Privacy policy
Last updated: 2026-10-20 — draft. Final text will be reviewed and locked before commercial launch. The sections below open when tapped.
1. Who we are
REPWORK ("the Service") is operated by Thomas Furmanek, developer and researcher at Babeș-Bolyai University, Cluj-Napoca, Romania.
- Data controller: Thomas Furmanek
- Contact: thomas.furmanek@stud.ubbcluj.ro
- Affiliated research institution: Babeș-Bolyai University, Faculty of Business
- Business entity: (to be set at commercial registration)
For any privacy-related request — access, correction, deletion, consent withdrawal — use the contact above.
2. What data we collect
Account and identity: Google account email and name; account creation timestamp; consent flags (research consent, timestamp, withdrawal history).
Profile (from the pre-survey): age range, gender, country, year of study, work status.
Session and progress: per-session fear description, start/end intensity ratings, completion status, timestamps, breakthrough events; topic choices, fears added, challenge progression; pre-survey and post-check-in anxiety and satisfaction ratings; waitlist signups.
Technical and administrative: the app version your account and records were created with; and, if you arrived through a shared or campaign link, the source tag carried by that link (so we know which channel referred you — nothing more).
How you use the app: when you last opened the app (one date a day at most), where you stopped in the setup steps, how many sessions you began, and whether you accepted the prompt to add the app to your home screen. We use this only to see where the app loses people, so we can improve it.
We do not collect payment card details directly. Payment (once subscriptions launch) is handled by Stripe; we receive only subscription status.
We do not use biometric, location, device-fingerprint, or ad-tracking data.
Our commitment: your personal anxiety, belief, and session content is never sold to or shared with third parties. We may use standard analytics tools (for example Google Analytics) to understand how the Service is used — screens visited, device type, aggregate usage patterns. Such tools never receive the content of your sessions: your fears, beliefs, and intensity ratings stay out of them, always.
3. Why we collect it — purpose and legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service (auth, session storage, progress tracking) | Art. 6(1)(b) — contract performance |
| Sending transactional emails | Art. 6(1)(b) — contract performance |
| Research use of anonymised data | Art. 6(1)(a) — consent, with Art. 89 safeguards |
| Understanding how people find the Service (link source tags) | Art. 6(1)(f) — legitimate interest |
| Usage analytics (when introduced — usage/technical data only, never session content) | Art. 6(1)(a) — consent (cookie banner) |
| Payment processing (Stripe, when launched) | Art. 6(1)(b) — contract performance |
| Legal obligations (e.g. tax records) | Art. 6(1)(c) — legal obligation |
4. Research use of data
REPWORK was developed as part of ongoing research at Babeș-Bolyai University into applications of Emotional Freedom Techniques.
If you consent at sign-in, your session data may be used in that research. This is always anonymised — your name, email, and any direct identifier are stripped before data enters any research dataset. What we analyse is patterns: how intensity ratings change across sessions, which topics users choose, how often fears open at zero, and how long a challenge of 30 sessions takes.
These patterns feed back into the tool. The intensity threshold that triggers breakthrough mechanics was derived from cohort data. The tool evolves as the dataset grows.
Legal basis: research under Article 89 GDPR, on the basis of your consent (Article 6(1)(a)) given at sign-in.
You can withdraw research consent at any time from your dashboard (user menu → Research consent). Withdrawal stops new session data from entering the research dataset going forward. Already-anonymised aggregate data remains in place, because it can no longer be linked back to your account.
If you decline research consent at sign-up, you can still use the full Service. Your sessions remain private to your account and never enter the research dataset. You can change your mind any time from the dashboard (user menu → Research consent).
You retain the right to request full deletion of your account and all associated data at any time (GDPR Article 17 — see §6). Full deletion is separate from consent withdrawal.
5. Retention — how long we keep your data
| Data | Retention |
|---|---|
| Account and profile | As long as your account exists. Deleted within 30 days of deletion request, except where legal obligations require longer. |
| Session and progress (while subscribed) | As long as the account exists. |
| Session data (after cancellation) | Retained on your account so you can re-subscribe and continue. |
| Anonymised research data (if consent given) | Retained indefinitely under GDPR Art. 89. Once anonymised, no longer linked to your account. |
| Email delivery logs | 30 days rolling (SendGrid default). |
| Payment and billing records | As required by Romanian tax law. |
6. Your rights under GDPR
You have the following rights. To exercise any of them, use the contact in §1.
- Access (Art. 15) — request a copy of your data.
- Rectification (Art. 16) — correct inaccurate data.
- Erasure (Art. 17) — delete your account and data.
- Restrict processing (Art. 18) — pause processing during a dispute.
- Data portability (Art. 20) — receive your data in a machine-readable format.
- Object (Art. 21) — object to specific processing activities.
- Withdraw consent (Art. 7(3)) — for anything processed on consent (research use), withdraw from your dashboard.
- Lodge a complaint — with the Romanian data-protection authority (ANSPDCP, www.dataprotection.ro) or your EU country of residence.
7. Third parties we share data with
We use a small number of processors. Each has its own data-protection agreement. We do not sell or trade your data.
- Google (Firebase) — hosting, authentication, database, cloud functions.
- SendGrid — transactional email delivery.
- Stripe (when subscriptions launch) — payment processing.
Some processors may store data outside the EU (e.g. in the US). Transfers are covered by Standard Contractual Clauses approved by the European Commission.
8. Cookies and local storage
The Service stores a small amount of data locally in your browser (Firebase Auth session token; minor UI state like your selected topic). This is essential to basic functionality.
We do not currently use marketing or analytics cookies, and we do not track you across other websites. If we introduce a standard analytics tool, we will ask for your consent through a cookie banner first (as EU law requires) — and, as stated in §2, your session content (fears, beliefs, intensity ratings) will never be shared with it.
9. Children
The Service is intended for adults and is available only to persons aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has created an account, please contact us — we will close the account and delete the associated data promptly.
10. Changes to this Policy
We may update this Policy. For material changes (affecting the categories of data collected, the purposes of processing, or the categories of recipients), we will notify you by email at least 30 days before the change takes effect, and seek fresh consent where required.
11. Contact
thomas.furmanek@stud.ubbcluj.ro
Complaints: the Romanian data-protection authority (ANSPDCP, www.dataprotection.ro) or the authority in your EU country of residence.