Pay Draft, not yet in force. Before publishing:
- Fill in the controller's legal name and postal address in section 1.
- Set up the email addresses privacy@hillgaars.com and support@hillgaars.com, or change them here.
- Check section 6 (ads) against the ad provider and consent tool actually used, and add the app's Ad privacy choices button in Settings that it promises.
- Have it reviewed by a lawyer, then remove this notice.
Privacy policy
Last updated: [date of publication]
Pay Power helps you see what inflation has done to your pay. To do that it needs your salary figures, which are personal and sensitive. This policy explains what the app collects, where it's kept, who else is involved, and how you can see, change or delete it.
In short:
- Your salary figures are used for one thing only: calculating your reports.
- They're never sold, and never shared with advertisers or anyone else.
- Without an account, they stay on your phone, encrypted.
- If you sign in, they're also stored in your own account, so you can restore them on a new phone.
- You can delete everything at any time in the app.
1. Who is responsible
The data controller is [legal name], [postal address], trading as Hillgaars ("we", "us"). For anything about your data, email privacy@hillgaars.com.
2. What we collect, and why
| Data | Why | Where it's kept | Legal basis (GDPR) |
|---|---|---|---|
| Salary figures you enter: for each year, gross and/or take-home pay, how it's paid, income labels you choose, pension and voluntary deductions, your country and currency, saved reports, and any inflation estimate you add with its source | To calculate your reports | On your phone, encrypted. If you sign in, also in your account in Google Firebase (servers in Belgium, EU) | Performing our contract with you: providing the app (Art. 6(1)(b)) |
| Account details, only if you sign in: an account ID, your email address (or the private relay address Apple gives you), and whether you used Apple or Google | To keep your data in your own account and let only you reach it | Google Firebase Authentication | Contract (Art. 6(1)(b)) |
| Technical data your phone sends when it connects to our servers: IP address, device and app version, time of request | To deliver inflation figures and your account data, and to keep the service secure | Google's server logs | Our legitimate interest in running a secure service (Art. 6(1)(f)) |
| Your choice on the privacy screen: which version you accepted, and when | To show you the screen again if its wording changes | On your phone | Legitimate interest (Art. 6(1)(f)) |
We don't ask for your name, employer, address or bank details, and the app has no analytics or tracking of how you use it. Salary figures are self-reported and we don't check them.
Under the GDPR, salary data isn't a "special category" of data, but we treat it as sensitive: it's encrypted on your phone, encrypted in transit, and only your own signed-in account can read it from our database.
3. On your phone
Your wallets, cards and saved reports are stored encrypted (AES-256) with a key kept in your iPhone's Keychain. The key can only be used while your phone is unlocked, and it's never included in backups. A backup of the app's files can't be read on another phone; to move your data to a new phone, sign in.
When you export a PDF, the app creates the file only to hand it to the share sheet, then deletes it. Copies you save, send or share are outside the app and are your responsibility.
4. If you sign in
You can add years and see reports without an account. Saving a report or exporting a PDF asks you to sign in with Apple or Google, so the report is kept in your account. Once you're signed in, your wallets, cards and saved reports are copied to your account and kept in step with your phone. They're stored in Google Cloud Firestore in the EU (Belgium). Only you, signed in, can read or change them: our database rules refuse every other request. We don't look at individual users' salary data. We'd only access it if you ask us to, for example to help with a problem, or if the law requires it.
We don't create statistics from users' salaries. If we ever want to, we'll ask for your separate, explicit consent first and update this policy.
5. Who else is involved
We use these service providers. They process data for us under data processing terms:
- Google (Firebase Authentication and Cloud Firestore, provided by Google Ireland Limited): account sign-in, storage of signed-in users' data, and delivery of inflation figures.
- Apple (Sign in with Apple) and Google (Google Sign-In): they confirm who you are when you choose to sign in with them, under their own privacy policies.
- Apple (App Store): distributes the app and may give us aggregate download and crash statistics, under Apple's privacy policy.
Inflation figures come from public sources such as the World Bank and national statistics offices. The app downloads them from our servers, not from those sources, and sends nothing about you to them.
Some of these providers may process data outside the EU, for example in the United States. Where they do, transfers are covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
6. Ads
Pay Power is free and shows ads, provided by Google AdMob. Ad providers never receive your salary figures or anything you enter in the app. The ads part of the app has no access to them. An ad is shown after you save a report or export a PDF.
- On iPhone, ads are personalised only if you allow tracking when iOS asks. If you don't, or you change it later in Settings → Privacy & Security → Tracking, you see non-personalised ads.
- In the EEA, the UK and Switzerland, we also ask for your consent through a consent form before personalised ads are shown. You can change your choice at any time in the app's Settings.
- Even non-personalised ads involve the ad provider processing your IP address and device information, for example to prevent fraud and to count how often an ad is shown. See how Google uses data from partner apps.
- You can use every feature of the app whatever you choose.
7. How long we keep it
- On your phone: until you delete it in the app, or delete the app.
- In your account: until you delete it, or delete your account. Deleting a wallet or report in the app deletes it from your account too.
- When you delete your account, your account and all data in it are deleted straight away. Google may keep copies in its backup systems for a limited time before they're overwritten.
- Server logs: kept by Google for a limited period for security and operations.
8. Your rights
Under the GDPR you can:
- See and correct your data: it's all in the app, and you can edit any card.
- Delete it: Settings → Delete account and data, or, without an account, Settings → Delete all data on this phone. Deleting a card, report or wallet removes it everywhere.
- Get a copy of it (data portability): export any report as a PDF, or email us for a copy of everything in your account.
- Object to processing based on our legitimate interests, or restrict it.
- Withdraw consent for personalised ads at any time.
Email privacy@hillgaars.com for anything the app doesn't let you do yourself; we reply within one month. You can also complain to a data protection authority. In Ireland that's the Data Protection Commission, or you can contact the authority where you live.
9. Security
Everything the app sends and receives is encrypted in transit (HTTPS/TLS). Data on your phone is encrypted, and our database only lets each signed-in user reach their own data. No system is perfectly secure. If a breach affects your data, we'll tell you and the authorities as the law requires.
10. Children
Pay Power is meant for working adults and isn't directed at children under 16.
11. Changes to this policy
If we change this policy, we'll update the date at the top. If a change affects how your salary data is used, the app will show you the new wording and ask you to accept it before you continue.
12. Contact
Privacy questions: privacy@hillgaars.com
Help with the app: Support