Delimeter.app Privacy policy
1. Controller and contact
The controller of data connected with the DeliMeter app is Milena Miałkowska Media, Nadziei 18c/18, 05-500 Julianów, Poland, Polish tax ID (NIP) 9512284175. For privacy and account deletion requests, contact [email protected].
This policy covers the DeliMeter Android app, sign-in, access checks and purchase data received from Easycart. Easycart's checkout and customer portal operate outside the app; information you enter there is also subject to EasyTools' policies.
2. Screen, OCR, Accessibility and local data
When you start screen capture, Android may let you choose one app window or the entire screen. DeliMeter analyses the shared image on your phone with OCR to identify an offer's amount, distance, time, delivery count and pickup point name. A courier app window may show recipients' data, while sharing the entire screen may also expose Maps, messengers or other apps. Such content may be read briefly during analysis. The app does not store full images or raw OCR text in the diary or Sherlock, or send them to Supabase or Firebase. It saves the needed fields of a recognised, accepted offer and releases the working image after analysis.
The separately enabled Accessibility service observes events in supported courier apps to recognise acceptance or rejection of an offer. It may read visible text and element descriptions, place names and addresses, amounts, distance, time, button positions, taps and window changes. It may read technical metadata from other windows, such as the app name and layout. This is processed on the phone; content of other windows is not sent to Supabase or Firebase.
Completed and active deliveries, work dates and times, amounts, tips, costs, deductions, expenses and notes, and calculation settings remain on the phone. Diary data are separated locally between accounts on that device and are not synchronised to Supabase or Firebase. New rejected offers are not stored; older in-app records are removed when the updated version starts. Older manual backup files may still contain them.
During OCR, Google's ML Kit library may send Google technical data and usage metrics, such as device and app information, installation identifiers and performance data. Google states that the image and OCR result are processed on the device and are not sent to Google's servers by ML Kit. Google's ML Kit information.
3. Account, sign-in and devices in Supabase
At sign-in, the app sends Supabase the email address you enter, a random installation ID, a hashed device identifier derived from Android ID and a device label (manufacturer and model). To verify sign-in, Supabase Auth sends a one-time code to your email through Brevo. Brevo receives the recipient address, the message containing the code and technical delivery data. It does not receive delivery history, expenses or screen images from the app. Existing sessions may remain valid until sign-out or revocation.
Supabase stores account and session data, the link to an Easycart customer, access type and status, expiry dates, order or subscription references, sales events and a device register: identifier hash, installation ID, label, registration date and check dates. These data support sign-in, the two-device limit, entitlement checks and prevention of repeat trials on a recognised device. The app receives an access decision and expiry date. It does not send delivery history, expenses, screen images or Sherlock to Supabase.
Session tokens are stored in an encrypted app file. Signing out removes the local session; freeing a device slot and revoking the remote session require a connection. Access expiry does not erase local data. You can request account deletion through “Delete account” in Profile, on the sign-in screen below the privacy policy link, on the account deletion page, or by emailing the address in section 1. After verifying your identity, we will erase data with no continuing basis for retention and tell you the outcome. Requests are handled manually; signing out or losing access does not itself delete the account.
4. Purchases through Easycart / EasyTools
Purchases, trials, subscriptions and the customer portal run on external Easycart pages. There you provide your email address and billing details required for the order. Payment data are handled by Easycart's payment provider; the DeliMeter app does not collect card numbers. Easycart sends our backend signed events about the customer, product, order, subscription, trial, payment and status changes. Supabase records the data needed to link the purchase to an account and manage access.
You delete your EasyTools customer account separately under its customer terms. Deleting it may cancel active Easycart subscriptions, but it does not automatically remove your DeliMeter account from Supabase. EasyTools describes its checkout and portal processing in its privacy policy.
5. Backups and export
In the app version covered by this policy, automatic Android backup of DeliMeter data and system transfer of that data to another device are disabled. Backups made by an older version may have reached a service linked to your Google account or another phone and may still exist there. Manage them in your device or account settings; updating the app does not delete them from the provider. Android Auto Backup information.
You may manually export and later import a DeliMeter file. A new export includes selected diary data, expenses, active deliveries and settings; it excludes session tokens, the installation ID and rejected offers. The file is readable JSON, without encryption by the app. The place or service you choose for saving or sharing it may keep a copy under its own rules. Import replaces the relevant local data. Earlier manual files remain under your control.
6. Safe diagnostics and bug reports
Sherlock runs only after you turn on “Safe diagnostics” in Profile. A session lasts up to 30 minutes and can be ended earlier. In phone memory it keeps timestamps and a limited number of fixed technical event names, such as scan started, OCR completed or offer recognised. It does not retain screen images, raw OCR, Accessibility text, addresses or customer data. Older local Sherlock files are removed when the new version starts. Nothing is sent automatically.
The “Report a bug” form prepares an email with the selected issue area, an optional courier app name, your description and the DeliMeter version. You may choose to attach a Sherlock file from the current session and a photo or video. The Sherlock file contains technical events or a notice that the session is off; a photo or video you select may contain third-party data. Review the message and attachments before sending. Bug reports go to [email protected]; individual help opens an email to [email protected]. Your email app and the mailbox providers process the sent message under their own terms.
7. Purposes, legal bases and automated access decisions
We process account, purchase and local diary data, and technical data needed to retrieve messages, to provide the DeliMeter service (Article 6(1)(b) GDPR). We retain data required by accounting law to meet a legal obligation (point (c)). We process device and trial data, bug correspondence and necessary, brief reading of visible third-party content to protect access, prevent abuse, handle reports and operate offer analysis on the basis of our legitimate interests (point (f)). We process optional push and related technical data with your consent (point (a)), which you can withdraw in Profile. You start screen capture and Accessibility separately through Android permissions.
Your email and details required for a purchase are needed to obtain access; device and installation identifiers support the device limit. Bug reports and their attachments are optional. Access decisions are calculated automatically from purchase status, access expiry, trial history and the device limit. Contact us if you believe a decision is wrong.
8. Recipients, transfers and retention
Recipients may include Supabase (account and access), Brevo (email codes), Easycart/EasyTools and its payment provider (purchases), Google (ML Kit, Firebase Cloud Messaging and Cloud Firestore), and email or export storage providers you choose. Authorised DeliMeter personnel may access relevant data. The main Supabase database is in the eu-central-1 region (Frankfurt), and Brevo says its databases are hosted in the EU; functions, logs and subprocessors may process data outside the EEA. The providers describe relevant transfer safeguards, including Standard Contractual Clauses, in information from Supabase, Google, Brevo and EasyTools. Ask us at the address in section 1 for details.
Local data remain on the phone until you delete them, clear app storage, uninstall the app or replace them by import. Safe diagnostics end after at most 30 minutes; events in memory are cleared when the session is turned off or its expiry is next checked. A file you export remains wherever you choose to save it. Older Android backups or manual files may exist separately.
We keep Supabase account, device, trial and purchase data while maintaining the account and offering access, including after a paid period ends, so you can return and we can enforce the device limit and one-time trial. If we stop offering the option assigned to an inactive account, discontinue the DeliMeter business or receive a deletion request, we manually erase data with no continuing legal basis. We delete bug reports and attachments when we finish handling them, including after resolving the bug. We keep tax records until the relevant tax liability becomes time-barred; the general period is five years from the end of the year in which the tax payment was due, unless the period is suspended or interrupted.
Brevo may retain technical delivery logs for codes under its service retention settings; these serve delivery and troubleshooting. Data in provider logs and backups may remain until removed in those services' cycles. The FCM token supports notifications while they are enabled. When push is turned off, you sign out or the app detects loss of access, it unsubscribes the installation from topics and asks Firebase to delete the token. The Firebase identifier and Google's technical data may follow separate retention cycles.
9. Your rights and deleting data
Subject to the GDPR, you may request access, correction, erasure, restriction and portability of your data, and object to processing based on legitimate interests. You may withdraw push consent without affecting earlier processing. You may complain to the Polish President of the Personal Data Protection Office (UODO). Contact us at the address in section 1 about Supabase account data and reports. You can view, export and delete selected local data in the app; clear app storage in Android settings or uninstall the app to remove all data held by the app on the phone. Deleting your DeliMeter account does not erase phone data, older backups or your separate EasyTools account. The availability of a right depends on the purpose and legal basis of processing.
10. Notifications, inbox and changes
The app may show a local notification for its screen-capture service. After you enable push in the app and grant the Android permission, Firebase Cloud Messaging (FCM) delivers general DeliMeter messages and update information. You can turn off push in Profile; this does not disable the local screen-capture notification.
The inbox retrieves public PL/EN messages and a new version number from Firebase Cloud Firestore. It keeps message copies and read status on your phone; it does not send read status to Firestore. The app does not send Firebase your email address, account data, offers, OCR, delivery history, expenses or courier settings.
FCM processes a Firebase installation ID (FID), notification token, app version and language/version topics. When Firestore is read, Google may receive your IP address and technical client data such as OS version, device model and brand, installation source and library versions. Firebase Analytics has not been added. Google's Firebase data documentation. We will update this policy if DeliMeter's operation changes materially.