Privacy Policy (GDPR)

We process your data only to the extent necessary for the following purposes:

• Running the free app and user registration: managing the user account, verifying access and cloud synchronisation of colony data.
  Legal basis: consent given by registering / legitimate interest in providing the service.
• Feedback and sign-ups of interested users: keeping e-mail addresses so that features can be improved based on questionnaire answers.
  Legal basis: user consent.
• Internal telemetry and stability diagnostics: recording offline activity (session dates only) to optimise synchronisation.
  Legal basis: legitimate interest in keeping the app running.
• Bug reports: a beekeeper can send a bug report from the app. Sending is always confirmed by consent. The description, app version, account and, optionally, a technical diagnostic record the user ticks are stored.
  Legal basis: user consent.

Data you enter: e-mail address, optional user name, profile photo (if you upload one), apiary records (apiary names, optional GPS coordinates used for the weather forecast and analyses) and the text of files you upload to the assistant's knowledge base.

Technical telemetry: IP address, browser type, session identifier (presence token) and technical error logs.

Cookies: the app uses no marketing, advertising or third-party tracking cookies (no Google Analytics, Facebook Pixel etc.). It only uses the browser's local storage to keep the Supabase sign-in token (JWT) and internal technical data needed for offline use. Tracking cookies may be loaded only when a user voluntarily fills in the feedback questionnaire in an embedded Google Forms iframe.

To run the app we use the following providers. Transfers (e.g. to the USA) are covered by the EU Standard Contractual Clauses and the EU-US Data Privacy Framework:

Data from your Google account

Connecting a Google account is optional – you can use the app without it and you do not lose your data. If you connect it, the app asks Google only for these permissions:

• Google Drive – only files created by the app (drive.file): backups, inspection photos and knowledge-base files. The app cannot see any other files on your Drive.
• Gmail – send only (gmail.send): monitoring alerts, planner reminders and a test e-mail that you turn on yourself, sent to your own e-mail address. Our server sends alerts and reminders once a day even when you are not using the app; for this it keeps your Google access, which you can disconnect at any time. If you invite an observer and choose to send the invitation from Gmail, the app sends one invitation from your account to the address you entered. The app does not read your mail or contacts.
• Basic profile data (userinfo.email, userinfo.profile): e-mail address, name and profile photo, to sign in and display the account.

We use data received from Google only for the features listed above. We do not sell it, do not use it for advertising or to train artificial intelligence models, and do not share it with third parties, except where necessary for these features or where required by law. You can revoke access at any time in the app (Settings → Storage) or at myaccount.google.com/permissions.

ApiaryONE's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Encryption in transit: the app, the website and all servers communicate only over HTTPS (TLS). Unencrypted connections are not used.
• Encryption at rest: the database and files at Supabase are stored encrypted on its servers (AES-256). Backups and photos on Google Drive are kept in your own Google account and protected by Google.
• Account isolation: every record in the database belongs to one account. Rules in the database itself (Row Level Security) allow each user to read and change only their own records. An observer sees only what the beekeeper has shared with them. Account isolation is checked automatically before every new version is released.
• Google access: long-term access to your Google account (the refresh token) is stored in a table that no user account and no browser can access. Only our server reads it, and only to send an e-mail you turned on or to work with the app's own files on Drive. The short-lived access token (valid for about one hour) is stored only on your device. When you disconnect Google in the app, access is revoked at Google and the token is deleted from the server the next time it would be used.
• E-mail content: the text of sent alerts and invitations is not stored after sending. The app has no permission to read your mail.
• Sign-in: a second factor (authenticator app) and a passkey can be added to the account. Administrative functions require the second factor.
• Diagnostics: the app's technical logs contain no apiary names, e-mail addresses or locations, only technical identifiers.
• Your device: when you sign out, the app deletes the account's data stored on the device.

5.1 We process personal data for as long as you are registered in the free beta version.

5.2 If you ask for your account to be deleted, all your personal data and colony records will be permanently deleted from our cloud servers (Supabase) within 30 days.

Under the GDPR you have the right to access your data, to have it corrected or erased (the right to be forgotten), to restrict processing and to object to processing, and the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Hraničná 12, Bratislava, dataprotection.gov.sk).

You can exercise your rights at any time by e-mail to our contact address: ram419@gmail.com.