Privacy Policy

Last updated: 24 August 2026

This is the source of the policy served at /privacy. Edit it here; the page renders the same text.

Status: this describes the application as built and its private household beta deployment. It is not offered as a public commercial service.

Who is responsible

Renato Curic, Omladinska ulica 10, 10437 Bestovje, Croatia, operates Warranty App and is the controller of the personal data described here. For questions or to exercise any of the rights below, contact renato.curic@gmail.com.

What the app is for

Warranty App stores your purchase records and the documents that prove them — receipts, invoices, warranty cards, manuals — so you can find them later and see whether a warranty is still valid. That is the only purpose the data is used for.

What is collected

Your identity

Handled by Keycloak, the identity provider. It holds your email address, your name, and a password hash. The application itself keeps a local copy of your email, display name, and the identity provider's user id, so records can be attached to you without asking the provider on every request.

What you enter

Product name, brand, category, store or seller, purchase date, price and currency, warranty dates and durations, serial number, and free-text notes.

The documents you upload

Photographs of receipts, scans, and PDFs. Originals are stored exactly as you uploaded them, because an altered receipt is worth less as proof.

For images the app also generates a display-sized copy and a thumbnail. EXIF metadata is removed from those generated copies, including the GPS coordinates and device identifiers that phone cameras embed. The original keeps its metadata, since it is the evidential copy — if that matters to you, strip it before uploading.

Records of activity

An activity log records that a document was uploaded, downloaded or deleted, that a purchase was created, changed or deleted, that an export was taken, and that an invitation was created or accepted. Each entry stores the time, who did it, and the IP address and browser user-agent of the request. This exists so you can see what happened to your own documents.

Technical data

Your session is a random opaque value in a cookie; the server stores only its hash. Server logs and operational metrics are kept for running the service. They are designed to contain no personal data — no email addresses, account identifiers, filenames, product names, serial numbers, storage keys, request bodies or document contents. This is enforced in code and covered by tests.

What is not collected

No advertising identifiers. No cross-site tracking. No session recording or screen capture. No analytics on the contents of your documents. Product usage is counted only in aggregate — "an upload succeeded" — with no identifier attached.

Legal basis

Warranty App is currently run as a private household beta. Processing that is needed to create an account, store and retrieve your records, share a household, and provide an export or deletion is carried out to provide the service you ask to use. Where the GDPR applies, this is Article 6(1)(b) (performance of a contract). Processing activity logs and security data is necessary to protect the service, documents and other household members from misuse; where the GDPR applies, this is Article 6(1)(f) (legitimate interests).

Who else can see your data

Members of your household. Sharing is per household, not per document: every active member of a household can see, edit and delete every purchase and every document in it, and can download the originals. There is no per-document sharing. Adding someone gives them access to everything in that household, and removing them revokes it immediately.

Nobody else by default. No third-party analytics, advertising or support tool receives your data. The identity provider, database, object storage and monitoring stack all run as part of the deployment.

Service providers. The deployment uses Oracle Cloud Infrastructure (OCI) for application compute instances, encrypted block storage that holds Postgres and MinIO, backup object storage, and Email Delivery. These services run in OCI's Switzerland North region (eu-zurich-1). Email Delivery processes sender, recipient and message data to deliver invitation and account emails. Cloudflare is the domain registrar and authoritative DNS provider; it processes domain-registration contact information and DNS query data, but does not host the application or store purchase records or documents.

The self-hosted application, Keycloak, Postgres, MinIO, Prometheus, Loki and Grafana run on the OCI instances. No advertising, behavioural analytics or support provider receives account or document data.

Where it is stored

Everything is hosted in OCI's Switzerland North region (eu-zurich-1): the instances, the encrypted block volumes holding Postgres and MinIO, and the OCI Object Storage bucket used for backups. Cloudflare provides globally distributed authoritative DNS, and does not host application data.

Security

• All traffic between your browser and the service is encrypted with TLS.
• Traffic between the application and object storage is encrypted with TLS.
• In production the application refuses to start unless the database connection,
• object storage endpoint and application URL all use TLS.
• Documents are never served from a public or pre-signed link. Every download
• goes through an authorised request, checked against your household membership
• at the moment of the request.
• The object storage bucket denies anonymous access.
• Session tokens and invitation tokens are stored only as hashes, so a database
• copy does not yield working credentials.
• Uploads are validated by inspecting the file's actual bytes, and script-bearing
• formats such as SVG and HTML are refused.
• Passwords are handled entirely by the identity provider and never reach the
• application.

Encryption at rest. The application does not implement its own encryption layer for database rows or uploaded documents. Their protection at rest is provided by OCI Block Volume encryption: the volumes holding Postgres and MinIO, and their backups, are encrypted with AES-256 using Oracle-managed keys by default. OCI Object Storage encrypts backup objects with AES-256 using Oracle-managed keys by default. The operator may move to customer-managed OCI Vault keys later; this policy will be updated if that changes.

How long it is kept

Your purchases and documents are kept until you delete them or delete your account. Operational logs and metrics are kept for 30 days. The activity log is kept with the household it belongs to, for up to 365 days, after which older entries are deleted — it contains IP addresses and user agents, so it is not kept indefinitely.

Backups. The database and every document are backed up daily, encrypted at rest, and kept for 30 days. A backup is a snapshot of the service as it was, so something you delete today remains inside backups taken before the deletion until those backups age out. Backups are only ever used to restore the service after data loss, never to look anything up — but see the note under Deletion below about what that means for erasure.

Your rights

Access and portability. Account → Export your data. The ZIP contains every record as data.json plus every original file. The JSON alone is also available. Prices are exported as exact integers so nothing is lost to rounding.

Deletion. Account → Delete account. This removes:

• every document you own, from object storage, including files left behind by a
• failed upload
• every purchase, warranty and activity record in households you solely own
• your membership of any shared household — the household itself and the other
• members' data are left alone
• your sign-in account at the identity provider
• your active sessions

Activity-log entries in a household that survives are pseudonymised rather than deleted: the actor, IP address and user-agent are removed, so the remaining members keep a coherent history without your identity in it.

A record that an erasure was requested and completed is kept, with your user reference removed. Keeping proof of compliance is itself an obligation.

Deletion takes effect immediately in the live service and cannot be undone there. Export first if you want a copy.

Backups are the one exception, and it is a real one. Backups taken before you deleted something still contain it, for up to 30 days, until they age out on their own. If the service ever has to be restored from a backup predating your deletion, that data would come back — so the operator's runbook requires the erasure to be re-run after any such restore. This is the only circumstance in which deleted data can reappear, and it exists because a backup that could be selectively edited would not be a reliable backup.

Rectification. Edit any purchase directly. Your name and email are changed in the identity provider and picked up on your next sign-in.

Objection and restriction, and complaints. Contact renato.curic@gmail.com. You may also complain to your data protection authority. In Croatia, this is the Croatian Personal Data Protection Agency (AZOP); elsewhere in the EU, contact your national authority.

Children

The service is not intended for children.

Automated decisions

None. Warranty status is a date calculation you can override; nothing profiles you and nothing decides anything about you automatically.

Changes

Material changes will be reflected in the date at the top of this page. The history of this document is in the repository.