Privacy Policy

The FinPath app and the finpath.likims.com website · version 1.0 · last updated: 15 August 2026

This privacy policy describes what personal data is processed in connection with the use of the FinPath mobile application (the “App”) and the finpath.likims.com website (the “Website”), for what purposes, for how long, and what rights data subjects have.

1. Data controller and data processor

The controller of the personal data of the App’s users is Fundacja Edukacji Finansowej Dzieci i Młodzieży „Trampki na giełdzie” (the “Trampki na giełdzie” Children and Youth Financial Education Foundation), with its registered office in Kraków, ul. Mogilska 65, 31-545 Kraków, Poland, entered in the National Court Register (KRS) under number 0001057734, tax ID NIP 6762651288, REGON 526373001 (the “Controller” or the “Foundation”). Data protection contact: kontakt@trampkinagieldzie.pl.

To ensure the technical operation of the App, the Controller uses the services of LIKI Mobile Solutions Sp. z o.o., with its registered office in Łódź, ul. Żeligowskiego 8/10, 90-753 Łódź, Poland (“LIKI”), which designs, develops, hosts and maintains the App and its infrastructure and processes personal data on the Controller’s instructions as a data processor. LIKI is also the entity that publishes the FinPath app in the Apple App Store and on Google Play (the app developer shown in the store listing).

2. How accounts are created

The App is part of an educational programme run in cooperation with schools. Accounts are not created by students themselves:

• student accounts are created in bulk as part of a school’s participation in the programme, and the initial credentials (a pseudonymous login and a temporary password) are handed to students by their coordinating teacher;
• teacher and coordinator accounts are created on the basis of invitations sent within the programme.

This means the Controller receives students’ data via the school participating in the programme, not directly from the students (Article 14 GDPR).

3. What data we process

Students — pseudonymous accounts

Student accounts are deliberately designed not to contain directly identifying data. The App does not collect students’ first or last names, e-mail addresses, phone numbers, dates of birth, photos or location. The following is processed:

• a pseudonymous login (school code, class designation and an ordinal number) and a password (stored only as a cryptographic hash);
• class and school membership and the ordinal number within the class;
• access-recovery data: a chosen security question and a hash of the answer;
• avatar configuration (graphic elements from a closed library only — no photos);
• educational data created while using the App: budget entries (amounts, categories, expense classification, the accompanying emotion, optional notes), savings goals, lesson answers (encrypted on the server), quiz results, points, badges and activity events (e.g. activity streaks).

Mood journal entries (the mood of the day and its note) remain solely on the user’s device — their content is not sent to the servers; the server only receives the fact that activity was recorded on a given day.

Teachers, coordinators and school contact persons

• first and last name, e-mail address, phone number, position, school assignment;
• data of persons designated by the school as programme contacts.

Technical data (all App users)

• an App installation identifier (a random string generated on the device), a push notification token, platform and App version, language;
• crash and technical error reports (see section 5);
• offline synchronisation metadata (without the content of the data).

The Website

The finpath.likims.com website is a static, informational site: it uses no cookies, contains no analytics or marketing tools and collects no personal data, except for standard server logs (IP address, time and requested URL), kept for a short period for security and diagnostic purposes.

4. Purposes and legal bases of processing

• running the educational programme, including account management, educational features, rankings and class challenges — for teachers and coordinators: necessity for the performance of a contract or arrangement concerning the school’s participation in the programme (Article 6(1)(b) GDPR), and for students: the Controller’s legitimate interest in pursuing the statutory goals of the educational programme (Article 6(1)(f) GDPR);
• communication and user support, handling bug reports and requests — legitimate interest (Article 6(1)(f) GDPR);
• security, diagnostics and maintenance of the App, including crash analysis — legitimate interest (Article 6(1)(f) GDPR);
• compliance with legal obligations of the Controller (Article 6(1)(c) GDPR).

The App does not use data for advertising, does not profile users for marketing purposes and does not make automated decisions producing legal effects concerning them.

5. Data recipients and transfers outside the EEA

Personal data may be disclosed to the following categories of recipients:

• LIKI Mobile Solutions Sp. z o.o. — the data processor providing development, hosting and maintenance of the App (see section 1);
• Google (Google Ireland Ltd. / Google LLC) — solely for:
  • delivering push notifications via Firebase Cloud Messaging (the notification token and the notification content pass through Google’s servers),
  • collecting App crash reports via Firebase Crashlytics (technical information about the device and the crash).
  Transfers to Google LLC in the USA take place on the basis of the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework and standard contractual clauses. See the Google Privacy Policy for details;
• the server infrastructure provider (OVH) — the App’s data is stored on servers located in the European Union (Warsaw, Poland);
• entities authorised under applicable law.

All entities processing data on the Controller’s instructions, including LIKI and the infrastructure provider, operate under data-processing agreements (Article 28 GDPR) obligating them to protect personal data at least to the standard described in this policy.

Server-side error monitoring runs on self-hosted tooling on our own infrastructure, configured not to collect user-identifying data. The App contains no advertising SDKs and no third-party marketing analytics. Data is not sold.

6. How long we keep data

• account data — for the duration of participation in the programme; afterwards, or upon request, the account is irreversibly anonymised (see section 7);
• student credential sheets (login and temporary password) — single-download; the file is deleted from the server after it is downloaded;
• educational data (quiz results, activity statistics, budget entries) — for the duration of the programme; after account anonymisation it is kept solely in a form not linked to any person, for programme statistics;
• crash reports — kept for the period necessary for diagnostics, in line with the tools’ retention settings (at most 90 days in Firebase Crashlytics);
• server logs — short-term, for security purposes;
• backups — rotated automatically; data deleted from the system disappears from backups with their rotation cycle.

7. Account and data deletion

Users may request account deletion at any time — without needing to have the App installed. Account deletion consists of irreversible anonymisation: the login, the class and school assignment, registered devices and push tokens, access-recovery data and all active sessions are permanently removed — and for teacher and coordinator accounts also the first and last name, e-mail address and phone number. The detailed procedure is described at Delete account.

To the extent processing is based on consent, consent may be withdrawn at any time by writing to kontakt@trampkinagieldzie.pl; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

8. Rights of data subjects

Every data subject has the right to:

• access their data and obtain a copy of it,
• rectify (correct) their data,
• erase their data,
• restrict processing,
• data portability,
• object to processing based on legitimate interest.

Requests may be submitted to kontakt@trampkinagieldzie.pl. Students may also ask their coordinating teacher for help. Every data subject also has the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

9. Protection of minors

The App is aimed at secondary-school students and is not directed at children under 13 years of age (the word “children” in the Foundation’s name refers to its broader statutory mission, not to the App’s audience). The App has been designed around the principle of data minimisation:

• students appear in the App only under pseudonyms; rankings and class features do not reveal identifying data beyond the class community;
• the App contains no ads, purchases or sponsored content;
• the App collects no student contact details and no location data;
• a student takes part in the programme within their school’s participation, under the care of a coordinating teacher.

10. Data security

We apply technical and organisational measures appropriate to the nature of the data, including:

• encryption of data in transit (HTTPS/TLS) between the App and the servers,
• storing passwords only as cryptographic hashes,
• server-side encryption of the content of lesson answers,
• role-based separation of permissions (student, teacher, administrator),
• infrastructure located in the European Union and regular backups,
• data stored locally on the device (e.g. session tokens) protected by the system key store (Keychain/Keystore).

11. Changes to this policy

This policy may be updated as the App evolves. We will announce material changes in the App or on the Website with reasonable advance notice. The current version is always available at finpath.likims.com/en/privacy-policy.

12. Contact