Privacy policy

Effective 23 October 2026. Wersja polska

This policy explains what data we process when you use oslonyrtg.eu and the Oslony RTG apps (browser, iOS, Android), and why. The app is a professional (B2B) tool and is not intended for children.

1. Data controller

For personal-data matters write to kontakt@oslonyrtg.eu.

2. What we process

• Account and licence — the e-mail address of the person using the account; the licensee's company name, licence number and key, expiry date and seat limit.
• Sign-in codes — you sign in with your e-mail address and a one-time six-digit code we send you. The server stores only a hash of the code (never the code itself), its 10-minute validity, the number of attempts and the IP address it was requested from.
• Device data when you sign in and when the licence is refreshed — a random installation ID (not a serial number and not an advertising ID), device and system type (e.g. manufacturer, model, Android version or browser), app version, IP address, first and last use.
• Cloud projects — calculation inputs (tube or isotope, parameters, room outline, walls), the project name and report data, but only when you save a project to the cloud yourself. Saving is explicit; nothing is synchronised in the background. Please do not put third parties' personal data in projects — the calculator does not need it.
• Deadlines and reminders — names and dates of duties you add in the app (e.g. medical checks, dosimeter calibration). We use them to send a reminder to your account e-mail. Do not enter third parties' personal data in the names.
• Calculations in the browser — parameters are sent to the server to perform the calculation and are not stored. To prevent abuse we only count how many different tubes and calculations a licence used per day and from which IP addresses; these counters are deleted after 30 days.
• Licence event log — activations, sign-ins, seat release, account deletion (with the e-mail address), blocks and security alerts. It is used to settle licences and to detect abuse.
• Technical data — server logs (IP address, time, requested address) needed to run and secure the service.
• “Try it free” form — the company name, e-mail address and optional description you enter yourself. We use them to reply to your request and to issue a trial licence; they go to the kontakt@oslonyrtg.eu mailbox. If you tick the additional, optional consent to reminders about the offer, we keep the address and company name for 12 months and may send you occasional reminders; you can withdraw consent at any time (reply to a message or write to kontakt@oslonyrtg.eu) and we will delete the address. Without that consent the address does not enter our contact database. A trial licence (account, projects, history) is deleted automatically the day after it expires, usually after 14 days. We issue the trial licence automatically and send the key to the address you gave; to prevent abuse (repeated trials from the same address) we keep, for 12 months, only an irreversible hash of the address, not the address itself.

What we do not collect: there are no ads, no analytics and no third-party tracking libraries; we do not read location, contacts, photos or files. On iPhone the app uses the camera and LiDAR sensor only to measure a room — the room outline is built on the device and the image itself is neither stored nor sent. The Apple Watch app, while you use it, reads location and step count on the watch only, to show your distance from the marked tube — this data never leaves the watch and is not sent to the server. The Android app needs only internet access.

3. What stays on your device

Your last inputs, language and country, the licence token and a copy of the calculation data downloaded from the server. The copy is encrypted with a key held in the system vault (Keychain on iOS, Keystore on Android) that never leaves the device, and it is removed when you sign out or the licence expires. App backups are disabled on Android. On iPhone, your settings and last inputs may be part of the system backup (iCloud or computer), which we do not control; the calculation-data copy is encrypted with a key that never leaves the device, so it cannot be read after a restore on another device.

4. Purposes and legal bases

• performing the licence agreement — sign-in, checking the licence and seat limit, saving projects, support (Art. 6(1)(b) GDPR);
• keeping the service secure and preventing abuse (legitimate interest, Art. 6(1)(f) GDPR);
• accounting and tax obligations (legal obligation, Art. 6(1)(c) GDPR).

5. Cookies and browser storage

The site uses no advertising or analytics cookies and no tracking tools. Browser local storage keeps only your settings and sign-in session. Page fonts are loaded from Google Fonts. The admin panel uses one technical session cookie. The server counts page views in aggregate only (day, page address, entry source such as a link tag or the referring site); it stores no IP address or any data that could identify a visitor.

6. Recipients

• Render Services, Inc. — application and database hosting, Frankfurt (EU) region;
• Cloudflare, Inc. — proxies traffic to the service (security and acceleration), so it sees IP addresses and request content in transit;
• home.pl S.A. — domain and the mailbox we use to send sign-in codes and quotes;
• app stores (Apple App Store, Google Play) process download data under their own terms.

Providers act as processors. Where data leaves the European Economic Area, this is done under GDPR mechanisms (e.g. standard contractual clauses). Data is never sold or shared for marketing.

7. Retention

• licence, account and device data — for the licence term and 12 months after it expires (longer only where tax law requires);
• cloud projects — until you delete them, delete your account, or the licence data is no longer kept;
• deadlines and reminders — until you delete them, delete your account, or the licence data is no longer kept;
• sign-in codes — valid for 10 minutes; used and expired codes are deleted;
• abuse-prevention counters — 30 days; technical server logs — at most 30 days;
• database backups are encrypted and may for some time still contain the data of a deleted account; they are used for nothing else.

8. Deleting your account and data

In the app: open the account screen and choose “Delete account”. This removes your account, your cloud projects, unused sign-in codes and this device's entry. Without the app: write from the account's e-mail address to kontakt@oslonyrtg.eu or use the Delete account page. We reply within 30 days.

What we do not delete: the licence itself — it was bought by a company, not by the user, so releasing an account does not void what was paid for. The event log keeps an entry about the account deletion (with the e-mail address) as the basis for settling the licence, under the periods in section 7.

9. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection. You may also lodge a complaint with the President of the Personal Data Protection Office in Poland (UODO, ul. Stawki 2, 00-193 Warsaw). Providing data is voluntary, but without an account tied to a licence the app cannot be used.

10. Changes

We will announce material changes to this policy on this page.