Privacy Policy

Effective from 2026-10-16 · FrozenBuddy (frozenbuddy.com)

Česká verze

1. Controller

The controller of your personal data is Kamagio s.r.o., Company ID: 23515309, Jaromíra Matuška 20/8, Dubina, 700 30 Ostrava, Czech Republic, e-mail: privacy@frozenbuddy.com. Contact this e-mail for any privacy question or request.

2. Data we collect and why

• Account: name, e-mail address, password (stored only as a secure hash). Purpose: running your account and signing you in. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• Google sign-in (optional): when you choose "Continue with Google", Google shares with us only your name, e-mail address and Google account ID (scopes openid, email, profile). We use them solely to create your account and sign you in. We do not access your contacts, Gmail, Drive, calendar or any other Google data, we do not post on your behalf, and we do not sell, share or transfer Google user data to anyone, nor use it for advertising or to train AI models. FrozenBuddy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Learning data: lesson progress, exercise answers, transcripts of your conversations with the characters, mistakes and corrections, statistics, and short notes the characters keep about what you told them. Purpose: making the app work, continuing conversations, feedback. Legal basis: performance of a contract.
• Voice: your recording is sent for transcription and discarded after it is transcribed. It is stored only for the progress check-in conversations (so you can hear your improvement) and for lessons only if the administrator turns it on and you are informed in your Profile. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time. We never infer emotions or identity from your voice.
• E-mails: a lesson summary with a PDF sheet and a welcome e-mail; you can switch them off in your Profile.
• Technical data: time of sign-in, device and browser type, IP address in server logs (security and abuse prevention). Legal basis: legitimate interest (Art. 6(1)(f)).
• Invitations: who invited whom (for the rewards).

3. Who can access your data

The app administrator can see your progress, answers and conversation transcripts in order to give you meaningful feedback; you agree to this when you register. We do not sell your data and do not use it for advertising.

Processors: hosting and AI run on servers managed by the operator (a rented server and the operator's own computer for AI); external AI providers only when enabled — currently: none (the AI runs on servers managed by the operator). If data is transferred outside the EU (e.g. to the USA), it is based on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. E-mails are sent through an e-mail delivery provider. Google sign-in is handled by Google under its own privacy policy.

4. Retention

Account and learning data for as long as the account exists; after deletion within 30 days (backups are overwritten within 90 days). The detailed activity log at most 2 years. Recordings until you delete them or your account.

5. Your rights

• access and a copy of your data (Profile → Account → Export),
• rectification, erasure (deleting the account, the characters' notes and recordings), restriction of processing,
• data portability and objection to processing based on legitimate interest,
• withdrawal of consent at any time,
• a complaint to the Czech data protection authority (www.uoou.cz) or your local authority.

Residents of the USA (e.g. California, CCPA/CPRA) have similar rights to know, correct and delete their data; we do not sell or share personal information for targeted advertising. We answer requests within 30 days.

6. Children

The app is intended for people aged 15 and over. We do not knowingly collect data of children under 13 (COPPA); if we learn such an account exists, we delete it.

7. Security

Connections are encrypted (HTTPS), passwords are stored only as hashes, administration is access-controlled and recordings are never publicly accessible.

8. Google user data

This section explains how FrozenBuddy handles information it receives from Google when you choose "Continue with Google". Signing in with Google is optional; you can use e-mail and password instead.

• Data accessed: only your Google account ID (sub), name, e-mail address and whether the e-mail is verified, through the OpenID Connect scopes openid, email and profile. FrozenBuddy does not request or access any other Google data — no Gmail, Contacts, Drive, Calendar, Photos, YouTube or location.
• Data usage: the Google account ID, name and e-mail are used only to create your FrozenBuddy account, to sign you in, to show your name in the app and to send you the e-mails you can switch off in your Profile (lesson summaries, welcome e-mail). They are not used for advertising, profiling, selling or training AI or machine-learning models.
• Data sharing: we do not sell, rent, share or transfer Google user data to any third party, except to the providers that host the app on our behalf, when required by law, or to protect the security of the service. Humans do not read your Google data except the administrator managing your account (name and e-mail).
• Data storage and protection: the data is stored in the app database on the operator's server, over encrypted connections (HTTPS). Access to the administration is restricted. We never store your Google password or Google access tokens; after sign-in we keep only the Google account ID to recognise you next time.
• Data retention and deletion: Google user data is kept for as long as your FrozenBuddy account exists. You can delete your account at any time in Profile → Account (all your data is deleted within 30 days) or ask us at privacy@frozenbuddy.com. You can also revoke FrozenBuddy's access to your Google account at https://myaccount.google.com/permissions; you then sign in with e-mail and password, or we delete the account on request.

FrozenBuddy's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

9. Deleting your data

Profile → Account → "Delete account" removes your account, progress, conversation transcripts, the characters' notes and your recordings. You can download a copy of your data first (Profile → Account → Export). You can also e-mail privacy@frozenbuddy.com and we delete everything within 30 days.

10. Changes to this policy

We will announce material changes in the app and by e-mail before they take effect and show the date of the current version at the top of this page.

11. Contact

Questions about privacy: privacy@frozenbuddy.com. Operator: Kamagio s.r.o., Jaromíra Matuška 20/8, Dubina, 700 30 Ostrava, Czech Republic.