Privacy Policy

Last updated: June 2026 · Version 1

1. Who We Are

Settle Fairly (“we”, “us”) is the data controller responsible for your personal data. The controller is Iván Barták, a sole trader (egyéni vállalkozó) established in Hungary (registration no. 55610025; tax no. 56906851-1-41), at Belgrád rakpart 22, 2nd floor / door 1, 1056 Budapest, Hungary.

For any privacy question or to exercise your rights, contact us at privacy@settlefairly.com.

2. What We Process

We collect only what is needed to run the service. We do not collect your real name, email address, or phone number.

• Session content:the problem descriptions, answers, notes, debate entries and other text you submit inside a room or debate. This is encrypted (see section 3).
• Account & device data:an anonymous account identifier (generated on your device and synced via your iCloud Keychain), a device-attestation identifier used to verify the request comes from a genuine app install, and your operating-system and app version. These do not identify you by name.
• Notification data:if you opt in to notifications, a push token (iOS) or a web-push subscription endpoint, used solely to deliver session notifications.
• Consent record:the version and date on which you accepted this policy and our AI-processing notice, kept as proof of consent.
• Usage & entitlement data:counts of how many AI features you have used and your purchase tier, used to enforce plan limits and prevent abuse. These are aggregate counts, not the content of your sessions.
• Website cookies:see section 9.

3. How Your Content Is Protected

All session content is encrypted at rest using strong, industry-standard authenticated encryption. The keys are held only on the participants' devices and in the private invite link, and are never stored on our servers.

Because the AI analysis runs on our servers, your input has to be readable there for the brief moment it is processed: your device supplies the keys, the server decrypts your input in memory only, produces the result, and writes everything back encrypted. We never store your keys or your unencrypted content on disk, and your raw input is passed onward only to our AI processor (see section 5).

We protect content at three levels, depending on how sensitive it is:

• Shared:content meant for both parties (such as the neutral summary or a debate verdict) is readable by both participants.
• Private:your personal notes and your half of an analysis are unlocked only by your own key.
• Raw & sealed:your original, unedited words can be unlocked only with every participant's key at once, and each person's key lives only on their own device. Reading them would require both a breach of our stored data and obtaining every participant's separately-held key, never any one of these alone.

Two further safeguards limit exposure: each field is encrypted under its own separate key, so compromising one never unlocks another; and the data is short-lived: double-blind debate answers are erased from our servers as soon as they are evaluated, and all session data is permanently deleted after 30 days of inactivity.

Because the keys live only on devices, if all participants lose their keys (for example by uninstalling and losing their backup), the sealed content becomes permanently unrecoverable, by design. We do not maintain a master key or backdoor.

4. Why We Process It & Our Legal Basis

Purpose	Legal basis (GDPR Art. 6 / 9)
Delivering the conflict-resolution service you requested, including the AI analysis	Performance of a contract (Art. 6(1)(b))
Processing any sensitive details you choose to include (e.g. about health or relationships)	Your explicit consent (Art. 9(2)(a)), captured before any AI processing
Sending notifications	Your consent (Art. 6(1)(a))
Verifying genuine app installs, enforcing limits, preventing fraud and abuse	Our legitimate interests (Art. 6(1)(f))
Handling purchases and complying with law	Contract / legal obligation (Art. 6(1)(b), 6(1)(c))

You can withdraw consent at any time (see section 10). Providing session content is necessary to use the core service; without it we cannot generate an analysis.

5. AI Processing

To turn what you share into useful insight, your input is processed by Google's generative-AI service, acting strictly as our data processor, under a contract that prohibits using your content to train its models. This processing may take place in the United States (see section 7). Your input is not retained by the provider for its own purposes and is not used for advertising. We do not disclose the specific model used, which may change over time.

The AI produces advisory analysis and suggestions only. It does not make any decision that produces legal or similarly significant effects about you, so this is not “automated decision-making” within the meaning of GDPR Art. 22. You decide what to do with the output.

Before any content is sent for AI processing, the app asks for your explicit agreement. Because the provider cannot un-see what it receives, please leave out, or change, any detail you would not want processed.

6. Who We Share Data With

We do not sell your data or share it for advertising. We use a small number of service providers (processors) who act only on our instructions:

• Google:generative-AI processing (see section 5).
• Apple:app distribution, in-app purchases, and push-notification delivery. Apple handles all payments; we never receive your card details.
• DigitalOcean:secure hosting and storage of the encrypted data, located in Amsterdam (EU).

We may also disclose data where required by law.

7. International Transfers

Your session content and account data are stored within the European Union (our hosting is in Amsterdam). The AI processing described in section 5 may take place in the United States. For that transfer we rely on appropriate safeguards: Google is certified under the EU-US Data Privacy Framework, and we additionally rely on the European Commission's Standard Contractual Clauses. No other transfers outside the EEA take place except where a provider's limited supporting functions require it, under the same safeguards.

8. How Long We Keep It

• Session content is automatically and permanently deleted from our servers 30 days after its last activity. Each action resets the 30-day clock, so an in-progress session is never deleted mid-use; once it concludes (or, for a guided session, after its last follow-up) deletion follows 30 days later. Double-blind debate answers are deleted as soon as they have been evaluated.
• Your own device. These timelines apply only to the copy on our servers. Content that is also stored on your device (and any PDF you export) stays under your control and is removed when you delete it there.
• Account, device, consent and usage data are kept while your account exists, so the service keeps working across your devices and plan limits stay accurate.
• When you delete your account we erase your sessions and your device record. We retain only an anonymous identifier and an aggregate count of free-tier usage no name, email, content, or device data so that deleting and recreating an account cannot be used to reset free-allowance limits. This minimal record carries no information that identifies you.
• You can trigger deletion at any time (see section 10).

9. Cookies

The mobile app does not use any analytics, advertising, or tracking technologies. This website uses only strictly-necessary cookies (for example, to remember your cookie choice). We do not use Google Analytics or any third-party tracking or advertising cookies.

10. Your Rights (GDPR)

You have the right to: access your data; have it corrected; have it erased; restrict or object to its processing; data portability; and withdraw consent at any time (without affecting processing already carried out). Because we hold no name or email, deleting a room erases its content immediately, and you can ask us to erase your account and associated data by contacting privacy@settlefairly.com.

We will respond within one month. If you believe we have mishandled your data, you have the right to lodge a complaint with your local data-protection authority. Our lead supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, naih.hu).

11. Age

Settle Fairly is intended for people aged 16 and over, and is not directed at children under 16; we do not knowingly process the data of anyone under 16. The app does not match or connect strangers. A session can only be joined by someone you invite directly (for example by sharing a link or QR code in person or through a channel you already use).

12. Changes to This Policy

If we make material changes, we will update the version and date above and, where required, ask you to re-accept before further AI processing.

13. Contact

Questions about this policy or your data: privacy@settlefairly.com. General support: support@settlefairly.com.