Eurolio / Legal documents
Privacy policy
Who is responsible for your data
The controller of personal data is Anton Lyapov, an individual from Bulgaria. He provides Eurolio, a personal album for euro coins.
For any question about your personal data, write to contacts@eurolio.lyapov.com.
What data we process
You can browse the coin catalog without signing up. Without signing in we collect no account data, but our providers still see technical data such as your IP address (see below).
When you sign in, we process your e-mail address and the user ID created for the account. If you sign in with Apple or Google, Supabase also stores your account identifier at that provider and the profile data the provider passes: the e-mail address, and with Google also the name and picture. Apple may pass the name, as well as a private relay address instead of your real e-mail.
If you register with an e-mail and a password, the password is stored only as a hash (an irreversible transformation) by Supabase. Nobody, including the controller, can read it.
Your collection consists of the keys of the coins you own, the quantities, your notes and the times of the changes. Notes are optional - do not put sensitive information in them.
The service providers we use also see technical data when you connect, for example an IP address. See the section on processors for details.
In the iOS and Android apps, outside development builds, we receive crash reports and usage statistics. A crash report contains a random installation ID created by Firebase Crashlytics, the device model, the operating system and app versions, and the technical trace of the crash. Usage statistics contain a random app instance ID created by Google Analytics for Firebase, automatic events (such as opening the app) and the name of each screen you open as a route pattern (for example the country page, without the country itself). We never send your account ID, e-mail address or an advertising ID, and we do not use the advertising ID, ad personalisation or Google signals. Both are on by default and you can turn them off at any time in More -> Privacy with the switches "Send crash reports" and "Share usage statistics". A change to crash reports takes effect from the next launch.
In the web version we use Google Analytics 4 only after you allow it - with "Allow" in the cookie banner or by turning on "Share usage statistics" in More -> Privacy. Then Google Analytics sets cookies (_ga) on your device and records the screens you open. If you tap "Decline", nothing is sent and no cookies are set. Turning "Share usage statistics" off stops it and removes the _ga cookies.
Where the data is stored
The account and the collection are stored in Supabase, in an EU region (Frankfurt, Germany).
On your device we keep the sign-in session, your preferences (language, theme, filters) and the downloaded catalog. This data is not sent to us or to third parties, except the session the app uses to authenticate with Supabase. Firebase also keeps random installation and app instance identifiers on the device (on the web, the _ga cookies after your consent) and sends them to Google as described in "What data we process".
Who else processes data
Supabase stores the account and the collection, performs authentication and serves the catalog updates; without signing in it sees only your IP address.
Resend sends the sign-in, address confirmation and password-reset e-mails.
Railway hosts the web app at app.eurolio.lyapov.com and sees your IP address when you open it.
НС 1 АД (NS1), Bulgaria, hosts the website eurolio.lyapov.com (the home page and the public legal pages) and sees your IP address when you open it.
jsDelivr serves the coin photos and sees your IP address when they load.
Apple and Google provide sign-in with their accounts and distribute the app in the App Store and Google Play.
Google (Firebase) processes the crash reports and the usage statistics on our behalf, as a processor.
We show no ads, we do not track you across apps or sites, we do not profile you, and we do not sell data.
Purposes and legal bases
We process the e-mail address, the identifier and the collection to provide you with an account and to keep your collection. The legal basis is the performance of the contract with you (Article 6(1)(b) GDPR).
Our providers keep technical logs for security purposes (for example IP addresses). The legal basis is legitimate interest - the interest in keeping the service secure and reliable (Article 6(1)(f) GDPR).
We process crash reports and the statistics in the iOS and Android apps to find and fix errors and to understand which parts of the app are used. The legal basis is legitimate interest (Article 6(1)(f) GDPR). You can object at any time by turning off the switches "Send crash reports" and "Share usage statistics" in More -> Privacy.
We process the statistics in the web version only with your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with the "Share usage statistics" switch in More -> Privacy.
Transfers outside the EU
Some of our providers may process data outside the European Union. In such cases the transfer relies on the providers' standard contractual clauses.
Google may process crash reports and statistics in the United States. The transfer relies on the EU-US Data Privacy Framework and on standard contractual clauses.
How long we keep the data
We keep your data until the account is deleted. After deletion, the account, the e-mail address and the whole collection with its notes are removed for good.
Crash reports are kept for 90 days and usage statistics for 2 months, and then they are deleted automatically. They are pseudonymous and are not linked to your account, so deleting the account does not delete them; they expire on their own.
How to delete your account
In the app, deletion is immediate - open "More" -> "Account", then "Delete profile…". Information is also at https://eurolio.lyapov.com/delete-account.
You can also request deletion by e-mail from the account's address to contacts@eurolio.lyapov.com. We answer within 30 days.
Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection. To exercise your rights, write to contacts@eurolio.lyapov.com.
You have the right to lodge a complaint with the Commission for Personal Data Protection (КЗЛД), cpdp.bg.
Age
The app is intended for people aged 14 or older. Younger children may use it only with the consent of a parent or guardian.
Changes to this policy
If this policy changes, we will let you know in the app. The date of the last change is shown at the top of the document.