ActionPoints mobile application
Last updated / Effective date: 31 May 2026
The App is provided by JDG Ilya Kavalenka, a sole proprietorship (jednoosobowa działalność gospodarcza) registered in Poland (the “Developer”, “we”, “us”, “our”). For the purposes of the GDPR, the Developer is the data controller of the personal data described in this policy.
You can contact us about privacy at any time:
We have not appointed a Data Protection Officer (DPO), as we are not legally required to do so. Privacy enquiries are handled directly via the email above.
This policy applies to the ActionPoints App on iOS and Android and to the back-end services that support it. It does not apply to third-party products or services that have their own privacy policies (for example Apple, Google, and Amazon Web Services), even where you reach them through the App. See section 16.
| Category | Examples | Source |
|---|---|---|
| Account & identity | Email address; a unique account ID; name and identifier supplied by Apple or Google if you use those sign-in options | You / your sign-in provider |
| Content you create | Titles of your tasks (“Actions”); the free-text goal descriptions you type or dictate; schedules you set | You |
| AI inputs & outputs | Goal prompts and Action titles you submit to AI features, and the suggestions the AI returns | You / AI service |
| Progress & gameplay data | Experience points, levels, streaks, skill points, virtual currency (“Silver”), collectible items (“Jokers”), completion logs and timestamps | Generated by your use of the App |
| Subscription & purchase data | Store platform, product ID, transaction identifiers, purchase/expiry dates, environment, the store purchase receipt/token, and your premium status | Apple / Google / you |
| Device & technical data | App language/locale and time-zone-related local date; IP address (received automatically by our servers) | Your device |
| Diagnostics | Crash reports, error logs, performance traces and related device/OS metadata, plus your account ID, sent to our error-monitoring provider | Your device |
To create and secure your account we use Amazon Cognito. Depending on how you sign in, we process: your email address, a unique account identifier, and — if you choose “Sign in with Apple” or “Sign in with Google” — the identifier and basic profile information (such as name and email) shared by that provider. Your password (for email sign-up) is managed by Amazon Cognito and is never visible to us. We use this data to authenticate you, keep your account secure, and send essential service messages (such as email verification or password reset).
The App lets you create tasks (“Actions”) and goals. We store the text you enter, including Action titles, the free-text goal descriptions you type or dictate, and any schedules you set. This content is stored so the App can function and sync across your sessions. Your content is private to your account — the App has no social, sharing, public-posting, friend, leaderboard or multiplayer features, and your content is not shown to other users.
When you use an AI feature, the relevant text you provide (your goal prompt, or an Action title) and an optional language hint are sent to an AI service to generate suggestions. Both your input and the generated output may be stored in your account. See section 6 for full detail.
As you use the App we generate and store gameplay data tied to your account: experience points and levels, streaks, skill points across categories (Health, Mind, Family, Social, Career, Finance, Creativity), virtual currency (“Silver”), collectible perks (“Jokers”), reward outcomes, and logs of completed Actions with timestamps. This is needed to provide the App’s core gamified experience.
If you buy a subscription (“ActionPoints Premium”), purchases are processed by the Apple App Store or Google Play. We do not receive or store your full payment-card details. To activate and validate your subscription we store: the store platform, product ID, transaction identifiers, purchase and expiry dates, the purchase environment, the store-issued purchase receipt/token, and your resulting premium status. We use this to grant premium access, validate purchases, prevent fraud, handle renewals/refunds, and meet our accounting and tax obligations.
We process your App language/locale and a local date string used for time-zone-correct features (such as daily streaks). When your device connects to our servers and third-party services, those servers automatically receive your IP address and standard connection metadata. To keep the App stable we use the Sentry error-monitoring service, which collects crash reports, error logs, performance traces and device/operating-system metadata, and is associated with your account identifier. Diagnostics are disabled in development builds.
To be clear, we do not:
The App offers optional AI features — breaking a free-text goal into suggested Actions, and automatically suggesting skills for an Action. These run on Amazon Bedrock (an Amazon Web Services product) using a third-party large-language model (an Anthropic “Claude” model) hosted within AWS. AI requests are processed server-side; your device does not talk to the AI provider directly.
You can optionally dictate Action titles and goal descriptions. When you start dictation, the App requests microphone (and, on iOS, speech-recognition) permission and your speech is converted to text by your device’s operating system. On iOS the App prefers on-device recognition where available and may fall back to Apple’s speech service; on Android, recognition is performed by the speech service installed on your device (typically Google’s). In those cases your audio is processed by Apple or Google under their own privacy policies. We do not receive your audio — only the resulting text, which is then saved as your content. You can use the App fully by typing instead.
We rely on the following legal bases under Article 6(1) GDPR:
We do not sell your personal data. We share it only with the service providers below, who process it on our behalf or as independent controllers in order to operate the App. Each has its own privacy commitments.
| Recipient | Purpose | Data involved | Location |
|---|---|---|---|
| Amazon Web Services (AWS) — Cognito, AppSync/DynamoDB, Lambda | Authentication, secure storage and processing of your account, content, gameplay and purchase data | All categories above except audio | USA (Oregon) |
| Amazon Web Services (AWS) — Amazon Bedrock (Anthropic Claude model) | Generating AI suggestions you request | Goal prompts / Action titles + language hint | USA |
| Sentry (Functional Software, Inc.) | Crash and error monitoring to keep the App stable | Error/crash reports, performance traces, device/OS metadata, account ID, IP | USA |
| Apple | Sign in with Apple, App Store subscriptions & billing, device speech recognition | Identity, purchase and (for dictation) voice data | Per Apple |
| Google sign-in, Google Play billing, Android speech recognition | Identity, purchase and (for dictation) voice data | Per Google |
We may also disclose personal data where strictly necessary to:
Our infrastructure and sub-processors are located in the United States. This means that when you use the App, your personal data is transferred from Poland/the European Economic Area (EEA) to the United States. Where personal data is transferred outside the EEA, it is protected by appropriate safeguards under the GDPR — primarily the European Commission’s Standard Contractual Clauses and/or the provider’s certification under the EU–U.S. Data Privacy Framework, together with supplementary technical and organisational measures. You may request more information about these safeguards using the contact details in section 18.
We keep your personal data only for as long as needed for the purposes described in this policy:
Under the GDPR you have the right to:
How to exercise your rights:
Exercising your rights is free of charge. We may ask you to verify your identity before acting on a request, to protect your data. Where a sub-processor independently holds data, we will pass on deletion/access requests as required.
We take reasonable technical and organisational measures to protect your personal data, including: encryption of data in transit (HTTPS/TLS) and encryption of stored data at rest; per-user authorisation rules so that each account can access only its own data, enforced on the server; disabled anonymous/guest access; server-side validation of purchases; and restricted, least-privilege access to back-end systems. No method of transmission or storage is completely secure, so while we strive to protect your data we cannot guarantee absolute security.
The App is not directed to children. You must be at least 16 years old to create an account and use the App. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data, please contact us and we will delete it.
We do not ask for special categories of personal data (such as data about health, religion or political views). However, the goal and Action fields are free text and you may choose to write personal or sensitive information in them (for example a fitness, health, financial or wellbeing goal). If you do, you provide that information on your own initiative and consent to its processing as described here. Please do not enter other people’s personal data, or any sensitive data you are not comfortable storing, into free-text or AI fields.
The App relies on and may link to services operated by third parties, including Apple, Google and Amazon Web Services. Your use of those services is governed by their own terms and privacy policies, over which we have no control:
We are not responsible for the privacy practices or content of these third parties.
We may update this Privacy Policy from time to time to reflect changes to the App, our practices, or legal requirements. When we make material changes we will update the “Last updated” date above and, where appropriate, notify you in the App. Your continued use of the App after an update takes effect means you acknowledge the revised policy.
If you have any questions, requests or concerns about this policy or your personal data, contact us at [email protected].
If you are in Poland or the EEA and believe your data has been handled unlawfully, you have the right to lodge a complaint with a data-protection supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, “UODO”), https://uodo.gov.pl. We would, however, appreciate the chance to address your concerns directly first.