Tauma

Privacy Policy

How Tauma collects, uses and protects your data.

Last updated: September 28, 2026

This Privacy Policy explains what personal data we collect when you use the Tauma mobile app and the website tauma.app (together, the “Service”), why we collect it, who we share it with and what rights you have. We process personal data in accordance with the Law of Ukraine “On Personal Data Protection” and, where it applies, the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The controller of your personal data is Individual Entrepreneur Maryna Mykolaivna Shvets (“we”, “us”). For any questions about your data, write to eywa21century@gmail.com.

2. What data we collect

Data you give us

  • Account: email address, password (we store only its cryptographic hash, never the password itself), name, username, profile photo, profile description, language and display settings.
  • Sign-in with Google, Apple or Facebook: your account identifier and email address with that service (with Apple, this may be a private relay address) and, if you allow it, your name. We do not receive your passwords for these services.
  • Content and activity: quotes (text, author, source, description, hashtags, visibility), comments, likes, saved quotes, reminders (which quote, days and time), who and what you follow (people, authors, topics, hashtags), follow requests, blocked users and the reports you file.
  • Messages: chat messages, the photos and files you send in them, and the quotes you share there.
  • Support requests: your email address and the text of your request.
  • Donations: the amount and your comment. To fill in the payment form in advance, we pass your email address and name to WayForPay. You enter your card details on the WayForPay page; we never see or store them.

Data collected automatically

  • Device and sessions: a device identifier created by the app, the device name and type, time zone, the token for push notifications, and session tokens.
  • Use of the Service: which quotes you have viewed and when, the time of your last activity and whether you are online. We use this for your statistics, day streaks and levels, to build your feed and to show your activity status (if it is turned on).
  • Subscription: whether you have Premium, which plan and until what date; we receive this from RevenueCat, Apple and Google. We do not receive your payment card details.
  • Technical data: IP address, the time and parameters of requests, and error reports, in server logs and in our error monitoring service.

The public pages of the website tauma.app do not use cookies, analytics or advertising trackers.

3. Why we use data and on what grounds

  • To provide the Service: your account, publishing and showing content, the feed, chats, reminders, notifications, statistics and translation at your request. Ground: performance of our agreement with you (the Terms of Use).
  • To keep accounts secure: confirming your email with codes, managing sessions, preventing abuse and fraud. Grounds: the agreement and our legitimate interest in security.
  • To moderate content: reviewing quotes and reports, enforcing the Terms of Use, protecting users. Grounds: our legitimate interest and legal requirements.
  • To process payments: subscriptions and donations. Grounds: the agreement and legal requirements (accounting and taxation).
  • To answer your support requests. Grounds: the agreement and our legitimate interest.
  • To keep the Service running: finding and fixing errors, protecting against attacks. Ground: our legitimate interest.
  • To send push notifications about activity, messages, reminders and, if you allow it, news and offers. Ground: your consent, given in the device settings; you can choose which notifications you receive in the app.
  • To comply with the law: responding to lawful requests from authorities and protecting our rights. Grounds: legal requirements and our legitimate interest.

Where Ukrainian law requires your consent, you give it by accepting this Policy when you create an account. We do not sell personal data, do not use it for targeted advertising and do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

4. What other users can see

  • Your name, username, photo, profile description, the number of your followers and quotes and, if you show it, your level are visible to all users.
  • Your quotes are visible according to the visibility you choose; if your account is private, only to followers you approve.
  • Comments are visible to everyone who can see the quote; messages, to the participants of the chat.
  • Anyone who receives a link to your profile or to a public quote shared from the app sees a preview of it: name, username, photo and the quote.

In the privacy settings you can make your account private; hide your activity status, who you follow, your level and your reading statistics; hide like counts; turn off comments; and choose who can message you.

5. Who we share data with

We share data only with service providers that help us run the Service (processors), and only to the extent they need it:

  • DigitalOcean: the servers the Service runs on;
  • Amazon Web Services: storage of photos and files;
  • Mailgun: sending emails (verification codes and service notices);
  • Google (Firebase Cloud Messaging): delivering push notifications;
  • Google, Apple and Meta (Facebook): sign-in, if you choose it;
  • Apple (App Store), Google (Google Play) and RevenueCat: buying and managing subscriptions;
  • WayForPay: processing donations;
  • DeepL and Google: translating the text you ask to translate, without any data about you;
  • Sentry: collecting error reports.

We may also disclose data when the law requires it or to protect the rights and safety of users and the Service, and, if the Service is reorganized or sold, to its new owner, in which case we will tell you in advance. We do not sell your data.

6. Transfers outside Ukraine and the EU

Some of these providers process data in other countries, including the United States. In such cases we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or the provider’s certification under the EU–U.S. Data Privacy Framework.

7. How long we keep data

  • Account data and content: for as long as your account exists.
  • When you delete your account, we delete it at once together with your profile, quotes, comments, likes, saved quotes, reminders, the messages you sent, your follows and your viewing history, and remove your profile photo from storage. Residual copies may remain in backups for up to 30 days.
  • Verification codes: 15 minutes. Session data: up to 30 days after you last used the app.
  • Server logs: up to 30 days. Error reports: up to 90 days.
  • Support correspondence: as long as needed to handle your request.
  • Payment records: as long as accounting and tax laws require.

8. Your rights

You have the right to:

  • know what data about you we process and receive a copy of it;
  • correct inaccurate data; you can edit most of it in the app yourself;
  • delete your data: delete your account in the app (Profile → settings → “Delete account”) or see Data Deletion;
  • restrict processing, or object to processing based on our legitimate interest;
  • receive the data you provided in a machine-readable format (data portability);
  • withdraw your consent at any time, for example by turning off notifications in the device settings; this does not affect processing before the withdrawal;
  • lodge a complaint with a supervisory authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, the data protection authority of your country.

To exercise your rights, write to eywa21century@gmail.com from the email address of your account. We will reply within 30 days and may ask you to confirm your identity.

9. Children

The Service is not intended for children under 16, and we do not knowingly collect their data. If you believe that a child has given us personal data, write to us and we will delete it.

10. Security

We encrypt data in transit (HTTPS), store passwords only as hashes, limit the number of attempts to enter verification codes and give access to data only to those who need it to run the Service. No method of transmission or storage is completely secure, but we work to protect your data and, where the law requires it, will notify you and the relevant authorities of a data breach.

11. Device permissions

The app asks for permissions only when a feature needs them: notifications, to send you push notifications; photos or camera, when you choose a picture for your profile or a message. You can withdraw permissions at any time in the device settings.

12. Changes to this Policy

We may update this Policy. We will announce significant changes in the app or by email before they take effect. The date of the current version is shown at the top.

13. Contact us

Individual Entrepreneur Maryna Mykolaivna Shvets
Email: eywa21century@gmail.com