Deynoa Privacy Policy
Version dated 16 October 2026.
1. Personal data controller
The operator of the Deynoa application and the personal data controller is Ivan Malakhov, a self-employed entrepreneur (OSVČ), business identification number (IČO) 22511741, with a registered address at Estonská 2568, 272 01 Kladno, Česká republika (the "Operator").
For questions about the processing of personal data, deletion requests and support, contact: deynoa.support@gmail.com.
2. Categories of data, purposes and legal bases for processing
Deynoa is an application with short learning materials about sales, money, purchases and rest. The Operator processes the following data of its users (the "User"):
| Data | Purpose of processing | Legal basis (GDPR) |
|---|---|---|
| Name, email address, account identifier, authentication data | Creating an account, signing in, restoring access | Performance of a contract, Art. 6(1)(b) |
| Language settings, selected tracks and topics, completed lessons, activity dates, day streak | Saving settings and learning progress | Performance of a contract, Art. 6(1)(b) |
| The User's written notes | Storing and displaying notes | Performance of a contract, Art. 6(1)(b) |
| Support correspondence | Responding to enquiries | Performance of a contract, Art. 6(1)(b); other enquiries - legitimate interest, Art. 6(1)(f) |
| Information from personal data requests | Handling requests, fulfilling the Operator's obligations | Legal obligation, Art. 6(1)(c) |
| IP address and technical request logs | Delivering the application, protecting against abuse, diagnostics | Legitimate interest in security and reliability, Art. 6(1)(f) |
| Application usage events (section 3) | Improving the application | Consent, Art. 6(1)(a) |
An email address and authentication data are required to create an account. Written notes and analytics are optional. The User should not enter passwords, payment details or sensitive information about themselves or third parties into free-text fields.
Authentication is handled through Supabase Auth. The password is not sent to analytics systems.
3. Optional analytics
With the User's consent, the Operator uses the PostHog service to assess how useful the application's features are. PostHog is not started before consent is given.
The following may be sent to analytics: information about visits, registration and sign-in; the start and completion of lessons, topics and tracks; the fact that a note was saved; the internal account identifier, lesson and topic identifiers and language settings; technical information about the browser and device; the time of the event; and the page address without parameters and fragment.
Name, email address, password and the content of notes are not included in analytics events. Session recording, click maps and automatic event capture are disabled. The IP address reaches PostHog as part of the network connection, but the Operator does not store it as an event property.
Consent may be given or withdrawn at any time under "Analytics settings" in the profile, as well as on the sign-in, registration and access recovery screens; an account is not required for this. Refusing does not restrict access to learning. The choice is stored in the browser for 180 days, after which consent is requested again.
After consent is withdrawn, data collection stops and analytics identifiers are deleted from browser storage. Previously sent events are not deleted automatically upon withdrawal. Withdrawal does not affect the lawfulness of processing carried out before it. Deletion of previously collected data can be requested at the address given in section 1.
4. Data stored in the browser
The application uses the browser's local storage, which may hold: the authentication session, interface language, a draft of a written note, markers of notes already shown, the User's analytics choice and, where consent has been given, PostHog identifiers.
Some of this data is cleared by the application itself: the authentication session is removed when the User signs out; PostHog identifiers are removed when consent is withdrawn (or, where consent has expired, when the application processes the expiry); an empty note draft is removed. The remaining data - interface language, non-empty drafts, markers of notes already shown and the record of the analytics choice - stays on the device until it is deleted through the browser settings. Deleting the account on the server does not clear local storage in the browsers where the application was used.
5. Recipients of data and international transfers
To operate Deynoa, the Operator uses the following service providers:
- Supabase Pte. Ltd. - authentication, database, registration and access recovery emails;
- Netlify, Inc. - hosting and delivery of the application;
- PostHog, Inc. - analytics (only where consent has been given);
- Google (Gmail) - correspondence with support.
The application database is hosted in a selected EU region; the European PostHog server is used. Providers and their subcontractors may process certain data outside the EEA. In such cases, the EU standard contractual clauses and/or the EU-US Data Privacy Framework apply. The providers' data processing terms:
- Supabase: https://supabase.com/legal/customer-resources/data-processing-addendum
- Netlify: https://www.netlify.com/pdf/netlify-dpa.pdf
- PostHog: https://posthog.com/dpa
- Google: https://policies.google.com/privacy
The Operator does not sell personal data. Data may be disclosed to competent authorities where required by law.
6. Retention periods
- Account data, progress and notes are kept for as long as the account exists. After the account is closed or a justified deletion request is granted, they are deleted, except for information that must be retained by law or to defend legal claims.
- Support correspondence is kept for no longer than 12 months after the enquiry is closed.
- Analytics data is kept in PostHog for as long as it is needed for analytics purposes, or until a deletion request is received. Withdrawing consent stops further collection but does not in itself delete events already sent.
- Technical logs are kept by the infrastructure providers for as long as necessary for security and diagnostics.
- Backups are kept by the providers in line with their recovery cycles; deleted data may remain in previously created backups until the relevant cycle ends.
7. The User's rights
To delete an account, send a request to deynoa.support@gmail.com, preferably from the email address registered to the account. The Operator may request verification of account ownership. Deletion is carried out manually and covers data in Supabase and, where necessary, in the analytics system.
Under the GDPR, the User may request access to their data, rectification, erasure, restriction of processing and portability, object to processing based on legitimate interest, and withdraw consent.
The Operator responds to requests without undue delay, as a rule within one month. If the period needs to be extended because of complexity or the number of requests, the Operator will inform the User and give the reason within the first month.
The User may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, https://uoou.gov.cz/) or another competent supervisory authority.
The Operator does not make decisions producing legal or similarly significant effects for the User based solely on automated processing.
8. Age restrictions
Deynoa is intended for people aged 16 or older. Age confirmation is requested at registration; date of birth and documents are not requested. If you know that a person under 16 is using an account, please inform us at deynoa.support@gmail.com and the Operator will take the necessary measures.
9. Changes to this policy
The version date is shown at the beginning of the document. The Operator will notify Users of material changes in data processing by appropriate means, and will request consent separately for any new purposes that require it.