Privacy Policy

GOTOIT sp. z o.o., ul. Słoneczna 9A, 55-080 Smolec, Poland, entered in the National Court Register (KRS) kept by the District Court for Wrocław-Fabryczna in Wrocław, 9th Commercial Division of the National Court Register under KRS 0001010915, VAT ID PL8961620558, REGON 524066068, share capital PLN 5,000. Contact for data protection matters: shortandchill@gotoit.pl.

• Account: email address, Google sign-in identifier, account identifier (including an app account without an email address).
• Code sign-in and app accounts: email address, time of the code request, a hash of your IP address – for attempt limits and abuse prevention.
• Sign in with Apple in the app: the user identifier assigned by Apple and an Apple token (a so-called refresh token) – we keep it only to revoke the app’s access to your Apple ID at Apple when the account is deleted, and delete it right after access is revoked (if Apple does not respond for a while – after 3 days at the latest).
• Website orders: product, amount, currency, status, payment method type, country, consents given. We do not receive full card details – they are processed by the payment provider.
• Cancelling a VIP subscription bought on the website (also from the app): the reason you choose on the cancellation screen and an optional comment (up to 500 characters); if the subscription is handled by Stripe, we also pass them to Stripe.
• The cancellation screen for a VIP bought on the website and the cancellation offer: account and subscription identifiers, plan, payment method, the reason you choose, whether we showed an offer and whether it was accepted or declined (with the amount), and when these happened, including a resume – to handle the offer (performance of the contract, Art. 6(1)(b) GDPR) and to measure how it works (our legitimate interest, Art. 6(1)(f) GDPR); the offer record is kept until the account is deleted (the offer is available once per person), the other records for 2 years.
• App purchases: from the App Store or Google Play, via RevenueCat, we receive transaction and subscription identifiers, product, price and currency, store country, purchase, renewal and expiry dates, and cancellation and refund information. We do not receive your name, your Apple or Google account email or card details.
• Technical: IP address and the country derived from it, device and browser type; in the app also the operating system (iOS/Android) and app version.
• Usage: unlocked episodes, viewing statistics of episodes (anonymous or linked to your device), payment window and in-app purchase sheet events.
• Marketing parameters (website only): UTM tags, fbclid, ttclid, the Meta cookies _fbp/_fbc and the TikTok cookies _ttp, src, src_at and tt_*.
• Emails about our series (if you gave your email address with an order on the website) and reminders about an unpaid order: a hash of your email address, the type and time of emails sent (without the address or the content), the series and episode the email was about, clicks on the button in the email and purchases within 7 days after it, your usual viewing time (an hour calculated from viewing statistics), whether you are in the group that receives these emails or in the control group, the record of switching emails on and off with the switch in My wallet (time and place; also records of email consents given before 4 November 2026) and hashes of addresses that unsubscribed or that Twilio SendGrid reports as bouncing or marking emails as spam. To choose the content we use data we already have: purchases and subscriptions, coin balance, unlocked episodes and viewing statistics.
• Series reminders (app only, if you turn them on): the push token Apple or Google assigns to your phone, the operating system (iOS/Android), app version, the language version you use (English or Polish), your phone’s time zone, a random installation ID used only for reminders, the consent record (wording version, the time and the place in the app where you agreed, and when you withdrew), the time you last used the app with the series and episode you can continue from, whether you have an active VIP covering that catalogue and your coin balance (sent by the app, without your account identifier), the end date of a VIP that does not renew automatically (also sent by the app), a series you finished, after which we may recommend another one, the reminder schedule, series that have already had their last reminder, whether your phone is in the group that gets reminders or in the control group, and the reminder history (what we sent – or, in the control group or during a trial period before we start sending, would have sent – and when, whether the reminder was opened and whether you then came back to the app or watched the next episode). When you turn reminders on we also keep a hash of your IP address for one day, to limit the number of registrations from one address. This data is not linked to your account, your email address or your viewing statistics. More: Notifications in the app.

• Providing the Service and performing the contract (account, purchases, access) – Art. 6(1)(b) GDPR.
• Accounting and tax – Art. 6(1)(c) GDPR.
• Security, fraud prevention, handling complaints and claims, service statistics (including reasons for cancelling VIP) and internal alerts to our team about sales and payments – our legitimate interest, Art. 6(1)(f) GDPR.
• Advertising measurement with Meta Pixel and Conversions API (reporting website purchases and visits to Meta to measure and optimise ads) – consent where required for cookies (Art. 6(1)(a) GDPR), otherwise legitimate interest.
• Advertising measurement with TikTok Pixel and Events API (reporting website browsing, checkout steps and purchases to TikTok to measure and optimise ads: page address, the series, episode or product reference, the _ttp and ttclid identifiers, IP address, browser data, for purchases and checkout steps the amount and currency, and a hash of your email address once we know it) – consent where required for cookies (Art. 6(1)(a) GDPR), otherwise legitimate interest. We do not report subscription renewals or in-app purchases to TikTok. The app contains no advertising pixels.
• Handling app purchases (linking a store purchase to your account, restoring purchases, refunds) – Art. 6(1)(b) GDPR.
• Reminders and news about our series in the app (push notifications), sent at a time matched to when you last used the app, with their number and text matched to whether you have VIP and coins – direct marketing of our series with your consent: Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law. You can withdraw consent at any time.
• Checking whether reminders help people get back to their series, by comparing phones that get them with a randomly chosen control group that does not – our legitimate interest, Art. 6(1)(f) GDPR. This covers only phones with reminders turned on.
• Proving that we send reminders with consent (the record of consent and its withdrawal) – our legitimate interest, Art. 6(1)(f) GDPR, in connection with Art. 7(1) GDPR.
• Emails we send to the address of your account or order: about your account and orders – sign-in codes and links, confirmations of purchases, refunds and VIP cancellation, and notices about a failed VIP payment or a payment that needs your action (performance of the contract, Art. 6(1)(b) GDPR; they keep coming after you unsubscribe); marketing – a reminder about an unpaid order, emails about our series after your VIP ends, after an unpaid order and after buying coins, and “Episode N is waiting” emails (described below). We send marketing emails without asking for separate consent, based on our legitimate interest in direct marketing of our services (Art. 6(1)(f) GDPR); you can unsubscribe at any time with the unsubscribe link in each of them or with the “Emails” switch in My wallet.
• A reminder about an unpaid order (one email, usually 30 minutes after an interrupted payment, at most once every 7 days) – our legitimate interest, Art. 6(1)(f) GDPR.
• Emails about our series, new series and episodes and VIP and coin prices – to people who gave their email address with an order on the website and have no active VIP: after your VIP ends 4 emails in about 3 weeks, then at most one a month; after an order that was not paid, at most 3 within 14 days (besides the payment reminder); after buying only coins, the first no earlier than 7 days later (3 days if you run out of coins for the next episode), then at most one every 3 weeks; only between 9 am and 8 pm (US Eastern time), at most 1 per 48 hours and 3 per 7 days – payment reminders already sent count towards these limits, while a payment reminder itself never waits for them; a purchase stops the series; after 4 emails without a click and 60 days without a visit we stop sending them; we do not send them to people who bought in the app (App Store, Google Play) or while their VIP is active. A randomly chosen share of people (about 20%) does not receive them, so we can check whether they help. Legal basis: our legitimate interest – direct marketing of our services (Art. 6(1)(f) GDPR), without separate consent. Every email has an unsubscribe link.
• “Episode N is waiting” emails – to people who cancelled a VIP bought on the website in the last 30 days (also while it still runs until the end of the paid period) or whose VIP ended, when at least 48 hours have passed since they last watched and the next episode of the series they watched is available: one email per such episode, at most one every 3 days, between 7 pm and 10 pm (Warsaw time), without prices, offers or VIP information. We choose the episode from viewing statistics. We do not send them to people who bought in the app (App Store, Google Play), received a refund or disputed a payment, or after account deletion. Legal basis: our legitimate interest – direct marketing of our services (Art. 6(1)(f) GDPR), without separate consent. Every email has an unsubscribe link.
• We do not send marketing emails to people who unsubscribed or to addresses that bounce or marked our emails as spam.
• Keeping the record of switching emails on and off in My wallet (and of email consents given before 4 November 2026) and hashes of addresses that unsubscribed – never to email people who unsubscribed – our legitimate interest, Art. 6(1)(f) GDPR, in connection with Art. 21(3) GDPR.

• Stripe Payments Europe, Ltd. – payments.
• Supabase / Lovable Cloud – hosting and database.
• A content delivery network (CDN) provider for video and audio (for example Bunny.net).
• Meta Platforms Ireland Ltd. – advertising measurement.
• TikTok Technology Limited (Ireland) and TikTok Information Technologies UK Limited (United Kingdom) – advertising measurement on the website. We and TikTok are joint controllers (Art. 26 GDPR) of collecting and transmitting data through TikTok Pixel and Events API and of measurement and reporting. We have agreed that we give you the information about this processing and that TikTok handles your rights under Arts. 15–20 GDPR for data it processes after this stage. TikTok uses this data as a separate controller for audience creation, ad targeting and improvement, and security. The TikTok privacy policy describes TikTok’s legal bases and how to exercise your rights against it.
• Make.com and Fakturownia – issuing sales documents.
• Twilio SendGrid – sending emails (sign-in codes, order confirmations and notices, payment reminders and emails about our series); once a day we download from SendGrid the list of addresses that bounce, reported our emails as spam or unsubscribed, and treat them as unsubscribed.
• Apple (App Store) and Google (Google Play) – selling and billing app purchases; they process purchase data under their own terms and privacy policies.
• RevenueCat, Inc. (USA) – handling app purchases (verifying purchases and subscription status); it receives your account identifier, not your email address.
• Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) – delivering notifications in the app on iPhone and Android; they receive the device token, the notification text and the data needed to open the episode when you tap the notification (series identifier, episode number, language, reminder ID), and on Android also the Firebase installation ID.
• Google (Firebase Crashlytics) – crash and error reports from the app on iPhone and Android, as our processor: the error trace, device model, operating system and app version, chosen catalogue, memory state and a random installation ID; no email address and no account identifier, not used for advertising or tracking. Legal basis: our legitimate interest in keeping the app stable (Art. 6(1)(f) GDPR).
• Telegram – internal alerts for our team about purchases, failed payments, refunds, subscription cancellations, accepted cancellation offers and resumed subscriptions: your email address (usually masked), product, amount, country, ad source, series and episode, device type, and for cancellations the reason and comment (for an accepted cancellation offer, the reason and renewal date); for purchases also whether they followed an email about our series; the daily summary of these emails contains only numbers, no email addresses.
• Authorities, where required by law.

Some providers may process data outside the EEA (for example in the USA). We rely on the EU–US Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses approved by the European Commission. TikTok states that it stores data on servers in the USA, Malaysia and Singapore, that entities in its group in other countries have limited remote access, and that it relies on European Commission adequacy decisions and Standard Contractual Clauses for transfers outside the EEA.

• Account data – while the account exists.
• Hash of your email address after an objection to advertising measurement – as long as needed to respect the objection.
• Order and accounting data – 5 years from the end of the calendar year of the purchase; after account deletion we keep them without your email address, IP address and advertising identifiers.
• Withdrawal requests (with your name, email address and IP address) – until claims become time-barred, also after account deletion.
• Sign-in code requests – up to 24 hours.
• Data for claims – until claims become time-barred.
• The reason and comment you give when cancelling a VIP subscription – 2 years from cancellation, then deleted.
• Cancellation offer (whether we showed it and whether it was accepted or declined, with the amount and reason) – until the account is deleted, because it is available once per person; other cancellation screen records – 2 years from recording, then deleted, and after account deletion they are no longer linked to the account.
• Analytics and marketing data – up to 2 years or until you object (or withdraw consent where consent is the basis); after account deletion viewing statistics and payment window events are no longer linked to the account.
• Series reminders: the token and other data of the phone – until you turn reminders off, Apple or Google report the token as invalid (for example after the app is uninstalled), or 270 days pass without you using the app; the series and episode to continue from and the coin balance – only until the reminder cycle ends; whether you have VIP – until you turn reminders off or the phone’s other data is deleted; the end date of a VIP that does not renew – up to 17 days after it ends; a finished series – up to 10 days; the IP address hash – up to one day; the reminder history – 180 days; the record of consent and its withdrawal (without the token) – 5 years after you withdraw consent or the phone’s data is deleted for another reason.
• Emails about our series: the record of emails sent and clicks – 13 months; the series state (for example the next check and your usual time) – up to 90 days after the last email or the last check, whichever is later; the record of the email switch in My wallet and of consents given before 4 November 2026 – 5 years after you switch emails off; the hash of an address that unsubscribed – as long as we must respect the objection. We use the address from your order for these emails until you object or delete your account, at most 12 months after your last purchase or activity (after an unpaid order – 60 days).

You have the right to access, rectify, erase and restrict processing of your data, to data portability, to object to processing based on legitimate interest, to object at any time, without giving reasons, to processing for direct marketing (Art. 21(2) GDPR), and to withdraw consent at any time (without affecting earlier processing). You can withdraw consent to series reminders yourself in the app (Account → “Series reminders”) or in your phone’s notification settings. Reminder data is not linked to your account, so we cannot find it by your email address (Art. 11 GDPR). You can delete the token and the phone’s other data yourself by turning reminders off in the app; we keep the reminder history and the consent record for the periods under Retention. You may lodge a complaint with the Polish supervisory authority (President of the Personal Data Protection Office, PUODO, ul. Stawki 2, 00-193 Warsaw) or the authority in your country.

Right to object. You can object at any time to the processing of your data for direct marketing, including profiling for that purpose (choosing the time, the series, the text and the number of reminders – also based on whether you have VIP and on your coin balance). The simplest way is to turn reminders off. You can also object, on grounds relating to your particular situation, to processing based on our legitimate interest. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

You can object to emails about our series (including “Episode N is waiting”) and to payment reminders with the unsubscribe link in each of them – it works immediately (purchase confirmations and sign-in codes keep coming); you can also switch these emails off with the “Emails” switch in My wallet. We choose the series, text and time of these emails automatically (profiling for direct marketing) – this has no legal effects on you.

You can delete your account yourself: in the app (Account → Delete account), on the Account deletion page or by email to shortandchill@gotoit.pl. That page explains what we delete and what we keep.

Short and Chill uses the following cookies and local storage entries:

• Session and sign-in (local storage) – necessary.
• Preferences: language, playback settings – necessary.
• np – test switch for the payment window (24 hours) – necessary.
• Anonymous listener identifier for episode statistics (local storage) – necessary for service statistics, not shared with advertisers.
• _fbp/_fbc – Meta (Facebook) Pixel advertising measurement. The Pixel loads when you open the site and reports page views and checkout steps to Meta Platforms Ireland Ltd.; purchases are also reported from our server (Conversions API) together with these identifiers, your IP address, browser user agent and a hashed email address. Legal basis: our legitimate interest in measuring and optimising our advertising (Art. 6(1)(f) GDPR).
• _ttp, ttclid and TikTok Pixel helper cookies, with a period set by TikTok – TikTok advertising measurement. The Pixel loads when you open the site and reports page views and checkout steps to TikTok; these steps and purchases are also reported from our server (Events API) together with these identifiers, your IP address, browser data and, once we know it, a hashed email address. Legal basis: our legitimate interest in measuring and optimising our advertising (Art. 6(1)(f) GDPR).
• src, src_at, tt_ttclid and tt_utm_* – the source and campaign parameters of a visit from a TikTok ad, 30 days. npw_utm (local storage) – the latest ad parameters, to attribute an order, until replaced by new ones or until you clear your browser data.

How to object: you can object to this processing at any time by writing to shortandchill@gotoit.pl – we will then stop reporting your purchases and events linked to your email address to Meta and TikTok, and pass your objection on to TikTok (we keep a hash of your email address for this). You can also block or delete cookies in your browser settings: this limits measurement in the browser, but our server may still send events and purchases, without an objection also with a hash of your email address. You can manage ad preferences in your Meta and TikTok account settings.

The app stores your sign-in session, chosen catalogue, settings and recently loaded catalogue data on your device (necessary). For series reminders it also stores your consent (wording version, time and place), the push token and a random installation ID used only for reminders (necessary for reminders to work and to turn them off); on Android, Google’s Firebase Cloud Messaging library creates a Firebase installation ID on the device, only after you turn reminders on and with analytics collection off. The app contains no advertising pixels (Meta, TikTok) and does not track you across other apps or websites.

Series reminders are marketing notifications about our series. They are optional: the app asks on its own screen – not when you first open it, but for example after you watch an episode or add a series to My List – and shows the phone’s notification prompt only after you agree. We give no reward for turning them on, and the app works the same without them.

• Reminders are about series you have not finished. If you don’t have VIP, after a break in using the app we send at most twelve reminders about a series: every day for the first 7 days, then after 9, 12, 15, 18 and 21 days – at most one reminder a day (between 10 am and 10 pm). While you have an active VIP covering the series’ catalogue (the app tells us each time you use it), we send no watch reminders; when your VIP ends, they may come back the next time you use the app. If the app has not told us whether you have VIP (older app versions), we send at most three – the next day, after 3 days and after 7 days – no more than one per 20 hours and no more than three in 7 days. After the last reminder about a series we do not remind you about it again until you watch it again. If twelve reminders in a row go unopened, we pause for 30 days.
• To plan a reminder and choose its text, the app sends us when you use it, your language version, your phone’s time zone, the series and episode you can continue from, whether you have an active VIP covering that catalogue and your coin balance (without your account identifier). The reminder usually comes at a similar time of day to when you last used the app – about half an hour earlier, between 10:30 am and 9:30 pm; after using the app at night (10 pm–4 am), at about 8 pm.
• We do not send reminders at night, between 10 pm and 9 am your phone’s time. A reminder that cannot be delivered by 10 pm (for example because the phone is off) expires.
• Reminders may show the series title, the episode number, how many free episodes of the series you have left, and your coin balance with the number of episodes it covers – with no description of the content and no images. They appear on the lock screen – you can hide notification previews in your phone’s settings.
• To check that reminders really help, we send none to a randomly chosen share of the phones that turned them on (the control group). For both groups we record when a reminder was sent or would have been sent (in the control group, and during a trial period before we start sending), whether it was opened and whether the app was used again or the next episode watched within 72 hours, and compare the results.
• You can turn reminders off at any time in the app (Account → “Series reminders”) or in your phone’s notification settings – this withdraws your consent. We then stop sending reminders and delete the token and the phone’s other data from our server, including the series and episode to continue from; we keep the reminder history for up to 180 days and the record of consent and its withdrawal for 5 years after you withdraw consent. We never turn reminders back on ourselves. If you turn them off in your phone’s settings, the app tells us the next time you open it; if you never open it again, we delete the phone’s data after 270 days, or sooner if Apple or Google report the token as invalid. Deleting your account in the app also turns reminders off.
• After VIP ends: if your VIP does not renew automatically, the app tells us its end date (without your account identifier); after it ends we send at most 3 notifications about the series you are watching – after about 2, 6 and 14 days; they stop when you use the app again or your VIP comes back.
• News: about a new series in the app’s catalogue that you have not started (at most 3 days after its premiere) and about new episodes of a series that has already had its last reminder – together with recommendations at most one per 7 days.
• Recommendations: when you have finished all the series you started – at most 2 notifications with another series to watch from the start, after 2 and 7 days; they count towards the news limit. News and recommendations do not come while you have an active VIP.
• These notifications fit within the limit of one a day (between 10 am and 10 pm), phones in the control group do not get them, and they contain only the series title and episode numbers – no description of the content, prices, offers or the word VIP.
• We do not send notifications about offers (coins, VIP) – if we ever do, we will ask for separate consent; a series reminder may mention your coin balance, but never contains offers to buy coins or VIP.

shortandchill@gotoit.pl