Kiss & Cry

Privacy Policy of "Kiss & Cry"

Effective date: 5 October 2026

1. Data controller

The controller of personal data is:

Andrei Davidchyk
operating a sole proprietorship under the name: Andrei Davidchyk
NIP (tax ID): 5842806930
Email: andrey.davidchyk@gmail.com

Personal data are processed in accordance with Regulation (EU) 2016/679 (GDPR / RODO) and the Polish Personal Data Protection Act of 10 May 2018.
This policy covers the Kiss & Cry mobile app for Android and iOS and the website kisscry.com. Together they are called “the service” below.

2. Competition results

Most of the data in the service are figure skating competition results. They concern skaters — most of them children and teenagers — and judges, whether or not they use the app.

2.1. What we process

  • skaters: first name and surname, club, nation, the categories they competed in, placings, scores, the elements and marks of their programmes, and the competitions they are entered for
  • judges and technical officials: first name and surname, nation and role on the panel
  • rankings and statistics we calculate from the results ourselves — among them the Kiss & Cry rating, the medal table and personal bests

2.2. Where the data come from

We do not collect these data from the people they concern. They come from publicly available results, protocols, calendars and entry lists published by the Polish Figure Skating Association (PZŁF), the International Skating Union (ISU) and competition organisers.
When importing them we use an artificial intelligence service (Vertex AI by Google) to put names, clubs and category names into a consistent form. It does not decide anything about a skater; it only tidies the text of the protocols.

2.3. Purpose and legal basis

Purpose: presenting the results and the history of the sport, and calculating rankings and statistics from them.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest, and that of the users, in access to sports information which its organisers have already published.
Rankings and statistics are calculated automatically, but they have no legal effect on anyone and do not similarly significantly affect them. This is not automated decision-making within the meaning of Art. 22 GDPR.

2.4. Retention

Results are kept for as long as the service runs, because a sports archive is its purpose. The original protocols are kept so that every result can be checked against its source.

2.5. Objection, and requests from parents and guardians

You may object to the processing of your results, or of the results of a child you are the legal guardian of (Art. 21 GDPR). Write to andrey.davidchyk@gmail.com, saying who the request concerns. We consider each request individually and reply within one month.
Deleting an account in the app does not remove competition results — see section 3.4.

3. Your account

3.1. Guest and registered accounts

On first launch the app creates a guest account: an identifier linked to no name and no e-mail address. You can also register with an e-mail address and a password. The password is handled by Firebase Authentication (Google), and we never see it.

3.2. What we keep with an account

  • the account identifier and, for a registered account, the e-mail address
  • the skaters and clubs you follow, and the types of posts you have hidden
  • the account's role, e.g. a linked skater account
  • the dates the account was created and last changed

3.3. Purpose, legal basis and retention

Purpose: providing the service — signing in, the list of followed skaters and clubs, and the feed.
Legal basis: Art. 6(1)(b) GDPR — performance of the contract for the use of the app (see the Terms of Service).
Retention: until the account is deleted.

3.4. Deleting an account

You can delete the account in the app at any time, or by writing to us. What is deleted and what stays is described at kisscry.com/en/delete-account.

4. Claiming a skater profile

A skater, or the skater's parent or legal guardian, can ask for the account to be linked to the skater's page — “Claim a skater profile” in the app's “More” menu, or “Manage this profile” at the foot of the skater's page. We review each request by hand before it takes effect.
A linked account can add to the skater's page a profile picture, a gallery of up to ten pictures, its own spelling of the name, and links to Facebook, Instagram, TikTok and YouTube profiles. Every change is reviewed by us first, and once approved it is visible to all users of the service.

Legal basis: Art. 6(1)(a) GDPR — consent. Consent can be withdrawn at any time by removing the content, unlinking the account from the skater or deleting the account. Withdrawal does not affect what was lawful before it.
For a child under 13, the link and the profile may be set up only by the legal guardian or with the guardian's consent.
By adding a picture, you confirm that you have the right to publish it, including the consent of the people shown in it or of their legal guardians.
A profile can be claimed by another account — for example by a parent when somebody else has claimed their child. If we approve such a request, the profile passes to that account together with the pictures and links added to it, and the previous account is no longer linked.
Retention: until consent is withdrawn. After the account is deleted or unlinked the profile is no longer shown in the service.

5. Messages

The app lets you hold conversations with other users of the service and with us. We keep the content of the messages, their dates, and who the participants of the conversation are.
Messages are visible to the participants of the conversation. We look at a conversation we are not part of only to handle a complaint about it, or where the law requires it.
Legal basis: Art. 6(1)(b) GDPR. Retention: until the account of either participant is deleted — deleting an account deletes its conversations for both participants.

6. Push notifications

To send notifications — e.g. about a followed skater's ranking — we keep the device token issued by Firebase Cloud Messaging (Google) and the language of the app.
Legal basis: Art. 6(1)(b) GDPR. Which kinds of notifications are sent can be chosen in the app (“More” → “Notifications”), and all of them can be turned off in the phone's system settings. The token is deleted with the account, or once it stops being valid.

7. Statistics and error reports

The app uses Google Analytics for Firebase to learn how it is used, and Firebase Crashlytics to learn about errors. They collect, among other things: the screens and actions in the app, the device model, the operating system and app versions, the approximate location derived from the IP address (country, city), an identifier of the app installation, and the technical details of an error.
We have limited the collection: the advertising identifier is not collected, Google signals are off, the data are not linked to the account, and we do not use them for advertising.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in improving the app and fixing errors.
Retention: statistics for 14 months, error reports for 90 days.

8. The kisscry.com website

The hosting provider (Google, Firebase App Hosting) records technical server logs, including the IP address, for security and to keep the service running — Art. 6(1)(f) GDPR.
The website uses Google Analytics to learn how many people visit it, where they come from and what they read — only with your consent, which we ask for on your first visit. Until you give it, the Google Analytics script is not loaded and the website sets no cookies.
Once you consent, Google Analytics sets cookies (_ga and _ga_…, valid for up to 2 years) and collects, among other things: the pages visited, the address of the page you came from, the type of device and browser, and the approximate location derived from the IP address (country, city). Google signals and ad personalisation are off, and the data are not linked to an account in the app.
Legal basis: Art. 6(1)(a) GDPR — consent. You can withdraw it at any time through the "Cookie settings" link at the bottom of the page; the Google Analytics cookies are then deleted. Statistics are kept for 14 months.
We remember your answer in the browser's storage (localStorage) so as not to ask again. It does not leave your device.

9. Recipients and transfers outside the EEA

We use the services of Google Ireland Limited and Google LLC as processors: Firebase (Authentication, Firestore, Cloud Storage, Cloud Messaging, Analytics, Crashlytics, App Hosting), Google Analytics (the kisscry.com website) and Google Cloud (servers and database in Warsaw, Vertex AI). Google processes the data on our behalf and under our instructions.
Some of these services, including Vertex AI, may process data outside the European Economic Area. Such a transfer takes place on the basis of the European Commission's standard contractual clauses or the EU–US Data Privacy Framework, under which Google LLC is certified.
We do not sell personal data and do not share them for marketing purposes.

10. Your rights

You have the right to:

  • access your data and receive a copy of them
  • rectify them
  • erase them
  • restrict their processing
  • data portability — for data processed on the basis of consent or a contract
  • object to processing based on legitimate interest
  • withdraw consent at any time
  • lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa

Requests should be sent to andrey.davidchyk@gmail.com. We reply within one month. A parent or legal guardian may exercise these rights on behalf of a child.

11. Changes

We may update this policy. The current version is always published at kisscry.com/en/privacy, with the date it took effect.