This document contains the detailed declarations required by the 'Data safety' section in the Google Play Console. It serves as a technical reference — the Play Console displays this information in an abbreviated, standardised form.
1. Purposes of data collection
- Provision of the service and its functionality — all account data, projects, tasks
- Support and communication — e-mail contact, support requests
- Security, fraud prevention and legal compliance — technical logs, crash reports
- Push notifications and alerts — FCM token, installation identifiers
We do NOT collect data for the purposes of:
- Advertising or personalised marketing (we do not use the advertising ID)
- Cross-app analytics / cross-device tracking
- Selling or sharing data with third parties for their marketing purposes
- Activities for credit, insurance or scoring purposes
2. Is data collected?
YES — we collect the data listed in the table below.
3. Is data shared with other companies/organisations?
YES — we share data with providers (processors) solely for the purpose of providing the service. List: Google (Firebase, Vertex AI), Anthropic (AI features with a selected Claude model, incl. AI assistants), fal.ai and the producers of selected models (Media AI — media generation), ElevenLabs (Media AI — cloning your own voice), Brave Search (web search at the AI assistant's request), Paddle, Resend (sending of platform e-mails), Hetzner (intermediary server for e-mail and document conversion, EU), e-mail providers (when the IMAP/SMTP integration is enabled). Full list and legal bases — Privacy Policy sections 6–7.
4. Detailed data declarations (following the Play Data safety schema)
4.1. Personal info — Personal data
| Data type | Collected? | Shared? | Required/optional | Purpose |
|---|---|---|---|---|
| Name (first name/name) | YES | YES (processor: Google Firebase) | Required at registration | Identification in the application |
| Email address | YES | YES (processor: Google Firebase, Resend) | Required | Sign-in, contact, notifications |
| User IDs | YES | YES (processor: Google Firebase) | Required | Technical identification |
| Address (postal address) | YES | YES (processor: Paddle) | Required for paid Plans (invoice) | Issuing a VAT invoice |
| Phone number | NO | — | — | — |
| Race and ethnicity, Religious beliefs, Sexual orientation, Political beliefs | NO | — | — | — |
| Other info (profile photo, job title description, profile colour) | YES | YES (processor: Google Firebase) | Optional | UI personalisation, identification within the team |
4.2. Financial info — Financial data
| Data type | Collected? | Shared? | Purpose |
|---|---|---|---|
| User payment info (card number) | NO | — (passed directly to Paddle, does not pass through HUBAL) | — |
| Purchase history | YES | YES (Paddle) | VAT invoices (5 years — Polish Tax Ordinance) |
| Credit score | NO | — | — |
4.3. Health and fitness — Health and fitness
We do NOT collect any health/fitness data.
4.4. Messages — Messages
| Data type | Collected? | Purpose |
|---|---|---|
| Emails (content and metadata) | YES — ONLY when the e-mail integration is enabled (IMAP/SMTP, MS365) | Handling e-mail in the application with the User's consent |
| SMS or MMS | NO | — |
| Other in-app messages (team chat, AI chat) | YES | Team communication, AI assistant |
4.5. Photos and videos — Photos and videos
| Data type | Collected? | Purpose |
|---|---|---|
| Photos (photos from the camera / gallery) | YES — only when you tap 'Take photo' or 'Choose from gallery' | Attaching to tasks / documents; input material in Media AI (passed to the provider of the selected model — Google Vertex AI or fal.ai) |
| Videos | YES — only when using Media AI | A video added as input material, e.g. for subtitles, montage, reading content and style, or as a voice sample (passed to the provider of the selected model — Google Vertex AI or fal.ai) |
4.6. Audio files — Audio files
| Data type | Collected? | Purpose |
|---|---|---|
| Voice or sound recordings (microphone) | YES — during active use of the 'hold-to-talk' feature; in Media AI — only when you add a speech recording yourself for voice cloning ("My voice") | Voice assistant (audio streamed to Google Vertex AI; recordings are not stored); voice clone in Media AI (the sample is passed to ElevenLabs — own voice only, subject to a recorded statement of the recorded person; deleted together with the voice) |
| Music files | YES — only when using Media AI | A music file added as input material (e.g. a soundtrack for a video montage) |
| Other audio files | YES — only when using Media AI | Voice-over recordings and other audio files added as input material (passed to the provider of the selected model — Google Vertex AI or fal.ai) |
4.7. Files and docs — Files and documents
| Data type | Collected? | Purpose |
|---|---|---|
| Files and docs (PDF, DOCX, XLSX, DXF) | YES — when you attach files to tasks/projects | Attaching project documentation, DXF parsing (CAD) |
4.8. Calendar — Calendar
| Data type | Collected? | Purpose |
|---|---|---|
| Calendar events | YES — ONLY when the Google Calendar integration is enabled | Two-way synchronisation of task due dates |
4.9. Contacts — Contacts
We do NOT collect contacts from the device.
4.10. App activity — App activity
| Data type | Collected? | Purpose |
|---|---|---|
| App interactions (taps, in-app navigation) | YES — anonymous, aggregated | Diagnostics, improving UX |
| In-app search history | NO — queries are not persisted | — |
| Installed apps | NO | — |
| Other user-generated content (notes, comments, documents) | YES | Project content, documentation |
| Other actions (sign-in, editing, export) | YES | Security audit, accountability |
4.11. Web browsing — Web browsing
We do NOT collect browsing history.
4.12. App info and performance — App info and performance
| Data type | Collected? | Purpose |
|---|---|---|
| Crash logs | YES (HUBAL's own reporter, Google Cloud europe-central2) | Error diagnostics |
| Diagnostics (start-up time, network errors) | YES | Performance optimisation |
| Other app performance data | YES — technical metrics | Quality monitoring |
4.13. Device or other IDs — Device identifiers
| Data type | Collected? | Purpose |
|---|---|---|
| Device or other IDs (Android ID, FCM token, Firebase Installation ID) | YES | Push notifications, installation identification |
| Advertising ID | NO — we never use it | — |
4.14. Location — Location
We do NOT collect either precise or approximate location.
5. Security practices
5.1. Encryption in transit
YES — all communication over HTTPS / TLS 1.3.
5.2. Encryption at rest
YES — AES-256 in two layers: (1) the database and file storage are encrypted at the Google Cloud infrastructure level (keys managed by Google); (2) in addition, sensitive data is encrypted at the application layer (AES-256-GCM) with an organisation key, protected by the HUBAL master key in Google Cloud KMS — e-mail content and its AI summaries, project names, notes, financial profile, invoice data, document fragments used by AI, and integration credentials.
5.3. Is data deleted upon request?
YES — the user may request deletion via Settings → Privacy → Your data → Delete my data and account or by e-mail to support@hubal-project.com. Completion: within 30 days from production, within 90 days from backups.
5.4. Can the user request deletion of specific data (not the entire account)?
YES — in the application you can delete specific projects, tasks, documents, messages; in addition, the right under Article 17 GDPR via privacy@hubal-project.com.
5.5. Families Policy compliance
The application is not directed at children. Minimum age 16 years. We do not apply for 'designed for families' status.
5.6. Independent validation
NO — we currently do not hold an independent audit (e.g. ISO 27001, SOC 2). Planned for evaluation in the future.
6. Update procedure
This form is updated whenever the application's functionality or the list of processors changes, in parallel with the Play Console update (in accordance with Google's policy).
7. Contact
For matters concerning privacy in the mobile application: privacy@hubal-project.com