Privacy Policy

Data controller and contact

The controller of your personal data within the meaning of Article 4(7) GDPR is ZORDON INTELLIGENCE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, entered in the register of entrepreneurs of the National Court Register under KRS number 0001190915, NIP 7252358503, REGON 542545843 (the "Controller", "we").

One contact for everything — data protection, general matters, security: hi@zordonintelligence.pl.

All contact regarding this policy and the rights described in the "Your rights" section takes place electronically, using the e-mail addresses listed above.

We answer data protection requests without undue delay and in any event within one month of receipt. That period may be extended by a further two months where a request is particularly complex — in which case we explain the reason for the delay.

What data we process — overview

Oatmeal Feed is a free web application (a PWA) for reading RSS and Atom feeds, running in the user's browser. The application has no user accounts, requires no sign-in and offers no subscriptions or payments in its web version.

The core function of the service — storing your feed list, articles, read and saved markers, and settings — takes place entirely on the user's device. The Controller has no access to that information and does not keep copies of it.

Data that may be processed by the Controller falls into four categories:

• data stored exclusively on the user's device (IndexedDB and localStorage) — beyond the Controller's reach;
• technical data processed transiently by the stateless feed proxy (GET /api/feed);
• data submitted in the iOS waitlist form (POST /api/waitlist): e-mail address, interface language and submission timestamp;
• standard access logs kept by the hosting infrastructure provider.

Data that stays on your device

Your feed list, saved articles, read and saved markers, and interface settings are stored in your browser's local storage — in the IndexedDB database and in localStorage.

This data is not sent to the Controller, is not synchronised between devices and is not stored on the server. The Controller cannot read, change or delete it.

As a result, operations on local data — reviewing it, correcting it, exporting it or deleting it — are carried out by the user directly in the application or in the browser settings.

If the user relies on browser profile synchronisation, local data may be included in the synchronisation operated by the browser vendor under its own terms. The Controller does not control that mechanism and has no access to it.

Data processed by the feed proxy (GET /api/feed)

To load an RSS or Atom feed, the application calls the GET /api/feed?url=... endpoint. This is a stateless proxy: the server fetches the indicated public feed and returns its content to the browser, which works around the CORS restrictions imposed by browsers.

The request involves the URL of the requested feed and the technical data necessary to serve the connection, in particular the IP address and the user-agent identifier, which are inherent to network communication.

The server does not store feed content, does not build a reader profile and does not keep a history of fetched feeds or read items. Processing is transient and ends once the request has been handled.

The feed URL is not used to build profiles, for advertising purposes or to analyse the user's interests.

Waitlist data (POST /api/waitlist)

The waitlist works independently of the reader and is the only place in the service where we collect personal data.

The sign-up form for the iOS waitlist processes three items:

• the e-mail address provided by the user;
• the interface language in which the user completed the form;
• the submission timestamp.

Scope of waitlist data

We keep the scope of this data to the minimum needed to send you a single notification about the iOS launch. We do not ask for your first or last name, phone number or any other details.

Providing an e-mail address is a condition of handling the submission — without it we could not tell you about the launch. The remaining elements of the submission, namely the interface language and the timestamp, are technical and serve only to process the form correctly.

Sharing and deletion of waitlist data

Waitlist data is passed to the e-mail delivery / submission storage provider configured by the Controller, which processes it as a processor strictly to the extent necessary to handle the submission.

We use this data solely to send one notification about the iOS launch. It is not used for marketing newsletters, is not sold, is not shared for advertising purposes and is not used for profiling.

Joining the waitlist is voluntary. You may request deletion of your data at any time by writing to hi@zordonintelligence.pl. We action such requests promptly and no later than one month after receipt.

Server and hosting infrastructure logs

Standard access logs of the infrastructure provider may include the IP address, user-agent identifier, timestamp, request path and HTTP response code.

Logs are kept by the infrastructure provider for a short period necessary to maintain the security of the service and for technical diagnostics, in line with that provider's configuration and terms of service.

Logs are not used to identify individuals, to analyse reader behaviour or for profiling. They serve to detect abuse, such as mass querying of the proxy, to respond to incidents and to keep the service available.

Legal bases for processing

We process data only where a legal basis under Article 6(1) GDPR exists. The scope of data assigned to each basis is limited to the purpose for which the data was obtained.

We assign the following legal bases to each category of data:

• Article 6(1)(b) GDPR (performance of a contract) — handling the feed request made through GET /api/feed, that is, providing the feature the user asks for when using the application;
• Article 6(1)(a) GDPR (consent) — joining the waitlist through POST /api/waitlist and sending the iOS launch notification;
• Article 6(1)(f) GDPR (legitimate interests) — service security, preventing abuse and mass querying of the proxy, technical diagnostics, establishing and pursuing legal claims;

Scope and consequences of the legal bases

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.

Using the reader does not require you to provide the Controller with any personal data at all. Providing an e-mail address in the waitlist form is voluntary, but it is necessary for us to send the iOS launch notification.

Where processing relies on Article 6(1)(f) GDPR, you may object to it. We assess such objections by considering whether our legitimate interests override your rights and freedoms; see the "Your rights" section for details.

Your data stays on your device

The basic design principle of Oatmeal Feed is that user data does not leave the user's device. Feeds, articles, read and saved markers, and settings are written to IndexedDB and localStorage in the browser.

The Controller does not store this data on a server, does not back it up, does not synchronise it across devices and has no technical means of reading it. There is no mechanism by which we could restore your feed list after you clear your browser data.

Deleting local data is something you do yourself — by clearing site data in your browser or by removing the application from your device. No request to the Controller and no waiting for a reply is required.

For as long as the data remains on your device, its confidentiality depends on the security of that device and browser, including the passwords and screen lock you use.

Recipients of data and transfers outside the EEA

The Controller does not sell personal data and does not share it for advertising purposes. Our list of recipients is closed — beyond the processors listed below, we do not disclose personal data to anyone.

Recipients may only be processors acting on the Controller's instructions:

• Vercel Inc. (United States) — the hosting infrastructure provider on which the application and the API endpoints run;
• the e-mail delivery / submission storage provider that handles the iOS waitlist.

Transfers outside the EEA — bases and scope

Transfers of data outside the European Economic Area, in particular to the United States, rely on the standard contractual clauses approved by the European Commission (SCCs) or — for recipients that qualify — on the adequacy decision adopted under the EU-US Data Privacy Framework.

The data transferred to the hosting provider is limited to the technical data described in the "Server and hosting infrastructure logs" section and to requests handled by the feed proxy. Waitlist data is shared only with the provider that stores submissions.

Public authorities may obtain access to data only under applicable law and only to the extent their request requires.

Retention periods

We keep data no longer than is necessary for the purposes for which it was collected.

Retention periods differ by category of data and are as follows:

• local data (feeds, articles, markers, settings) — until the user deletes it; the Controller does not hold it at all;
• data processed by the feed proxy — not retained; processing ends once the request has been handled;
• waitlist data — up to 12 months after the iOS launch date, or if the launch does not happen, no longer than 24 months from sign-up; in both cases shorter if consent is withdrawn or you request deletion;
• access logs kept by the infrastructure provider — 30 days, for security and technical diagnostics;
• analytics data — none: the Service uses no analytics at all, neither cookie-based nor cookieless.

Longer retention periods

Once the applicable retention period ends, data is deleted or anonymised.

Where the law requires certain data to be kept for longer, for example in connection with pending proceedings or an accounting obligation, the retention period may be extended accordingly. This applies only where such an obligation actually exists.

Your rights

To the extent that the Controller processes your personal data, you have the rights set out below.

These rights stem from the GDPR and we exercise them free of charge. Some of them may be limited where the law permits us to continue processing — in that case we explain the legal ground for refusal.

• right of access to data (Article 15 GDPR) — information on whether and what data we process;
• right to rectification (Article 16 GDPR);
• right to erasure (Article 17 GDPR);
• right to restriction of processing (Article 18 GDPR);
• right to data portability (Article 20 GDPR) — for data processed by automated means on the basis of a contract or consent;
• right to object to processing based on legitimate interests (Article 21 GDPR);
• right to withdraw consent at any time (Article 7(3) GDPR);
• right to lodge a complaint with a supervisory authority (Article 77 GDPR).

How to exercise your rights

To exercise your rights, write to hi@zordonintelligence.pl. We answer requests without undue delay and no later than one month after receipt; for complex or numerous requests, we may extend that period by up to two months and will explain the reason.

The supervisory authority competent for the Controller is the President of the Personal Data Protection Office of Poland (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl). You may also lodge a complaint with the supervisory authority in the country of your habitual residence, place of work or the place of the alleged infringement.

Rights concerning data held only on your device are exercised by you directly in the browser — the Controller cannot access that data, so it cannot disclose, rectify or delete it.

Security

Communication between the browser and the server takes place exclusively over HTTPS, which encrypts transmission at the transport layer.

We apply data minimisation: we operate no user accounts, store no passwords and collect no data that is not necessary for the service to function. Having no accounts and no sign-in significantly reduces the attack surface — there is no credential store that could be exposed.

Access to the infrastructure and to the service configuration is limited to authorised personnel and to what maintaining the service requires.

In the event of a personal data breach we take the measures set out in Articles 33 and 34 GDPR, including — where required — notifying the supervisory authority and communicating the breach to the individuals concerned.

Security reports are welcome at hi@zordonintelligence.pl.

Children

The service is intended for people who are at least 16 years old.

We do not direct the service to children and we do not knowingly collect personal data from anyone under 16. The reader requires no data at all, and the only place where we can receive personal data is the waitlist form.

If we learn that waitlist data belongs to a person under 16 and was submitted without the required consent, we delete it promptly. You can report such a case to hi@zordonintelligence.pl.

Anyone under 16 may use the service only with the consent and under the supervision of a parent or legal guardian, in accordance with applicable law.

Automated decisions and profiling

We do not make decisions about users based solely on automated processing, including decisions that produce legal effects or otherwise significantly affect them within the meaning of Article 22 GDPR.

We do not profile users, build reader profiles, analyse interests to personalise advertising or carry out remarketing.

The service contains no advertising, no sale of data and no disclosure of data to advertising companies.

Analytics, if enabled, operates on aggregated data without identifying individuals and without profiling. The Cookie and Local Storage Notice describes this in detail.

Changes to this Privacy Policy

We may amend this policy when the scope of the service, our list of providers, the applicable law or its interpretation changes.

We announce material changes in the service interface before they take effect. Where we process your data on the basis of consent and we hold your e-mail address, we also inform you of changes to the scope of processing electronically.

The current version of the policy is always available at oatmealfeed.app. The date of the last change and the version number appear at the top of this document.

Contact

All contacts — general, data protection and rights, security: hi@zordonintelligence.pl.

Controller: ZORDON INTELLIGENCE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, KRS 0001190915, NIP 7252358503, REGON 542545843.

All contact regarding this policy takes place electronically, using the e-mail addresses listed above.

Matters not covered by this policy are governed by the GDPR and by Polish law.