PRIVACY POLICY.

1. Data controller

The controller of personal data is:

We have not appointed a data protection officer. You may use the email address above for every privacy matter.

2. Data that stays on your device

Game files, archives, BIOS files, saves, save states, custom artwork, settings, shortcuts and library metadata are stored locally on your device. We do not upload them to our servers. You create a library export yourself and decide where to save or share it.

Bluetooth access is used to connect a controller. The camera and motion sensors are used only by compatible games after you grant the relevant system permission. Camera images and motion data are processed on the device and are not sent to the Studio.

3. Catalogue and network infrastructure

The app downloads the supported integration catalogue from the POKKIO server. The website and API run on Vercel infrastructure. When a connection is made, Vercel may process ordinary technical data, including IP address, approximate location derived from IP, device and browser type, timestamps and diagnostic data. The Studio does not use this data for advertising, profiling or cross-service tracking.

Purpose: delivering the website, catalogue and API, and protecting the service from faults and abuse. Legal basis: performance of the service under Article 6(1)(b) GDPR and the legitimate interest in security and reliability under Article 6(1)(f) GDPR. Technical log retention depends on the Vercel plan and policies. The Studio does not create an additional database of those logs.

4. New game notifications

Notifications are optional and off by default. If you enable them, we store an APNs token, a random installation identifier, the app environment, notification language, subscription date and the identifiers of catalogue items already delivered. We use this data only to send the selected notifications through Apple Push Notification service.

Legal basis: your consent under Article 6(1)(a) GDPR. You may withdraw consent in the app. Turning notifications off deletes the registration and token from our server. You may also disable notifications in iOS Settings or ask us to erase the data.

5. Apple, Microsoft and external links

App search and artwork downloads may connect directly to Apple services. Opening Xbox Cloud Gaming loads the Microsoft website in a browser view. POKKIO does not receive your Apple or Microsoft sign-in credentials. Those companies process data under their own policies.

Links to the App Store, GitHub, PawlukStudio and other websites open external services. After you open a link, the operator of that service may become the controller of data collected there.

6. Support and correspondence

If you email or call us, we process the contact details, message content and information needed to handle the matter. The legal basis depends on the request: steps at your request or contract performance under Article 6(1)(b) GDPR, a legal obligation under Article 6(1)(c) GDPR, or the legitimate interest in handling correspondence and defending claims under Article 6(1)(f) GDPR.

We retain the data for as long as needed to reply, then for the period required by law or needed to establish, pursue or defend claims.

7. Recipients and transfers outside the EEA

Data may be processed by infrastructure providers acting for us, particularly Vercel, and by Apple for notifications. If you deliberately open a Microsoft service, Microsoft also processes data. Providers may process data outside the European Economic Area using an appropriate legal mechanism, such as an adequacy decision or standard contractual clauses.

We do not sell data or share it with data brokers or advertising networks.

8. Your rights and choices

Depending on the legal basis and circumstances, you may have rights of access, correction, erasure, restriction, portability, objection and withdrawal of consent at any time. Withdrawing consent does not affect processing that was lawful before withdrawal.

To exercise a right, email kontakt@pawlukstudio.pl. We will reply without undue delay, normally within one month. We may request information needed to confirm that the request concerns the correct person or installation.

You may lodge a complaint with the President of the Polish Personal Data Protection Office, uodo.gov.pl, or with your local EEA supervisory authority.

9. Automated decisions, children and security

We do not make decisions producing legal effects based solely on automated processing. We do not profile users. The app does not request a date of birth and does not create child accounts. A parent or guardian should supervise a child’s use of game files and external services.

We use encrypted HTTPS connections, random notification credentials and data minimisation. No system can provide an absolute guarantee of security.

10. Website storage and policy changes

The website uses no advertising or analytics cookies. It stores only the selected site language in browser storage. We may update this policy if the app, providers or law changes. A revised policy will show a new date and remain available at this address.