Skip to content
Colour theme
Download

Privacy Policy

Version of September 29, 2026

In short

  • There are no accounts: we never ask for your name, email or phone number.
  • Your notes, photos, chosen institution and group, favorites and settings stay on your device only.
  • Our server receives a random installation identifier, the app version and device details, your IP address (not stored in the database) and de-identified events about how the app is used.
  • The app has no ads, no advertising identifier, no location access and no third-party SDKs for analytics, advertising or crash reporting. We do not sell data or share it with third parties.
  • The poranaparu.com website sets no cookies and loads no visitor counters or third-party scripts.
  • The server and its backups are located in Russia.

1. Who processes the data

The data controller («operator» under Russian law) is Danil Andreevich Zablotsky, an individual and the developer of the «Pora na paru» app («we», «us»). This policy covers the «Pora na paru» mobile apps for iOS and Android («the app»), the server they get the schedule from, api.poranaparu.com, and the poranaparu.com website («the website»).

For any question about your data, contact us at contact@poranaparu.com or on Telegram @poranaparu.

2. What stays on your device only

This data is kept in the app's storage on your device, is never sent anywhere, and we never receive it:

  • your chosen institution, role and group;
  • notes, their text and attached photos;
  • favorites, recently opened items, appearance, reminder and notification settings;
  • the saved schedule and directories (a copy of the server's public data);
  • technical details about crashes that the app records itself.

Reminders, widgets and Live Activities are built on the device from the saved schedule and send nothing. Photos for notes, taken with the camera or picked from the gallery, stay on the device unless you share them yourself through the system share sheet.

3. What our server receives

Installation identifier. A random number (UUID) the app creates on first launch and sends with every request to the server. It is not linked to your name, phone number, Apple or Google account, advertising identifier or device hardware. Reinstalling the app or resetting its data creates a new identifier.

App and device details, from the header of every request: platform (iOS or Android), app version and build, operating system version, device model.

Request log. For each request to the server: the time, which part of the API was requested (the address pattern without specific values), the institution and the kind of schedule (group, teacher, room and so on), the response code and size, and the processing time — together with the installation identifier and the app and device details.

App usage events — from a closed list only:

  • the app was launched;
  • initial setup was completed;
  • the institution was changed;
  • a note was created — the fact only, never its text;
  • a screen was opened — the screen's name from a fixed list;
  • the saved schedule was shown instead of a fresh one because there was no network;
  • notifications were turned on.

Each event carries its time, the installation identifier, the platform and the app version. Event parameters come only from fixed lists: nothing you type can end up in an event.

IP address. It inevitably arrives with any network request. We do not write it to the database. It is used in the server's memory to limit the rate of requests, and it reaches the server's technical logs only truncated: the last part of the address is hidden (the last of four blocks for IPv4, everything after the first 48 bits for IPv6).

The server's technical logs contain the full request address, the installation identifier, the app and device details and the truncated IP address. They are used to find errors and to fend off abuse.

4. The website

The website needs no sign-up. It sets no cookies and loads no visitor counters, ads or other third-party scripts. The light or dark theme you choose on the website is kept only in your browser and is never sent to the server.

Like any request to the server, opening a page of the website is recorded in the server's technical log: the time, the page's address, the response code, the headers your browser sends (for example, its name and version, your preferred language and the address of the page you came from) and the truncated IP address — just as described in section 3. The log is kept for 14 days.

Once a day the log is summarised into visit totals: how many times each page was opened, in which language, from which website (its domain only), whether by a person or a search engine's robot, and the response code. The totals contain no IP address, no browser details and no full address of the referring page; they cannot identify a visitor.

5. Why

  • Analytics — to understand how many people use the app, on which versions and devices, for which institutions, which screens they use, whether they finish the initial setup and how often they are left without a network. This tells us what to improve.
  • Operating and securing the service — to limit how often one installation and one address may send requests, to protect the server from overload and abuse, and to find and fix errors.

We do not use the data for advertising, do not build user profiles, and do not try to identify the person behind an installation: by design, the server cannot link an installation identifier to a person.

6. What the app does not have

  • sign-up or accounts;
  • location access;
  • ads or an advertising identifier;
  • third-party SDKs for analytics, advertising or crash reporting;
  • access to contacts, calendar or microphone;
  • selling data or passing it to advertisers or data brokers.

7. Third parties

We do not share the data we collect with third parties. We may disclose it only when required to by the laws of the Russian Federation.

The building map. The screen of a campus building shows a map:

  • Android — map tiles are loaded through our server (tiles.poranaparu.com), which fetches them from OpenFreeMap (OpenStreetMap data). The request contains only the coordinates of the map tiles around the building, taken from the public directory. OpenFreeMap sees the address of our server, not of your device; neither the installation identifier nor your location is sent there. Earlier versions of the app load the tiles directly from tiles.openfreemap.org — then, as with any network request, OpenFreeMap receives the device's IP address.
  • iOS — the map is shown by Apple's built-in service (MapKit, Apple Maps); requests to it are handled under Apple's privacy policy.

Crash reports from Apple and Google. If you allowed sharing diagnostics with developers in your device settings, Apple (App Store Connect) or Google (Google Play Console) may show us aggregated crash and performance reports for the app. They are collected by the device's operating system under Apple's and Google's rules, not by the app itself, and contain no installation identifier.

When you open an address in a maps app, write to us on Telegram or by email, or go to an app store, those services' own terms apply.

Hosting. The server and backups are hosted by the Russian hosting provider Timeweb Cloud. The provider supplies the hardware and does not use the data stored on it.

8. Where and for how long

All server data is stored in Russia: the server is at Timeweb Cloud in Moscow; database backups are in Timeweb Cloud storage in Saint Petersburg.

  • Request log — 90 days.
  • App usage events — 13 months from receipt.
  • After these periods the records are deleted. Only daily totals without installation identifiers remain: how many installations there were per platform and version, per institution, and how many of each event. They identify neither an installation nor a person.
  • Server technical logs — 14 days.
  • Backups — up to 30 days.

9. Security

  • The app talks to the server only over encrypted HTTPS; unencrypted connections are forbidden in the app itself.
  • IP addresses are not stored in the database, and appear in logs only truncated.
  • Only the operator has access to the server and the data.
  • Data on the device is kept in the app's private storage, which other apps cannot read.

10. Your rights and deleting data

  • Data on your device is deleted by the reset in the app (the «Profile» tab → reset data): it erases your chosen institution, notes, favorites and recents, and creates a new installation identifier. Uninstalling the app deletes everything it keeps on the device.
  • Data on the server is deleted on request: write to contact@poranaparu.com, and we will tell you what was deleted. Technical logs and backups are cleared only when their periods run out — 14 and 30 days.
  • You have the right to know what data about you we process, to have it corrected, blocked or deleted, and to complain about our actions to Roskomnadzor (the Russian data protection authority) or to a court. Send requests to the same address; we answer within the time limits set by law.

11. Children

The app is made for students and is not intended for children under 16. We do not knowingly collect data from children and do not ask for anyone's age. If you believe we have received a child's data, write to us and we will delete it.

12. Changes to this policy

A new version is published on this page with a new date at the top. If what data is collected, or why, changes, we update this policy before the change reaches the app.

This policy is published in Russian and English; if the two differ, the Russian version prevails.