Privacy Policy
Effective from: 2026-11-10 · Version 1.3
This document describes how personal data is processed in the SavaliGear service (savaligear.com) in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Polish Act on the Provision of Electronic Services. The Polish version at /prywatnosc is the binding version; this English translation is provided for convenience.
1. Data controller
Sławomir Śnieguła, a natural person, place of residence: Żnin, Poland; correspondence address: ul. Czarnieckiego 5, 88-400 Żnin, Poland.
Data protection contact: mail@savaligear.com.
The Controller has not appointed a Data Protection Officer, as the scope of processing does not require one under GDPR Art. 37.
2. What data we process and why
| Category | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Name, username, email, password (bcrypt) | Account creation and login. Members of packs you share with others can see your name and username. Your name also appears in invitations you send. | Art. 6(1)(b): contract performance | Until Account deletion; up to 30 more days in backups |
| Date and time of your last login to your Account | Account management, handling support requests, Account security (abuse detection), identifying unused Accounts. Only the Controller can see this date. | Art. 6(1)(f): legitimate interest (security of Accounts and the Service, handling support requests, keeping the Account database in order) | Until Account deletion. We keep only the date of your most recent login; each new login replaces it. Up to 30 more days in backups. |
| Content (packs, gear, wishlist, notes and opinions, trip date and destination, contents of an imported CSV file) | Providing the planning service | Art. 6(1)(b): contract performance | Until Account deletion. A pack or gear item you delete in the app disappears from view but stays in the database until your Account is deleted. Up to 30 more days in backups. We read the CSV file itself during import and do not store it. |
| Email address of a person invited to a shared pack | Sending the invitation at the User's request and enabling the invited person to join the pack. The address is visible to the person who sent the invitation and to the pack's members. | Art. 6(1)(f): legitimate interest (enabling shared planning) | Until the invitation or access is revoked, and in any case no longer than until the inviting person's Account is deleted. The invited person can object to the use of the address or ask us to delete it at any time: mail@savaligear.com. |
| Search terms (Library, gear, trip destination) | Showing search results | Art. 6(1)(b): contract performance | Not stored in the database; may remain in web server logs (like the IP address) |
| IP address, user agent | Security, abuse detection | Art. 6(1)(f): legitimate interest | Browser login sessions: until you log out or the session expires (after 2 hours of inactivity); expired sessions are removed during automatic cleanup. Web server logs: automatically overwritten once a size limit is reached, so the retention period depends on traffic to the Service. |
| Affiliate link clicks: hashed IP address, browser information (user agent), the page the click came from, product ID, your Account number if you are signed in to savaligear.com in the browser that opens the link, and the pack number if the link includes it | Conversion statistics, partner reconciliation | Art. 6(1)(f): legitimate interest | 24 months (aggregated data kept indefinitely) |
| Public packs (pack content plus your name and username, shown on the pack page and in its URL) | Displaying the pack at its public link | Art. 6(1)(a): consent | Until consent is withdrawn |
3. Cookies
The Service uses only cookies essential for operation (session, CSRF token, language preference). No third-party marketing, advertising or analytics cookies are used (no Google Analytics, no Google Ads, no Facebook Pixel, no Hotjar, etc.).
savaligear-session: session, 2 h lifetimeXSRF-TOKEN: CSRF protection, 2 h lifetimesniegula_locale: language preference, 1 year lifetime, set on the savaligear.com domain
4. Data recipients
We transfer data to the following categories of recipients:
- Hetzner Online GmbH (Germany / EU): infrastructure and backup hosting (data processing agreement in place)
- IQGroup Adam Buhl (IQhost, Poland): the Service's email (the mail@savaligear.com mailbox and messages sent by the Service)
- Partner stores (e.g., Skalnik, 8a.pl, Fjellsport, Bergfreunde): receive only a product identifier in the UTM parameter, no User personal data
We do not sell personal data. We do not share it with data brokers.
5. International transfers
Service data and its backups are processed within the EEA (Hetzner, Germany).
6. What we do NOT do
- We do not sell personal data and do not share it with brokers.
- We do not send marketing newsletters from savaligear.com (the sniegula.com newsletter signup is a separate, voluntary action).
- We do not use third-party advertising or analytics trackers.
- We do not profile Users for advertising and do not make automated decisions with legal effects (no profiling within the meaning of GDPR Art. 22).
7. Your rights
Under GDPR you have:
- Right of access (Art. 15): you may request a copy of your data
- Right to rectification (Art. 16): edit your data directly in the app or by email
- Right to erasure ("right to be forgotten," Art. 17): you can delete your Account and all its content immediately in your account settings ("Danger zone" section); if you ask by email, we delete it within 7 business days
- Right to restriction of processing (Art. 18)
- Right to data portability (Art. 20): on request by email, we will provide your packs and gear in JSON or CSV format
- Right to object (Art. 21): to processing based on legitimate interest
- Right to withdraw consent (Art. 7): e.g., by making a public pack private
- Right to lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). EU residents may also contact their local supervisory authority.
What happens when you delete your Account. You can delete your Account in the app (account settings, "Danger zone" section) or ask us to do it by email at mail@savaligear.com. When your Account is deleted, we permanently delete from the Service database your Account data, packs (including those shared with others), gear, wishlist, categories, sharing invitations, login sessions and tokens, and affiliate link clicks associated with your Account. The following are kept longer: backups (for up to 30 days); technical logs that may still contain your username, Account number or IP address (application logs for up to 90 days, web server logs until they are automatically overwritten); an entry in our internal deletion register containing only the former Account number, how the deletion was initiated, the date and the number of deleted records (no email address, username or name). The register lets us demonstrate that the deletion took place and repeat it if a backup ever has to be restored.
We respond to requests without undue delay and within one month of receipt at the latest. In complex cases, this period may be extended by a further two months. If so, we will tell you within the first month and explain why.
8. Security
We apply the following technical and organizational measures: password hashing with bcrypt and per-user salt, transmission only over HTTPS (TLS 1.2 or 1.3, Let's Encrypt certificate), session tokens in HttpOnly cookies with SameSite=Lax, SQLite database with file permissions restricted to the application process, daily encrypted database backups (details below), security updates for dependencies.
Backups. We back up the Service database automatically once a day. Each backup is encrypted (AES-256), and the key needed to decrypt it is stored off the server. Backups are kept on the same server as the Service (Hetzner, Germany) and are automatically deleted after no more than 30 days.
9. Children's data
The Service is not directed at children under 16. Persons under 16 may use the Service only with the consent and under the supervision of a legal guardian (GDPR Art. 8). If we discover that an Account belongs to a child without guardian consent, we delete it without delay.
10. Mobile application
SavaliGear also works as an Android mobile app. It uses the same data as the web version.
The mobile app does not collect: location, contacts, calendar, microphone recordings, photos or camera images, advertising identifiers (Advertising ID).
The app stores a login token in its own storage on your device to keep you logged in. The token stays valid until you log out or delete your Account; it does not expire automatically.
The app is free of charge and does not handle payments.
11. Partner stores
When you click an affiliate link from the Library or your wishlist, you are taken to an external store. In the Android app, the link opens in your browser. The store's privacy policy applies from that point. The Controller transfers to the store only the product identifier in the UTM parameter, no User personal data.
12. Changes to this policy
Material changes are announced 14 days in advance by email and by an in-app notice. The current version is always available at savaligear.com/en/privacy (PL: /prywatnosc).
13. Contact
Privacy questions and data subject requests: mail@savaligear.com. We respond within 7 business days (GDPR requests: within one month at the latest).