cancelling a VIP Subscription bought on the Website (the offer to stay, a pause, undoing a cancellation or a pause) and confirming each of them by e-mailArt. 6(1)(b) GDPR – performance of a contract
Giving the offer to stay when cancelling only once per person (a record with the normalised e-mail address)Art. 6(1)(f) GDPR – legitimate interest
Syncing reading and listening progress between devicesArt. 6(1)(b) GDPR – performance of a contract
Settlements, issuing and keeping accounting recordsArt. 6(1)(c) GDPR – legal obligation under tax and accounting laws
Handling complaints and withdrawal statementsArt. 6(1)(b) and (c) GDPR
Answering other enquiriesArt. 6(1)(f) GDPR – legitimate interest
Transactional e-mails: login codes and links, purchase confirmations, notices of changes to the Terms and pricesArt. 6(1)(b) GDPR
Reminders about an unfinished order (no more than once a week) and – to people who gave an e-mail address at an order on the Website and have no VIP Subscription (who bought nothing or only Coins) – up to 4 messages about the free App over about a week: the first about an hour after buying only Coins, otherwise at the earliest the day after the order or the reminder about it; we stop once you sign in to the App with that e-mail address, buy a VIP Subscription or unsubscribe – each message with an unsubscribe linkArt. 6(1)(f) GDPR – legitimate interest
Ordinary notifications in the App, with no offers: about new Chapters of the Novels you read and about new Novels, reading reminders and invitations to read on; linking the notification token to the Account (from version 1.0.3 of the App), so that the tokens of its devices are deleted when the Account is deleted and, after a VIP Subscription ends, at most 3 notifications about the Novel you read are sent to themArt. 6(1)(b) GDPR – performance of a contract (information about the Novels you read) and Art. 6(1)(f) GDPR – legitimate interest (letting you know about new content in the Service, encouraging you to read on, also after a VIP Subscription ends, and deleting the tokens of devices when the Account is deleted)
Reading reminders also about Chapters to unlock and offers (commercial information) – only for people who agreed to them in the iPhone App version 1.0.2 (from version 1.0.3 the App does not ask for this consent), until they withdraw that consentArt. 6(1)(a) GDPR – consent (also required by Article 398 of the Polish Electronic Communications Law)
E-mails about the Novels and offers – to people who gave an e-mail address at an order on the Website and have no active VIP Subscription (after a VIP Subscription ended, without a purchase or with only Coins bought): about the Novel you read, new Chapters, the prices of the VIP Subscription and Coins, about every third message with a time-limited offer (valid for 72 hours, once per person for each type of offer, only for purchases on the Website); after a VIP Subscription ends 4 messages over about 3 weeks, and for others the first after the second message about the App or once those messages have ended (at the earliest a week after buying Coins); then about once a month, preferably when new Chapters come out; between 9:00 and 20:00, where possible at the time you usually read; these messages, the messages about the App and the message about the referral programme wait so that, together with all our marketing messages (the order reminder included), at most one per 48 hours and 3 per 7 days go out; the order reminder itself is sent without waiting; not sent while you have an active VIP Subscription, and a purchase stops the current series at once (one exception: if you cancel a VIP Subscription bought on the Website, about a day before it ends we send one message saying until when it works, with the option to resume it – it also counts towards these limits); marketing messages are paused for an address that got at least 4 of them, clicked no link in any of them and has not used the Service for 60 days (a visit or a click resumes them) – each message with an unsubscribe linkArt. 6(1)(f) GDPR – legitimate interest
The "Poleć znajomym" referral programme: the referral code, recording invitations, checking the conditions (a new e-mail address, the first Chapter read, the invited person's first purchase), giving rewards (Coins, moving the payment date of a VIP Subscription bought on the Website) and showing the Referrer the resultsArt. 6(1)(b) GDPR – performance of a contract (the Referral Programme Terms)
Preventing abuse of the referral programme (referring oneself, multiple accounts, the same device or network) using hashes of identifiers and of the IP addressArt. 6(1)(f) GDPR – legitimate interest
Deciding who is shown the referral programme as a Referrer – people who bought something, or who have been using the Service for at least 14 days without buying and saw the purchase offer on at least 3 different days – based on purchase data and activity statisticsArt. 6(1)(f) GDPR – legitimate interest
Information about the "Poleć znajomym" referral programme by e-mail: a short note at the end of the purchase confirmation e-mail for Website purchases (before the seller details) and a one-time message about the programme to people who bought something before it was announced – with your referral link if you have an Account with that e-mail address (we then create the referral code automatically); no push notifications – each with an unsubscribe linkArt. 6(1)(f) GDPR – legitimate interest
Our own statistics and analytics, preventing abuse and fraud, security and improving the ServiceArt. 6(1)(f) GDPR – legitimate interest
Showing on the Website and in the App the total number of hearts and of read Chapters of each Novel, and the heart at the end of a Chapter – total numbers only, based on the record of opened and liked Chapters, without the e-mail addressArt. 6(1)(f) GDPR – legitimate interest
Internal notifications for our team about sales, VIP Subscription cancellations (with the reason given, if any), qualified referrals and incidents (with a masked e-mail address)Art. 6(1)(f) GDPR – legitimate interest
Measuring advertising effectiveness on the Website with the Meta Pixel and Meta Conversions APIArt. 6(1)(f) GDPR – legitimate interest
Establishing, exercising or defending legal claimsArt. 6(1)(f) GDPR – legitimate interest

Our legitimate interests are keeping the Service secure and working properly, preventing abuse, developing the Service, monitoring sales, measuring the effectiveness of our advertising, letting you know about unfinished orders (the reminder), letting people without a VIP Subscription who gave an e-mail address at an order on the Website know about the free App (up to 4 messages), letting people without an active VIP Subscription who gave an e-mail address at an order on the Website know about the Novels, new Chapters and offers (including time-limited offers), letting you know about new Chapters and Novels in the App's notifications and encouraging you to read on, letting people who bought something know about the referral programme (a short note in the purchase confirmation and a one-time message), showing the referral programme to Referrers only if they bought something or are unlikely to buy (so that information about the programme does not draw anyone away from buying), reminding people who cancelled a VIP Subscription bought on the Website, a day before it ends, that they can resume it, giving the offer to stay only once per person, showing how many hearts and read Chapters each Novel has, and protecting ourselves against claims.

Advertising measurement (Meta) – Website only

On the Website we use the Meta Pixel, and from our servers we send Meta information about events (e.g. visits, choosing a product, starting an order, purchases) via the Conversions API. This may include ad click identifiers (fbclid, _fbc), the _fbp identifier, IP address, user agent, the order value and a hashed (one-way encrypted) version of the e-mail address entered in the order. This helps us understand which ads lead to visits and purchases. Meta may also process this data for its own purposes in accordance with its privacy policy. For collecting these data on the Website and transmitting them to Meta we are joint controllers with Meta Platforms Ireland Ltd. (Art. 26 GDPR) under Meta's Controller Addendum; Meta is responsible for any further processing.

The Meta Pixel is not loaded on the document pages (Terms of Service, Privacy Policy, Account deletion, Referral Programme Terms) or in the admin panel.

The App contains no Meta Pixel or any other third-party advertising or analytics tools, does not send Meta any information about App purchases and does not track Users across other companies' apps or websites.

5. The App and Anonymous Accounts

In the App you can make purchases and leave a heart without providing an e-mail address. In that case, on your first purchase or your first heart at the end of a Chapter we automatically create an Anonymous Account with a random identifier, which we process together with purchase data received from Apple or Google (via RevenueCat) and technical data. If you sign in to the App (with an e-mail address, a Google account or Apple), we move your existing purchases to the Account linked to that address so that they are available on other devices and on the Website. Please note that Coins held on an Anonymous Account not linked to an e-mail address cannot be recovered if the device or the App is lost.

In the App you can sign in with a code sent to your e-mail address, with a Google account or with Apple ("Sign in with Apple"), and on the Website with a code or a Google account. When you sign in to the App with a Google account or with Apple, the App gives us a signed token issued by Google or Apple that confirms your e-mail address. We check the token and keep only the e-mail address from it (for Sign in with Apple, also the user identifier assigned by Apple). We do not receive your contacts or password, we do not store your name, profile picture or other profile data, and we do not use this data for advertising. Instead of your address, Apple may give us a random forwarding address in the privaterelay.appleid.com domain – your Account is then linked to that address. If you already have an Account with the same e-mail address, you will sign in to that Account.

When you sign in with Apple, the App also gives us a one-time code, which we exchange with Apple for a token (a so-called refresh token). We keep it only to revoke the App's access to your Apple ID at Apple when the Account is deleted, and we do not use it for anything else. We delete the token right after access is revoked. If Apple does not respond for a while, we retry for up to 3 days and then delete the token. If we have no token (e.g. an older version of the App did not provide it), you can remove the access on your iPhone: Settings → tap your name → Sign in with Apple → Secret Stories → Delete.

The App sends usage statistics (e.g. opening a Chapter, playing audio) only to us, linked to a random installation identifier rather than to your e-mail address. On the device, the App stores data it needs to work: sign-in session data, settings (e.g. playback speed), the age confirmation, a random installation identifier, cached Account and catalogue data, copies of recently opened Chapters (text) that can be read offline, reading and listening progress, the setting for automatically unlocking the next Chapters, notification and reminder settings (including the consents given), and the times the App was opened in the last 14 days (for reading reminders). Audio recordings are not saved on the device – listening requires an Internet connection. When you sign out or delete your Account, the App removes the copies of Chapters, your progress, the automatic unlocking setting and the cached Account data from the device; all of its data is removed when the App is uninstalled.

If you use the App on an Account (including an Anonymous Account), we save your reading and listening progress on it (section 3) so you can continue on another device, after signing in again or on a new phone. Without an Account, progress stays only on the device. The Chapters saved in your reading progress also count towards the total number of read Chapters of a Novel, and a heart given at the end of a Chapter in the App is saved with the Account (section 3).

The App sends ordinary notifications: about new Chapters of the Novels you read and about new Novels, reading reminders and invitations to read on. Ordinary notifications contain no offers and need no separate consent – your phone's notification permission is enough. On an iPhone they may first arrive quietly in the Notification Center until you decide whether to keep them. The App may also ask about them after you finish reading a Chapter. We offer no reward for turning notifications on, and turning them off does not limit your use of the App. You can turn them off at any time in the Account tab or in your phone's settings.

We send notifications about what's new at most once a day, between 9:00 and 21:00. They are delivered by Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging); we give them the device token and the notification text. We write about new Chapters based on the Novels read on that device. From version 1.0.3 of the App, if you use it with an Account (including an Anonymous Account), the token is linked to that Account, so that the tokens of its devices are deleted when the Account is deleted. After a VIP Subscription ends, we send at most 3 ordinary notifications about the Novel you read to the devices linked to the Account (your bookmark, a line of the story, new Chapters), after about 2, 6 and 14 days, based on the reading progress saved on the Account – with no offers or prices, within the same limit as the notifications about what's new; after that only the notifications about what's new. If you keep using the App with notifications on after the Account is deleted, the App may give us the token again, no longer linked to the Account. Tokens from versions up to 1.0.2 are not linked to the Account. We do not store an e-mail address with the token. The App up to version 1.0.2 asks for consent to notifications about what's new as marketing information; if that consent was given, we keep its date and wording with the token, and such a device gets the same ordinary notifications as any other. From version 1.0.3 the App does not ask for this consent.

The phone itself schedules reading reminders (local notifications) – we do not use Apple's or Google's notification services for them and send nobody the reminder text or your reading times. You turn them on in the dialog that appears after you finish reading a Chapter, or in the Account tab. After a break in reading, the phone reminds you to continue the Novel you are reading – at most once a day, between 8:00 and 21:30, at the time you usually read, less and less often and for no longer than 30 days after you last read; while you have an active VIP Subscription – at most 3 times, after about 1, 3 and 8 days. Ordinary reminders are only about Chapters that open without paying and contain no offers. The phone schedules reminders in advance, based on the Account status (e.g. the VIP Subscription) the App last knew – a change made outside the App (e.g. a VIP Subscription bought on the Website) applies from the next time you open the App. The App works out your usual reading time on the device from the times it was opened in the last 14 days. In the usage statistics we record only your answers to the notifications question, turning notifications and reminders on and off (also just the offers), and opening the App from a notification or a reminder.

The iPhone App version 1.0.2 also asks for consent to reminders about Chapters to unlock (e.g. how many Coins the next Chapter costs) and offers (VIP Subscription, Coins). If that consent was given, we send such reminders – commercial information – only on the basis of that consent and only without an active VIP Subscription. You can withdraw that consent at any time in the Account tab (the "Also chapters to unlock and offers" switch) or by turning reminders off; neither withdrawing the consent nor turning reminders off limits your use of the App. From version 1.0.3 the App does not ask for such consent.

6. Where your data comes from

We receive data directly from you (e.g. your e-mail address, the content of your messages), collect it automatically when you use the Service (technical data, activity, identifiers, ad link parameters), and receive it from payment operators, Apple, Google and RevenueCat (information on transaction and subscription status) and, if you sign in with a Google account or with Apple, from Google or Apple. In the referral programme we learn who invited you from the invitation code or link you use (when the App is installed from Google Play – from Google Play).

7. Do you have to provide your data?

Providing data is voluntary but necessary to conclude and perform the contract. An e-mail address is needed for purchases on the Website and to use your purchases across devices; in the App you can make a purchase without one. Processing data for accounting purposes is required by law. Giving a reason for cancelling the VIP Subscription is entirely voluntary and does not affect the cancellation.

8. Recipients

Data may be shared with the following parties to the extent necessary for the purposes described above:

  • Lovable (Lovable Cloud) – hosting of the Website, server and infrastructure;
  • Supabase – database and sign-in system (as part of Lovable Cloud);
  • Stripe – card, Apple Pay and Google Pay payments on the Website;
  • Tpay (Krajowy Integrator Płatności S.A.) – BLIK payments on the Website, including recurring payments;
  • Apple – distribution of the iOS App, in-app payments (App Store), Sign in with Apple in the App (including revoking access when the Account is deleted) and delivery of notifications (Apple Push Notification service);
  • Google – distribution of the Android App and in-app payments (Google Play; when the App is installed from an invitation link, Google Play passes the invitation code to the App), delivery of notifications in the Android App (Firebase Cloud Messaging), sign-in with a Google account on the Website and in the App, and fonts (Google Fonts) loaded by the Website, which involves sharing your IP address;
  • RevenueCat – processing and validating in-app purchases;
  • Twilio SendGrid – e-mail delivery (once a day we fetch from SendGrid the list of addresses that reject messages, reported them as spam or unsubscribed from them, and mark these addresses as unsubscribed);
  • Meta Platforms Ireland – advertising measurement on the Website (section 4);
  • Telegram – the messenger in which our team receives internal notifications about sales, VIP Subscription cancellations, qualified referrals and incidents; these contain only a masked e-mail address (e.g. "jo***@gmail.com"), the amount, the product and the advertising campaign and, for a cancellation, also how long the Subscription ran, the number of payments and the reason and comment if you give them (e-mail addresses and phone numbers typed in the comment are replaced with a placeholder, e.g. "[numer]"); for a qualified referral – the masked e-mail addresses of the invited person and the Referrer and the rewards given; the daily summary of the messages about the Novels and offers contains only numbers, no e-mail addresses;
  • providers of accounting and legal services to us;
  • public authorities – where required by law.

Parties that process data on our behalf do so under data processing agreements or these providers' data processing terms and in line with our instructions. Some recipients (in particular payment operators, Apple, Google and Meta) also process data as independent controllers under their own privacy policies.

9. Transfers outside the EEA

Some providers (e.g. Supabase, Stripe, RevenueCat, Twilio SendGrid, Apple, Google, Meta, Telegram) may process data outside the European Economic Area, including in the United States. Such transfers are based on a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified organisations) or on standard contractual clauses approved by the European Commission. We share with the Telegram messenger only the data described in section 8, with a masked e-mail address. You can obtain information about these safeguards, and a copy of them, by contacting us.

10. How long we keep data

  • Account data – until the Account is deleted;
  • Apple token and the user identifier assigned by Apple (Sign in with Apple in the App) – until the Account is deleted and access is revoked at Apple; if Apple does not respond for a while – no longer than 3 days after the Account is deleted;
  • reading and listening progress saved on the Account – until the Account is deleted;
  • notification token (with the link to the Account and the record of the consent to notifications about what's new, if one was given) – until you turn notifications off, delete the Account (we then delete the tokens of all devices linked to it), or Apple or Google reports the token as invalid (e.g. after the App is uninstalled), and no longer than 270 days after the App was last opened;
  • order and accounting data (orders, payments, invoices) – for 5 years from the end of the calendar year in which the tax payment deadline passed; after the Account is deleted we keep them without the e-mail address, IP address and advertising identifiers (payment operators, Apple and Google keep transaction data, including payer data, in their own systems in line with their own obligations);
  • e-mail address from an unfinished order (also for the order reminder and the messages about the App) – until the Account is deleted, you object or ask for erasure, and no longer than 2 years after the last activity; we use it for messages about the App for no longer than 90 days after the last activity at an order (usually about a week);
  • e-mail address given when buying Coins – we use it for messages about the App for no longer than 30 days after the first purchase (usually about a week) or until you object; otherwise we keep it like order and accounting data. The record of which messages about the App we sent (without the e-mail address) is kept for up to 12 months;
  • record of the messages about the Novels and offers (which messages we sent and when, your usual reading time – without the e-mail address) – up to 12 months after the last change; we use the e-mail address from the order for these messages until you object (the "Wypisz się" link), delete the Account or the order form data is deleted, and no longer than 2 years after the last activity at an order; offers (type, e-mail address, validity period, use) – 2 years after the offer was sent, and deleted at once when the Account is deleted;
  • the record of options chosen when cancelling a VIP Subscription (the offer to stay, a pause, resuming – with the e-mail address and its normalised form) – 2 years after the choice, and deleted at once when the Account is deleted; the Subscription data itself (e.g. the end of a pause, the reduced renewal amount) – like order and accounting data;
  • referral programme data – the referral code and the records of referrals and their rewards until the Account is deleted; invitations refused or not qualified in time – up to 12 months after the invitation was used; the browser or App installation identifier – until the referral qualifies, for no longer than 30 days; the IP address hash – 30 days; when the Account is deleted we delete the referral code and the e-mail address from the referral records and keep the hashes (without the e-mail address) for up to 12 more months, so that the same address or device does not get a reward again; the record that we sent the one-time message about the programme (without the e-mail address) – up to 12 months;
  • reading and listening statistics – 180 days;
  • the record of opened and liked Chapters (the total counts, without the e-mail address) – for as long as we show these counts; the part linked to an Account is deleted together with the Account, and a like when you tap the heart again;
  • order progress statistics (without an e-mail address) – no longer than 2 years;
  • one-time login links – valid for 14 days; the links, records of login attempts (with a hashed IP address), records of notifications from payment operators and technical logs – for as long as necessary for security, accounting and troubleshooting, no longer than 12 months;
  • internal notifications in the Telegram messenger (with a masked e-mail address) – no longer than 2 years;
  • correspondence and complaints – until they are dealt with, and then until the relevant limitation period expires;
  • data processed on the basis of legitimate interest – until you successfully object, but no longer than the periods stated above;
  • data needed to establish, exercise or defend legal claims – until the relevant limitation period expires.

11. Your rights

You have the right to:

  • access your data and receive a copy of it;
  • have your data rectified;
  • have your data erased;
  • restrict processing;
  • data portability;
  • object to processing based on legitimate interest, including advertising measurement and sending the unfinished-order reminder, the messages about the free App (up to 4, to people without a VIP Subscription), the messages about the Novels and offers (to people without an active VIP Subscription) and the information about the referral programme by e-mail – the "Wypisz się" (unsubscribe) link in each of these messages (after unsubscribing, purchase confirmations still come, without the information about the programme);
  • turn notifications and reading reminders off at any time (the Account tab or your phone's settings);
  • withdraw at any time the consent to reminders also about Chapters to unlock and offers, given in the iPhone App version 1.0.2 (Account → "Also chapters to unlock and offers", or by turning reminders off); withdrawal does not affect the lawfulness of processing before it;
  • lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland, https://uodo.gov.pl) if you believe we process your data unlawfully.

To exercise your rights, write to novels@gotoit.pl. We may ask you to confirm your identity (e.g. by writing from the e-mail address linked to your Account). We respond without undue delay and in any case within one month.

Deleting your Account. You can delete your Account yourself in the App (Account → "Usuń konto"), on the Website after signing in (sekretnehistorie.pl/account → "Usuń konto") or by asking us by e-mail from the address linked to the Account. We then delete the Account, the Coin balance, unlocked Chapters, reading and listening progress saved on the Account, the notification tokens of devices linked to the Account, the referral code (and the e-mail address in the referral records), the record of opened and liked Chapters linked to the Account, order form data, login records and login links and, if you sign in with Apple, we revoke the App's access to your Apple ID at Apple. Orders and accounting data are kept for the period required by law, without being linked to your e-mail address. Instructions: https://sekretnehistorie.pl/delete-account.

12. Cookies and browser storage

The Website stores information in your browser in cookies and in browser storage (local storage and session storage):

  • necessary – your sign-in session, age confirmation, the current order (selected product, e-mail address entered in the form, BLIK payment status), access to purchased Chapters, the last Chapter read, a friend's invitation opened from a link (the invitation code, for up to 30 days or until you sign in);
  • our own statistics – a random browser and session identifier (also for the counts of hearts and read Chapters) and the parameters of the advertising campaign the visit came from; this data goes only to us;
  • advertising – Meta Pixel cookies (_fbp, _fbc) and cookies set by Meta on its own domains, used to measure advertising effectiveness.

At present the Website does not show a cookie consent banner – the Meta Pixel loads automatically (with the exceptions described in section 4). If you do not want Meta to receive information about your visit, you can block cookies (in particular third-party cookies) or tracking scripts in your browser settings or with an extension, use private browsing, or object by writing to novels@gotoit.pl. Blocking necessary storage may prevent you from signing in or making purchases on the Website.

Card payments take place on Stripe's page, which uses its own cookies in accordance with Stripe's policy.

13. Profiling and automated decisions

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Advertising measurement may involve profiling by Meta. We choose the content and timing of the messages about the Novels and offers automatically (based on purchases, the Novel you read and your usual reading time) – this has no legal effects on you, and objecting (the "Wypisz się" link) ends these messages.

14. Security

We use appropriate technical and organisational measures to protect data, including encrypted connections (HTTPS), password-free sign-in with one-time codes, storing login links only as cryptographic hashes and limiting access to data to what is necessary.

15. Minors

The Service is intended for adults only. We do not knowingly collect data from anyone under 18. If you believe such data has reached us, please contact us and we will delete it.

16. Changes to this policy

We may update this policy, e.g. if the law or the way the Service works changes. We will announce significant changes in the Service and, for Users whose Accounts are linked to an e-mail address, also by e-mail. The current version is always available at https://sekretnehistorie.pl/privacy, and the English version at https://sekretnehistorie.pl/privacy/en.

Regulamin·Polityka prywatności·Usuwanie konta·Pomoc·Kontakt: novels@gotoit.pl · tel. +48 509 437 668

Sekretne Historie (Secret Stories) · GOTOIT SP. Z O.O., ul. Słoneczna 9A, 55-080 Smolec, NIP 8961620558