Privacy Policy

This Privacy Policy describes how ParkWise (“we”, “our app”) processes the personal data of users of the ParkWise mobile app and website parkwise.pl.

1. Data controller

2. Data we collect

2.1. Data provided by the user

• Username — public, visible to other users alongside added parking and comments
• Email address — for account activation, account-related contact and password recovery
• Password — stored only as a hash (bcrypt algorithm), never in plain text
• Profile description (bio) — optional, public
• Profile picture (avatar) — optional, public

2.2. Data about added parking places

• Parking name, description, GPS coordinates — provided voluntarily by the user
• Address retrieved automatically from OpenStreetMap Nominatim based on coordinates (reverse geocoding)
• Parking photos — public, visible to everyone; any logged-in user may add them
• Comments and ratings — public, visible to everyone

2.3. Automatically collected data

• Device GPS location — used only locally on the device to centre the map and display nearby parking. We do not send your location to our servers.
• IP address — recorded in server logs (hosting), retained for up to 30 days
• Advertising ID — provided to Google AdMob for advertising

2.4. Report data (UGC moderation system)

• Report content — the reason and optional comment (max 500 characters) supplied by the user
• Reporter identifier — links the report to a user account to prevent abuse (one account = one report for the same parking)
• Report date and status — pending, reviewed or rejected

3. Purposes of processing

• Providing app services: login, map display, adding parking, photos, comments and ratings
• Account verification by confirming the email address
• Password recovery (link sent by email, valid for 1 hour)
• Protection against abuse (account blocks, content moderation, report system)
• Displaying advertising (Google AdMob) to maintain free access to the app
• Preventing registration spam (Google reCAPTCHA)

4. Legal basis

We process personal data on the basis of:

• Article 6(1)(b) GDPR — performance of a contract (providing app services)
• Article 6(1)(f) GDPR — the controller's legitimate interest (security, protection against abuse, advertising, moderation of user-generated content)
• Article 6(1)(a) GDPR — user consent (for example location or personalised advertising consent)

5. Moderation of user-generated content

ParkWise allows users to add content (parking, photos, comments, ratings). To ensure safety and quality:

• Any logged-in user may report parking or its content that breaches the Terms (for example spam, indecent content or outdated information)
• When the report threshold (5 reports) is exceeded, parking is automatically hidden from the map until reviewed by the administrator
• The administrator reviews reports and may reject a report (false alarm), restore parking visibility or permanently remove parking with its photos and comments
• Users with an active block cannot add or report content
• A user may be temporarily or permanently blocked for serious or repeated breaches of the Terms

6. External services

The app uses the following external services, which may process user data:

• Google AdMob — displaying advertising. Google Privacy Policy: policies.google.com/privacy
• Google reCAPTCHA — protecting registration against bots
• OpenStreetMap (OSM Foundation) — map data and geocoding. Policy: osmfoundation.org/wiki/Privacy_Policy
• Webh.cloud — hosting provider storing account data (MySQL database) and photos (file server)
• Webh Email (SMTP) — sending activation, password reset and notification emails

7. Data retention periods

• Active account — for the duration of app use
• Unactivated account — 24 hours after creation, after which it may be deleted
• Password reset token — 1 hour after generation, automatically deleted after use or expiry
• Deleted account — account data (login, email, hashed password, avatar, bio) is permanently deleted; ratings are deleted; parking, photos, comments and reports added by the user remain anonymous in the service (without a link to the deleted account) — see section 8
• Server logs (IP) — up to 30 days
• Content reports — retained while the reported parking exists or for up to 90 days after review, to allow analysis of abuse

8. Deleting your account and data

The user may permanently delete their account at any time in two ways:

• In the app — go to “My profile” → “Account” → “Delete account”, then confirm with your password
• On the website — go to parkwise.pl/usun-konto.html and enter your login details

After account deletion:

• Permanently deleted: login, email address, hashed password, avatar (server file), profile description (bio), parking ratings
• Anonymised (remain in the service without a link to the account): added parking, photos, comments and reports. This is because these contributions have community value and mass deletion would negatively affect other users
• The operation is irreversible — the account and data cannot be restored after deletion

If technical problems prevent self-service account deletion, the user may contact kontakt@parkwise.pl.

9. User rights (GDPR)

Every user has the right to:

• Access their data — the full account history is available in “My profile”
• Rectification — profile editing in the app
• Erasure — the “right to be forgotten”; through the app or website (see section 8), or by email
• Restriction of processing
• Data portability
• Object to processing based on legitimate interests
• Withdraw consent for location or personalised advertising (in system settings)
• Lodge a complaint with the President of UODO (Personal Data Protection Office, uodo.gov.pl)

10. Data security

• App communication with the server uses encrypted HTTPS only
• Passwords are stored as one-way bcrypt hashes
• Database access is restricted and password-protected
• Files (photos, avatars) are validated by MIME type and limited in size (max 5 MB)
• User sessions use JWT tokens with a limited lifetime (7 days)
• Password reset tokens are single-use and expire after 1 hour
• Account deletion requires password confirmation (in both app and website)

11. Minors

The app is not intended for children under 13. We do not knowingly collect children's personal data. If a parent or guardian finds that a child has provided data, please contact us to delete the account.

12. Advertising and marketing consent

The app displays Google AdMob advertising. Ads may be personalised or non-personalised depending on device operating system settings and consent given in the app. Consent for personalised ads can be withdrawn at any time in device settings (Limit Ad Tracking / Reset Advertising ID).

13. Cookies (website)

The website parkwise.pl uses only essential session files. We do not use cookies for marketing tracking on the website.

14. Changes to this Privacy Policy

We reserve the right to update this policy. We will inform users of significant changes through the app or email. The current version is always available at: parkwise.pl/polityka-prywatnosci.html

15. Contact