Privacy policy

Website status: 25 October 2026 · app 9.3.102 / 246 · policy: revision 8

Status as of 25 October 2026: release 9.3.102 (246) is available through Google Play internal testing. Online recognition uses the secured R4 service; the old shared access token has been revoked. The owner confirmed correct number recognition and saved measurements on a physical phone after updating to release 244. Release 246 improves sheet-review guidance and PL/EN page labels without changing the scope of data processing. The policy below, dated 24 October 2026 (revision 8), also applies to release 246. References to 242 identify the release that introduced the stated safeguards. Download availability depends on membership of the relevant Google Play track, account country and device compatibility.

Controller and scope

Plaster Calculator (TynkPlan) for Android — privacy policy covering release 9.3.98 (build 242) and the secured OCR server. Document version: 24 October 2026, revision 8. The availability of individual features depends on the installed app version and activation of the relevant services. The controller for the online service and support is Dariusz Kuca, contact: jaroslawkuca33@gmail.com. Data entered in jobs remains under the user’s control. The app does not require a TynkPlan account, display ads or include Google Analytics.

Privacy on www.tynkplan.pl

This information website has no forms, advertisements, analytics scripts or payments. It does not receive job databases, OCR images or service keys. When a page is displayed, OVHcloud hosting receives ordinary connection data, such as the IP address, request time, page address, response status and browser information. These data serve page delivery, diagnostics and service protection, based on the legitimate interest in operating and securing the service. Technical logs are subject to OVHcloud hosting settings and policies. The hosting provider may also produce anonymised, aggregate visit statistics. These are not app reports or uploaded measurements.

The suggested language comes from your browser settings. After a manual PL/EN change, the website stores your choice in a tynkplan_lang cookie for 180 days (Secure, HttpOnly, SameSite=Lax). It is not an advertising identifier. OVHcloud hosting may additionally use a technical SERVERID cookie to route requests to a server; according to the hosting documentation, it expires in less than 24 hours. You can delete or block cookies in your browser; without a saved language choice, the website uses browser settings again. Opening an external link, such as Google Play or provider documentation, sends an ordinary browser request to that service, which applies its own policy. OVHcloud hosting documentation.

Scope of measurement recognition

The OCR described below concerns photos of written measurements. Version 9.3.92 removes the “Import floor plan” (“Wczytaj projekt”) feature for reading a floor plan. Manual measurements, measurement-photo import and Bluetooth measuring-device support remain available.

On-device data

Jobs, clients and suppliers, contact details, measurements, rates, dates, notes, site pins and selected photos are stored locally. Contact import uses a contact you select in the system. Camera and photo selection support documentation and OCR. Bluetooth supports measuring devices; older Android versions may require location permission for scanning. TynkPlan does not track GPS in the background. Data remain until you delete them or uninstall the app. Personal OCR API keys are held in protected device storage and excluded from exports. The controller’s Gemini key stays on the server; automatic access in this version contains no shared secret and requires Play Integrity verification.

Optional online photo recognition

Offline OCR processes images on the device. Online recognition is optional: after selecting a reader, consenting and tapping “Read text”, the selected photo is sent over HTTPS. Service access routes it through the TynkPlan server to Google Gemini. A personal profile may send it to Gemini, Google Cloud Vision, OCR.space or your configured server. The image may contain personal information visible on the page; cover unnecessary details. Purpose: transcribing measurements. Selecting a photo does not upload it. Checking the connection sends access information and an installation identifier without a photo. Verification may send the photo again to the same provider; comparison sends it to the two selected providers. No automatic switch to another service follows an error. Withdraw remembered OCR consent by unchecking it in the reading window; this does not reverse previous uploads.

Online access verification — Play Integrity

This section applies to the new service after activation. When reading through the TynkPlan service or manually checking its connection, the app asks Google Play to verify the app, its licence and device integrity. Google processes app and signing metadata, the Google Play account licence status and device integrity signals. The requestHash field contains only a request digest, not the photo or measurement text. The server verifies the proof with Google and binds it to that request. A used proof digest is stored with expiry after 5 minutes; actual Firestore TTL deletion is asynchronous. Proofs are not written to application logs. The purpose is security and quota protection, based on the legitimate interest in protecting the service. Access requires a current recognised Google Play build and successful device verification. Failed verification does not select another provider; manual entry, offline OCR and personal profiles remain available. Play Integrity terms and data handling.

OCR recipients and retention

The TynkPlan server uses Google Cloud and online recognition uses Google Gemini API. Server code processes the image and result in memory for the request; it does not store them in Firestore, files or application logs. This describes the app server, not a guarantee of no Google retention. According to the current abuse-monitoring documentation, Google retains Gemini API prompts, context and outputs for 55 days to detect and prevent policy violations, protect the service and meet required legal disclosures. Authorised Google personnel may review flagged content. This monitoring data is not used to train or fine-tune models other than models used for policy enforcement. Paid Gemini API does not use prompts and responses to improve products and requires an actively billed project. The server uses a Google project with active billing. Offering this API client in the EEA, Switzerland and UK requires Paid Services. The feature is for adult professional users. Cloud Run in Warsaw does not imply that Gemini or Crashlytics processing is limited to Poland or the EEA. Google may process data outside the EEA under its service terms and applicable transfer safeguards. We do not promise zero retention. Personal profiles follow the chosen provider’s terms and plan.

Counters and online reader protection

To protect service availability and control costs and abuse, the server stores recognition-attempt counters in Firestore: per-installation counters, short per-minute limits and service-wide daily and monthly totals. In version 9.3.98, the quota identity is a pseudonymous digest of the Android identifier scoped to the app, system user and device. The raw Android identifier stays on the phone. An upgrade may send the previous random installation identifier to preserve used quota; no telephone number is used. Legacy access codes use a tester identifier. Deleting data from the phone does not reset server counters.

The connection IP address is also used to derive a cryptographic HMAC identifier for a network and day. IPv4 uses the public address; IPv6 uses the /64 prefix; the Google verification budget additionally groups addresses by /56. The identifier includes the Europe/Warsaw day and a server-held secret, and changes between days. Security records contain this identifier, counts of requests and started reads, period markers, and additional installation hashes with their first-seen times for that network on that day. These records do not contain the raw IP, images, OCR text or client names. This is pseudonymous data, not anonymous data. Users sharing an internet connection may share a network limit, independently of their personal installation allowance.

A network record is marked to expire at Europe/Warsaw midnight after the day following the measurement day — approximately 24–48 hours after it is written. Firestore deletes expired records asynchronously, so actual deletion may happen later. Short counters for region and connection checks use bounded server-process memory in one-minute windows, without Firestore storage. These safeguards do not create a persistent first-use history of a phone across days.

Personal and service counters, attempt receipts needed for a single refund, and daily token totals are marked to expire approximately 30 days after the relevant day or month ends, with a small technical time-boundary offset and TTL deletion delay. Aggregate usage metadata, when supplied by the provider, includes counts of input, response and reasoning tokens and responses, without image content. It is not an invoice or an exact per-read charge.

For network failures or timeouts before receiving the provider HTTP response and provider HTTP 429 or 5xx responses, the server may refund a reserved personal attempt at most once. Not every incomplete or rejected result is eligible for a refund. Cost-protection and network counters are not rolled back because the call may already have incurred costs. Access blocks and credential hashes remain while in use or needed for abuse prevention; the controller reviews them monthly and deletes unnecessary data within 30 days after that purpose ends. Purpose and grounds: providing the requested service and legitimate interests in protecting costs and availability. Contact the controller for erasure or restriction requests; do not send an API key or access code.

Standard access allows up to 10 attempts per installation per day, within a shared pool of 175 daily and 2700 monthly attempts. A separate technical reserve of 30 daily and 300 monthly attempts is included in the total cap of 205/3000. Shared-network limits, load, provider restrictions or emergency suspension may restrict access sooner. Personal and daily network limits reset according to Europe/Warsaw; the message gives the reset time for the relevant restriction. The reserve does not bypass country restrictions or the global switch. We do not guarantee 10 successful readings every day. A cost alert threshold is not a guaranteed charge cap.

Protected verification allowance

After activation of the new service, the server may issue a signed, installation-bound credential for the protected allowance only after successful Google verification and successful photo recognition. A connection check alone neither issues nor renews a credential. The credential is valid for 7 days; renewal requires another successful reading and satisfaction of security conditions. Issuing new credentials is subject to a shared daily network limit. Reaching this limit does not discard an OCR result already obtained. Its records contain daily HMAC digests of the network and installation, expiring at the end of the Europe/Warsaw day plus 24 hours, with asynchronous TTL deletion. They contain no raw IP address, plain identifier, photo or measurement text. The phone stores it locally in encrypted storage backed by Android Keystore; it is excluded from measurements, PDFs, job backups and the WebView interface. It is sent only to the matching server when you request a reading or connection check. It does not replace a fresh Google verification or increase OCR limits. Deleting all data or forgetting all reader profiles removes it. Verified-installation attempt counters use a daily HMAC key with expiresAt set to the end of the Europe/Warsaw day plus 24 hours; TTL deletion is asynchronous. They contain counts without images, OCR text or plain installation identifiers. The fixed aggregate record retains at most 25 hourly buckets per pool and has no TTL. Purpose: protecting availability and limiting abuse and costs. A missing or expired credential uses the ordinary verification allowance within the same attempt, without uploading the image again. If that allowance is exhausted, access may have to wait for the limit to renew.

Technical server logs

Application failure logs contain allowed error codes, recognition stage, model and response status. Optional timing logs contain the model, statuses, provider and request-handler durations, response initiation and a cancellation flag. We do not add images, OCR text, IP addresses, installation/user identifiers or keys to these application logs. Server application timeouts start when request handling begins in the container; uploading or infrastructure buffering before that point can extend the phone’s total wait. Cancelling a connection or reaching a timeout does not guarantee that provider-side processing or billing stops.

Separately, Google Cloud infrastructure may record request metadata including the raw IP address, timestamp, service address, status and latency. Purpose: service operation and security. These are separate from Crashlytics reports. A check on 17 October 2026 confirmed 30-day retention of ordinary logs in _Default and 400-day retention of required audit logs in _Required. Both buckets have the global location setting; we do not claim storage exclusively in Poland or the EEA. The europe-central2 region applies to the Cloud Run server and Firestore database, and does not establish the location of logs or Gemini processing. Log access depends on IAM permissions. Deleting data from the phone does not automatically erase previously recorded Google logs.

Optional Firebase Crashlytics reports

Report upload is disabled by default. Give separate consent in the crash reports panel. Recipients: Google as Firebase Crashlytics provider, and Dariusz Kuca and authorised people with Firebase project access. Purpose: identifying and fixing faults and assessing stability. Scope: stack traces and errors, app state at a crash, app/OS versions, device model and technical metadata, Crashlytics/Firebase installation identifiers, and SDK session/stability data. Our custom reports use fixed error codes without jobs, contacts, photos, OCR text, API keys or Bluetooth addresses. We do not set client or user IDs in Crashlytics. Google states it retains crash traces and associated identifiers for 90 days before starting deletion from live and backup systems; this does not mean the entire process finishes exactly on day 90.

Withdrawing diagnostic consent

Withdraw consent by disabling reports in the same panel. “Delete all data” also disables uploads and instructs the SDK to delete unsent reports. Restart the app afterwards. The SDK may store crash information locally even while upload is disabled. Enabling consent may also upload reports previously stored locally. Deleting local reports does not delete reports previously delivered to Firebase; Google’s retention applies. Contact the controller about your rights or earlier erasure; the controller may refer the request to Google. Withdrawal does not affect the lawfulness of earlier processing.

Other functions and measuring-device diagnostics

NBP receives public exchange-rate requests without job data; the latest rates are stored locally for offline use. Reminders are local. Opening a map passes the selected location to Google Maps or your browser. When you request an address from a site pin, the app passes the selected coordinates and, for a short Plus Code, the locality name to the system Android Geocoder service. The service may use the network; its provider depends on the device. The purpose is to fill in the job location. This feature does not obtain the phone’s current GPS position or transfer the entire job database. Review the result before saving. Preparing an SMS opens your messaging app; you approve sending the number, order text, location and signature yourself. A local HOTO report may include Bluetooth names and addresses, services, packets and entered readings. It is not uploaded automatically or included in job backups; clear it in diagnostics or by deleting all data. Email support processes what you voluntarily send; correspondence is deleted within 12 months after closing a request unless law requires longer retention. A local FNIRSI report contains Bluetooth channel inventory, read statuses, measurement packets and test markers, without client names or the meter Bluetooth address. Only the latest 300 events are held in app memory; older events are discarded. Reports are exported only at your request, without automatic upload. Ending the app process or deleting all data clears this buffer; previously exported copies remain separate.

Region, materials and migration

System language settings are used locally to propose PL/EN language, country, units, currency and number format. This does not use GPS or IP-based country detection. You confirm the choices. Each job retains its settings, price basis and selected product/price snapshot. Changing defaults does not convert existing jobs. Opening a manufacturer documentation link sends a normal browser request to that service, without the job database.

Before the first regional migration, the app stores and verifies a copy of the previous database in its private directory. This copy excludes separate photo files and does not replace a full ZIP backup. ZIP restoration writes photos under fresh keys; older files may remain locally to protect against interruption. Migration copies and retained photos contain earlier job data even after ordinary editing or job deletion. “Delete all data” removes them; previously exported files remain separate. None of these copies is uploaded automatically.

Backups and export

A ZIP backup contains job data and saved photos, including client details, notes and documentation. ZIP and JSON exports are not encrypted or password protected. Store them in a protected location and share deliberately. Exported files are separate copies under the selected recipient’s or storage service’s control. This Android version disables system cloud backup and explicitly excludes app data from device-to-device transfer. This does not erase earlier backups or previously exported files. Phone manufacturers’ services and tools may have separate rules. Documentation photos are not automatically included in customer quotation PDFs.

Deletion and rights

Settings let you delete all jobs, clients, settings, app-stored photos, local device reports and temporary files. This removes personal OCR profiles and remembered photo-upload consent, disables crash uploads, and queues deletion of unsent SDK reports. Service access may be configured again locally, but uploading a photo requires renewed consent and a user action. It does not erase gallery originals, sent files, external backups or data already received by providers. The identifier used to enforce limits is excluded from exports. Older releases keep a random identifier in protected storage; release 9.3.98 uses the pseudonymous Android identifier digest described in the counters section. Deleting app data does not reset server-side usage. Partial deletion failure is reported and can be retried. Deleting a client does not change their historical snapshot in a retained job — also edit or delete that job. Where applicable, you may request access, correction, erasure, restriction, portability or object to processing. Contact the controller about data sent to them. You may complain to the Polish supervisory authority, the President of UODO. Processing grounds depend on the function: consent for optional diagnostics and OCR uploads, providing the requested service and legitimate interests in protecting limits and handling support.

Brands and rights

Google, Gemini, Firebase, HOTO, FNIRSI, Leica, Bosch and other manufacturers’ names describe services or device compatibility for information only. They imply no partnership, authorisation or endorsement. © 2026 Dariusz Kuca — rights in original TynkPlan elements. Manufacturers retain rights to their names and marks, and libraries retain their code rights and separate licences. Dariusz Kuca’s rights notice does not limit rights granted under library licences; their texts are available under “Third-party licences”.

Firebase privacy and retention · Gemini API terms · Gemini API abuse monitoring and retention · Gemini retention documentation (ZDR not claimed) · Google Cloud privacy · Google processor terms · OCR.space privacy · Google privacy

Availability and client data

Google Play availability does not imply that every OCR provider is available in that country. Online recognition is subject to the provider’s current territorial restrictions and terms; we do not promise support in every market. Users entering their clients’ information are responsible for having authority to process and send it to OCR. Controller and processor roles depend on the particular use and agreements; this policy does not replace a required processing agreement or transfer assessment. If the appropriate basis is missing, use manual measurements or offline recognition and do not upload client data. Local law may provide additional rights; send requests to the contact address above.

Regional Gemini availability

Before Gemini recognition, the server estimates the connection country from its IP address using a local DB-IP Country Lite database. This also applies to personal Gemini profiles: the app first checks eligibility with the TynkPlan server, without the photo or API key. No GPS permission is used. The IP and eligibility result are processed in memory; we keep no separate location history and do not send the IP to DB-IP. Ordinary Google Cloud request logs may contain IP addresses as described above. The purpose is to enforce provider territorial restrictions. An unsupported or unknown country, or an outdated eligibility configuration, blocks Gemini before any API call. Manual measurements and offline OCR remain available. IP geolocation is approximate, depends on the network exit and may be inaccurate; it is not used for tracking. The country selected for a job does not change Gemini eligibility. IP Geolocation by DB-IP, database licensed under CC BY 4.0. Current Gemini regions.

Local data recovery and Bluetooth — 11 October 2026 update

From release 9.3.51, the app stores its database in private files, checks that writes completed, and retains the previous state. Migration from the older store retains a local migration copy; a full database replacement during import also saves the pre-import state. These copies can contain earlier customer details, jobs and measurements, including records removed from the current database. They remain on the device until the corresponding copy is replaced, you use “Delete all data”, or uninstall the app. They do not contain separate photo files and do not replace your own ZIP backup. Emergency JSON exports are not encrypted.

HOTO authentication keys are stored locally, encrypted using Android Keystore. This may include a pending key and the last successfully verified key. Keys are not included in job backups, PDFs or diagnostic reports. “Delete all data” removes these local keys and saved Bluetooth associations. It does not remove associations in Xiaomi Home or the manufacturer account. Rangefinder operation does not send measurements to the TynkPlan server.

Optional HOTO binding through Xiaomi — 13 October 2026

You may approve sign-in on Xiaomi’s website in an external browser. TynkPlan does not receive the username or password entered in that form. The phone contacts Xiaomi directly, without a TynkPlan server. The temporary Xiaomi session provides access to account data, but the app uses it only to read homes and devices in the selected region and HOTO bindings. The API may return other devices; the app discards them without saving and shows only supported HOTO meters and a masked account number. You select the meter yourself.

The session and retrieved keys remain in memory for at most 3 minutes and are discarded on cancellation, error or completion. Only the selected HOTO key is saved in protected phone storage after verification with the meter. They are excluded from ZIP backups, PDFs, reports and TynkPlan servers. The browser may retain Xiaomi cookies and history, including a short-lived sign-in request link; TynkPlan does not clear them. This is an unofficial connection that Xiaomi may change or block. Manual import remains a fallback. This function does not reset or re-pair the meter.

Local data deletion — 14 October 2026 update

“Delete all data” removes jobs, local photos, private reader profiles, HOTO keys and remembered photo-upload consent. Service access included in this version may be configured again locally; no photo is uploaded without renewed consent and a user action. “Disconnect reader” remains a separate, intentional way to disable automatic access. The pseudonymous installation identifier and abuse counters are not reset by local data deletion. ZIP backups contain no private keys or remembered OCR consent.