Privacy Policy

Privacy Policy for the PolarBear Footprint mobile app

Last updated: October 7, 2026

Operational notice under review: actual retention periods, active providers and legal bases must be confirmed before final legal approval.

Privacy by Design

This page governs privacy for the PolarBear Footprint mobile app. For website privacy, see /website-privacy.

How the PolarBear Footprint app works

PolarBear Footprint estimates the environmental impact of daily habits (food, transport, energy, and purchases) and displays it in kg of CO2 equivalent per day.

Estimates are based on scientific factors derived from EXIOBASE 3 and peer-reviewed literature (Nature Food, Science). Users log daily variations against their personal baseline and the app calculates incremental impact.

Personal calculations stay on your device. Sharing features send the data they need to the backend: Research requires a separate opt-in, as does usage telemetry. Personalized advice may send structured data to the AI service when you request it. Some features may request location.

When you request AI advice, the backend may send structured baseline and behavior data to the configured provider (Gemini or Mistral) to generate a response. Free-text notes and AI history are removed before caching and provider transmission. The app currently has no separate AI consent control: the actual provider, legal basis, transfers and retention still require legal review. This data is not described as anonymous.

Research sharing is optional and must be explicitly enabled. Uploads send selected behavioral records with persistent pseudonymous user/device IDs, approximate location and available organization, QR and scan references. Data are not anonymous at ingestion; outputs are classified and protected according to dataset type and access rules. You can revoke consent in Settings.

PolarBear is free, without advertising, and does not sell personal data.

1
Data controller

Data controller: Andrea Perniciano, Piazza Italia, 30 - Magnago (MI) - Italy

Privacy contact: privacy@polar-bear.app

2
Data not required to use the app

  • name, surname, email or other personal identifiers to use the app
  • phone number
  • payment data
  • behavioural profiles for advertising purposes
  • biometric data

3
Collected data and purposes

1. Pseudonymous app and device identifiers

Purpose: link research records, usage sessions and, where present, organization and QR-scan data. A persistent UUID and device ID may be sent to the backend: these are pseudonymous identifiers, not anonymous data.

Legal basis: research uploads and app-usage telemetry require separate in-app consents. The legal basis for other operations must be specified by purpose in the legally approved notice.

Retention: local identifiers remain on the device until deletion/reset. A retention period for research records held by the backend must be formalized before the final legal notice.

2. Behavioral data for research (opt-in)

Purpose: analyze estimates and reported behaviors, including baselines, check-ins and variations. The Research workbook contains behavioral categories and may include text from Notes, From, To or Description fields, as well as trip origins/destinations. Actual contents depend on data saved in the app. AI history is excluded from AI requests; that is separate from Research uploads. The data is not anonymous at upload.

Research consent is separate from telemetry and can be withdrawn in Profile or Settings. The backend confirms withdrawal after already-authorized submissions finish; after confirmation, it stores no new data under that consent. Withdrawal does not erase existing records: use “Delete all my data” to request erasure. Offline, new uploads stay disabled while the app retries revocation.

3. Location and geolocation

The app may request location permission to resolve city and area through BigDataCloud. The reverse-geocoding request sends coordinates to this provider.

Coordinates sent to BigDataCloud for reverse geocoding are precise; coordinates in Research payloads are rounded to one decimal degree (about 11 km) and may include city, region, country and timezone. If OS permission is denied or cannot be verified, the location cache is cleared. If permission remains active but a fresh fix is unavailable, the app may reuse the last stored location. Withdrawing permission does not retract data already sent.

4. Push-notification token

If the user grants OS permission and enables notifications, the push token is sent to the backend with the device pseudonymous identifier, platform and app version. Turning notifications off requests removal of the token and internal copies; messages already delivered or in transit through the push provider cannot be recalled.

5. Pseudonymous app-usage telemetry

The backend records the consent timestamp and text version against a salted hash of the subject identifier. It rejects events without a valid record or with a mismatched version; this technical record does not independently prove which person gave consent.

Raw events are automatically deleted after 90 days. Research aggregates are calculated on request from those events and are not stored in a separate table. Retention for backend subject records and consent metadata is not configured and must be formalized before this notice is finalized. On revocation, the app stops collection, clears the local queue and asks the backend to delete the subject and associated events.

4
Data sharing with research institutions

  • Public aggregates: group indicators with cells below k=5 suppressed.
  • Minimized event-level exports: protected endpoint, ephemeral token, reduced time/location and k=5 suppression.
  • Pseudonymized longitudinal exports: stable token, personal data, administrator-controlled endpoint with DPA reference.

Event-level and pseudonymized exports are not a self-service researcher offering. External access is not automatic: purpose, eligibility, anti-reidentification safeguards and applicable agreements require documented review. Operational procedures must be formalized before third-party access is offered.

5
International transfers

Research data are sent to PolarBear’s Analytics backend. Coordinates used to resolve location are sent to BigDataCloud; push tokens are processed by services required to deliver notifications.

Actual hosting locations, processor legal entities, transfers outside the EEA and safeguards must be confirmed in the processor/subprocessor register before this notice is finalized.

6
User rights

  • Access
  • Erasure (in app: Settings → Delete all my data). The app reports the outcome for each component and allows incomplete operations to be retried; a partial result is not confirmation that all data were erased.
  • Restriction and objection
  • Withdrawal of consent
  • Complaint to the competent authority

Contact for exercising rights: privacy@polar-bear.app

Privacy Contact

For privacy or GDPR requests, contact us at:

privacy@polar-bear.appContact