DRAFT — needs legal review. This text has not been approved yet and is not in force. Items in [brackets] are still open.
Privacy policy
Draft of 7 November 2026
Who is responsible
The controller of your personal data is IskraLabs [full legal name and company number], Sermin 75P, 6000 Koper - Capodistria, Slovenija. For anything about your data, write to [email protected].
This policy covers the Unik iPhone app, the Unik service behind it and this website.
What we process
| Data | What it is |
|---|---|
| Account | Your email address and whether it is confirmed, your display name, the app language and your phone's time zone. The sign-in service also records when and how you sign in, and from which IP address. |
| Yachts and controls | Yacht names; the control boxes (their Bluetooth identifiers) on each yacht; control names, order and the installer settings from the box's QR code. |
| Proof of presence | When you add a box: the time, the signal strength and the box's Bluetooth name, showing that your phone was near it. |
| Sharing | Who is a member of which yacht and until when; invitations (the invited email address, who sent it and the exit date). Invitation codes are stored only in a form that can't be read back. |
| Notifications | Your phone's push token, platform and app version, and the text of the notifications we send you (yacht names, names of people, dates). |
| Security records | A log of boxes added and released, members added, changed and removed, and yachts deleted; counters for rate limits; reports you send about a box that someone else has added. |
| Crash reports | If the app crashes: technical details about the app and the phone at the time of the crash [confirm once Crashlytics is configured]. |
Unik has no advertising, does no tracking across apps or websites and uses no analytics. It doesn't use your location; Bluetooth is used only to talk to the boxes.
This website uses no cookies and stores nothing in your browser [confirm that no Cloudflare analytics or bot cookies are on]. The invitation page reads the code from the link in your browser only; the code is not sent to us.
Why, and on what legal basis
- To provide Unik to you: your account, your yachts, sharing, notifications and sync (performance of a contract, Art. 6(1)(b) GDPR).
- To keep Unik safe and working: one owner per box, rate limits, the security log, crash reports and handling disputes about boxes (legitimate interests, Art. 6(1)(f) GDPR).
- To deliver invitations: when an owner invites an email address, we send that address one email (legitimate interests of the owner and of IskraLabs) [legal review].
Who processes data for us
| Provider | For | Where |
|---|---|---|
| Supabase | Database, sign-in and server functions | EU (Frankfurt, Germany) |
| Resend | Sending emails (sign-in codes, invitations) | USA [or EU, per the region chosen] |
| Google Firebase | Delivering push notifications; crash reports | USA |
| Apple | Push notifications to iPhones; the App Store | USA |
| Cloudflare | This website, DNS and forwarding mail sent to our addresses | Global |
Transfers outside the EU/EEA are covered by the EU–US Data Privacy Framework or by standard contractual clauses [confirm per provider]. We don't sell personal data and don't share it for advertising.
Owners and members of a yacht see each other's display names, and owners see members' email addresses. The person who invited you sees the email address they used.
How long we keep it
- Your account data, until you delete your account in the app (Profile → Delete account). Deleting your account deletes the yachts you own, with their boxes and controls, your memberships, your push tokens and then your account.
- Security log entries, to resolve disputes about boxes and access [retention period to be decided]. Once your account is deleted, they are no longer linked to you.
- Invitations, for as long as the yacht exists. Codes stop working after 7 days (email) or 10 minutes (QR).
- Notifications, 30 days. Rate-limit counters, 2 days.
- Logs at our providers, for as long as each provider keeps them (usually days to weeks).
Your rights
You can ask for access to your data, for corrections, for deletion, for a copy in a portable format, and you can restrict or object to processing. Write to [email protected]. Many changes you can make yourself in the app, including deleting your account.
You can also complain to the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si).
Children
Unik is not meant for children under 16.
Changes
If this policy changes, we update this page and its date, and tell you in the app if the change matters.