How we handle your data

1. Scope and data controller

This policy applies to the I’m OK mobile app and getimok.com website.

Data controller: Michal Rehak, registration number 74573667, Prague 5, Czech Republic. Send privacy questions and requests to support@getimok.com.

The app is intended only for adults aged 18 or older. If you believe a minor has created an account, contact us; we will investigate and delete the account as appropriate.

2. What data we process

2.1 Data you provide

• Account: email, optional phone number, display name, sign-in information and account settings.
• Profile photo: an optional photo you choose from your phone or take with the camera. We upload only the photo you choose and do not browse your photo library. Before making it available to loved ones, we crop and resize it and remove image metadata, including any embedded location.
• Invitations and circles: the invited person’s email, invitation status, acceptance, permissions and access revocation. We do not read the phone’s address book.
• Check-ins: message type, time, optional note, check-in plan, expected check-in status and sharing records.
• Voice: an optional recording started by the user, storage metadata and transcription. Recording never starts on its own.
• Reports and blocking: if you report content or behaviour in the app, we store your account ID and the reported account ID, the reason, any details you provide and a private copy of the relevant profile, photo or shared check-in. Blocking stores the chosen person’s account ID and name.
• Support and exercising your rights: the content you send us and a record of our reply.

Non-binding interest form

The form processes your own email, role, combination of phones, chosen reply language and confirmation of voluntary use by adults in the Czech Republic. It does not request the other person’s details or health information. The record is used only to handle your enquiry: it is stored in Cloudflare KV for up to 90 days and sent to support through SendGrid. We delete the support mailbox copy within the same period unless we expressly agree with you to continue the case. You can ask support to delete it.

Cloudflare Turnstile checks the request against automated abuse. We do not send form answers or the verification token to marketing analytics. Aggregate counts of received and manually reviewed enquiries are separate from accounts and the other person’s consent.

In the app, you can voluntarily share a verified phone number with accepted loved ones so they can call manually. You can turn this consent off in settings; opening the phone does not mark an event as resolved.

Profile photo checks before sharing

Before sharing a profile photo, we send its cropped, resized copy without image metadata to Google Cloud Vision SafeSearch. The service detects sexual, violent and other inappropriate content; we do not include your name, email or account ID in the request. Automated checks can make mistakes. If the photo cannot be approved or screening is unavailable, we do not share the new photo. You can choose another photo, retry later or use the app without a photo. Older unscreened photos stay private until you choose and save them again. You can ask support to review a mistake.

We use synchronous screening: according to Google’s documentation, image data is processed in memory, is not persisted to disk and is not used to train Vision. Google temporarily retains some request metadata to operate the service and prevent abuse. Private photo drafts and screening records expire after 24 hours and are removed by scheduled cleanup. We retain the current approved photo’s approval marker until replacement or deletion. The aggregate monthly screening count contains no account identifiers. Google Vision data usage.

2.2 Service and device operational data

• Sign-in and device: account identifier, notification identifier, operating system, app version, device registration and anti-abuse signals.
• Notification operations: sending attempts, provider responses, failure type and daily delivery summaries.
• Usage measurement: a limited, predefined list of events associated with a stable pseudonymous account key. The data can be linked to an account, so we do not describe it as anonymous.
• Diagnostics: automatic crash and performance collection is disabled in the current version. Before enabling it, we will update this policy and the app store disclosures.
• Website: Cloudflare processes data needed to deliver and protect the website. Optional analytics is off until you explicitly accept it in Analytics settings. If the website does not offer this choice, measurement is off. Expanded measurement requires a fresh choice. We then record page type, recognised device type and manufacturer, browser, operating system, screen and viewport size in CSS pixels, language, time zone, referring domain, approved campaign codes and confirmed interest submission. Device type and manufacturer are inferred from available browser signals and may remain unknown. Language and time zone are settings, not location. Approximate country, region and city may be available only from a verified server source. We do not request phone location. Analytics events contain no IP address, full browser identification string, full URL, search-engine query, form contents or contacts. We do not link a browser session to a mobile account. The random session and its entry context expire after 30 minutes of inactivity, and the localStorage choice after 180 days. We keep expanded events, choice records and their visitor summaries for up to 90 days after receipt. Expanded events do not enter long-term statistical history. Separate form confirmations in Cloudflare KV remain for 90 days after creation, and their central copies for 180 days. Older summaries collected under the previous notice may remain in private statistical history without a fixed deletion date while needed to understand long-term development. They are not automatically anonymous. A separate pseudonymous link allows a session contribution to be removed after the original events expire. On withdrawal, we remove available session contributions and recalculate affected summaries or stop displaying them. You can withdraw consent in Analytics settings at any time. Declining does not limit the website.

Optional website measurement is processed by our separate analytics service on Hetzner infrastructure in the EU. Access to results is private. Encrypted recovery backups are stored in Cloudflare R2 in the EU for up to 30 days. A separate limited erasure journal prevents deleted data from returning through recovery. Cloudflare KV keeps separate form confirmations for up to 90 days and the session withdrawal marker for up to 180 days. These records contain no email address or form contents.

The website remembers your language choice in the imok_language cookie for one year. It contains only the language (cs-CZ or en-US), not a person’s identifier, and is not used for analytics. You can change it with the language switch or remove it in your browser.

2.3 Features that may not currently be active

• Purchases: if paid options are enabled, we will process the store product, transaction or receipt verification, entitlement status, renewal, refund, expiry and recipient account. Apple or Google processes payment details; we do not receive card numbers or bank details.
• Precise location: the technically prepared option to share location once is disabled in the current version. If separately approved later, it will require an explicit action each time, will not run in the background and will not create a movement history.

2.4 What the current service does not collect

It does not collect health and fitness app data, continuous or background location, the device’s address book, videos, browsing or search history, advertising identifiers, card details or bank account information. The only photo it collects is the optional profile photo described above.

3. Why we process data

• To operate accounts, check-in plans, individual check-ins, sharing with loved ones in the circle, reminders and alerts sent on a best-effort basis.
• To display your optional profile photo so that loved ones directly connected to you can recognise you more easily in the app.
• To transcribe optional voice messages and, where applicable, verify paid entitlements.
• To provide support, data exports, account deletion and request handling.
• For security, abuse prevention, delivery troubleshooting and service reliability.
• For limited measurement of usage outcomes and service improvement.
• To meet legal, accounting and regulatory obligations and resolve disputes.

4. Who we share data with

4.1 Loved ones in the circle

A loved one who has accepted a circle invitation can see the person’s check-in, its time and any optional message the person chooses to share. Voice transcription is shared only when voice sharing is enabled. The person checking in can remove a loved one from the circle to prevent further access. The app does not share location.

We make your profile photo available to you and people with whom you have an accepted direct connection in a circle. Sending an invitation alone does not grant access to the photo. You can replace or remove it in Settings. After a connection is removed, we will not issue that person a new link; a previously issued link may remain usable for up to five minutes from the time it was issued. The photo is not a public profile.

Reports and their private evidence are available only to the authorised operator for reviewing abuse and protecting users. We do not show the report or the reporter’s identity to the reported person. Blocking ends both directions of the connection and prevents new invitations between those accounts. Unblocking does not automatically restore sharing. Content or notifications already received may remain on the device.

4.2 Providers and platforms

• Google, Firebase and Google Cloud: sign-in, databases, computing functions, storage, notifications, app protection, transcription and limited telemetry.
• Apple: notification delivery on Apple devices, app distribution and purchases when enabled.
• Google Play: app distribution and any purchases.
• RevenueCat: purchase verification, subscription status and related events if the paid version is enabled.
• Twilio SendGrid: invitations and service emails.
• Expo/EAS: building and delivering app updates, and notification routing where enabled.
• Cloudflare: website hosting, delivery, DNS, security and connection logs.
• Tailscale and Hetzner: encrypted access and EU infrastructure for separate aggregate website measurement and its encrypted backups.

We may disclose data where required by law, to protect users or the service, or in a business transaction with appropriate safeguards. We do not sell data, use it for behavioural advertising or allow providers to use it for their own advertising.

5. How long we retain data

• Check-ins, messages, transcripts, check-in plans, missed check-in records and sharing records: up to 90 days.
• Voice recordings: up to 7 days.
• Profile photo: we retain it until you replace or remove it, or delete your account. We then stop making it available in the profile and remove stored copies through the relevant deletion process. An unfinished upload expires after 24 hours; we remove unused copies during regular cleanup. Links already issued for a photo are valid for no more than five minutes from the time they were issued.
• Reports and review evidence: retained for up to 90 days after submission and included in the deletion process for either the reporter’s or the reported person’s account. A private copy of a reported photo may remain with the report during this period after the profile photo is changed or removed. A block record lasts until unblocking or deletion of either account.
• One-off location, if approved later: display for up to 60 minutes, coordinates for up to 24 hours and access records without coordinates for up to 90 days.
• Notification attempts: up to 30 days; daily delivery summaries for up to 180 days.
• Purchase verification events: up to 90 days; current entitlement status for the lifetime of the account.
• Unaccepted invitations: 7 days, then a limited technical record for up to another 30 days.
• Profile and active relationships: for the lifetime of the account, then according to the deletion process.
• Product measurement and legacy aggregate website measurement: source data for up to 180 days, with legacy separate website backups for up to seven further days. Optional consented website measurement follows the periods above: 90 days for events, choice records and source confirmations, 180 days for central confirmation copies and daily aggregates, 730 days for working monthly aggregates and 30 days for recovery backups. The separate statistical history of closed months and its minimal erasure link follow the no-fixed-expiry criteria described above. Central records are cleaned up daily. Source confirmations in Cloudflare KV expire automatically.
• Minimal first-use registry: A separate minimal registry stores pseudonymous keys for both accounts, the date of first verified use, evidenced classification as ordinary, internal or unverified use, and whether the defined follow-up use occurred. It contains no check-in or message content. We do not estimate missing history. Disconnecting a contact alone does not delete this record, so reconnecting does not appear to be a new first use. We delete it when either original account is deleted and when an applicable rights request requires removal. To verify new history, we also keep a pseudonymous account key and its creation date confirmed by the sign-in service. We delete this supporting record when that account is deleted or an applicable statistical erasure request requires removal. Temporary evidence for reliable statistical processing is retained for up to 90 days. This is not a permanently retained check-in stream.
• Protected product statistical history: We keep private statistical summaries for fixed weeks without a fixed expiry while needed for long-term statistics. We do not automatically treat them as anonymous. Summaries that can be related to people are protected as personal data. On erasure, we correct affected summaries if complete inputs are available. Otherwise, we stop displaying them. You can ask support to erase statistical data without deleting your account.
• Cloudflare connection logs: up to 7 days; any future export must be deleted within 30 days.

6. Your rights and choices

Under applicable law, you may request access, correction, deletion, portability or restriction of processing, object to processing and withdraw consent where it is the basis for processing. Use export and deletion in the app or write to support@getimok.com. Statutory deadlines take precedence over ordinary support targets.

We respond to rights requests without undue delay, normally within one month. If a lawful extension is needed, we explain the reasons within the first month. Withdrawing consent does not affect the lawfulness of earlier processing.

You may lodge a complaint with a supervisory authority, in particular in the country of your habitual residence, workplace or the alleged infringement. In the Czech Republic, this is the Office for Personal Data Protection.

Deleting an account immediately disables access. A subsequent controlled process removes owned content and removes or anonymises relationship references. Limited operational records may remain for the periods stated, or where needed for security, fraud prevention, legal claims, accounting or other legal obligations.

Your own data export includes the reports you submitted and your blocked-people list. It excludes private evidence copies and other people’s reports. Support handles related access requests with regard to other people’s rights.

7. Legal bases

For users in the EEA, we rely on performance of a contract for basic account, check-in plan and individual check-in operation; on consent where required for that processing for optional access to the phone, camera, selected photo, notifications, microphone or potential location; on legitimate interests for minimal security, reliability and measurement; and on legal obligations where necessary. A profile photo, voice recording and potential location are not required for the basic service.

A device permission only enables access to a particular device feature. It does not itself replace a GDPR legal basis or consent to another use of your data. For example, allowing microphone access does not mean agreeing to marketing. You can change device permissions in your phone settings. You can withdraw sharing consent in the relevant app setting or through support.

8. Security and international transfers

We use access verification, app protection, encrypted transport, managed encryption at rest, separate website event storage, encrypted recovery backups, restricted permissions, defined retention periods and operational oversight. No system is completely secure. Some providers may process data outside your country; where required, we use an approved transfer mechanism and supplementary safeguards.

9. Changes to this policy

We may update this policy when the service or law changes. We will publish the new wording and date here and provide appropriate notice before a significant change.

10. Contact

Michal Rehak, registration number 74573667, Prague 5, Czech Republic
support@getimok.com · Questions and support