HalfPast Privacy Policy

Effective date: 26 October 2026
Published at: https://planner.halfpast.io/privacy

This policy explains what personal data the HalfPast student planner app ("HalfPast", "the app", "we") handles, why, where it goes and what you can do about it.

1. The short version

• Your planner lives on your phone. You can use HalfPast without an account. Then your timetable, tasks, grades, notes, recordings and files stay on your device. They leave it only if you export or back them up yourself.
• An account is optional. If you sign in, we sync your planner to Google Firebase servers in the EU so it is backed up and available on your other devices.
• AI features run only when you use them. They send the content you choose to Google's Vertex AI (Gemini). Google does not use it to train its models.
• Analytics and crash reports are off until you agree. They never include the content of your planner.
• You can export everything and delete everything at any time, in the app.
• The Free plan shows a few ads (Google AdMob), personalised only for adults who agree. Plus has none.
• We don't sell your data, and the content of your planner is never used for ads.

2. Who is responsible

The controller of your personal data is:

Sergiy Bondarev, IČO 23604280
Bachmačská 691, 280 02 Kolín, Czechia
Email: privacy@halfpast.io

Contact us at privacy@halfpast.io with any privacy question or request.

3. What data we handle, and why

3.1 Data stored only on your device (no account)

Everything you enter stays in the app's private storage on your phone. This includes:

• subjects, teachers, timetables, lessons and terms;
• tasks, exams, events, grades, attendance and notes;
• lecture recordings and transcripts;
• scanned pages, photos and attached files;
• practice tests, focus sessions and settings.

We have no access to it.

Android's own device backup (Google One / Android backup) may include the app's settings. That backup is governed by your Google account settings, not by us.

• If you allow it, the app reads your device calendars to show or import events. This happens on the device; calendar data is not uploaded unless you import it into the planner and sync is on.
• The app records audio only when you start a recording, using the microphone permission.

3.2 Account and cloud sync (optional)

If you create an account, we process:

Keeping recordings off the cloud. You can mark any recording "Audio stays on this phone". Its audio file is then never uploaded.

Where your synced data is stored:

• Cloud Firestore in europe-west3 (Frankfurt, Germany);
• Cloud Storage for files, in the EU;
• server functions in europe-west1 (Belgium).

3.3 AI features

The AI features are:

• turning lectures into notes;
• generating practice tests;
• reading scans;
• reading a timetable from a photo;
• understanding a quick-add sentence when the app can't parse it on the device.

When you use one, the content you selected is sent to Google Vertex AI (Gemini) through Firebase AI Logic. That content can be audio, transcript text, note text, an image or a sentence. Google processes it as our processor to produce the result. Under Google Cloud's terms, Google does not use this data to train its models. The result is returned to your device.

AI features start only after you turn them on in Settings → Privacy, and then only when you tap them. Below the digital-consent age, they also need a parent's confirmation (see section 6).

To enforce plan limits, we keep a count of AI usage per account (or per app installation, if you are not signed in): the feature, the units used and the time. We don't keep the content.

• Legal basis for AI features: your consent (Art. 6(1)(a)), which you can withdraw at any time in Settings → Privacy.
• Legal basis for the usage count: contract (Art. 6(1)(b)).

3.4 One-time free trial ledger

The free AI allowance is a one-time trial. Deleting an account and signing up again would otherwise give a new trial. To prevent this, when you delete your account we keep only the number of trial units already used. We store that number under an irreversible, salted cryptographic hash (HMAC-SHA256) of your sign-in identities: the Google or Apple account ID and your verified email address.

• We don't store your email, name or account ID with it.
• The hash can't be turned back into them without a secret key held only on our server.
• If you sign up again with the same identity, your remaining trial is what was left before. Nothing else is restored.

This ledger has a legal basis of legitimate interest (Art. 6(1)(f)) in preventing abuse of the free trial. It contains no content and cannot be used to contact or profile you. You may object at privacy@halfpast.io; see section 8.

3.5 Subscriptions and purchases

Plus subscriptions and AI credit packs are bought through Google Play. Google processes the payment. We never see your card details.

We receive a purchase token, the product, its status (active, renewed, cancelled, refunded) and dates. We verify them with Google Play to unlock Plus or add credits to your account.

• Legal basis: contract (Art. 6(1)(b)).
• We also keep purchase records as long as tax and accounting law requires (legal obligation, Art. 6(1)(c)).

3.6 Analytics and crash reports (only with consent)

These are off until you agree. You can switch each one on or off at any time in Settings → Privacy.

• Analytics (Google Analytics for Firebase). We count events such as "task created", "onboarding completed" or "AI feature used" to understand which features help. We never send planner content: no subject or task names, notes, grades, recordings or other text you typed.
• Crash reports (Firebase Crashlytics). When the app crashes, it sends technical data: device model, OS version, app version and the stack trace.

Legal basis: consent (Art. 6(1)(a)).

3.7 App integrity and updates

• Firebase App Check (Google Play Integrity) verifies that requests to our servers come from a genuine copy of the app. Legal basis: legitimate interest in security.
• Firebase Remote Config tells the app the minimum supported version, so we can ask you to update when an old version would break your data. It sends technical identifiers only. Legal basis: legitimate interest.

3.8 Ads (Free plan only)

The Free plan shows a few ads, served by Google AdMob. Plus has no ads.

• Your choice first. Where the law requires it (for example in the EEA, the UK and Switzerland), the app asks for your choice through Google's consent tool before any ad loads. You can change it at any time in Settings → Privacy → Ad choices.
• Personalised ads are shown only to users aged 18 or over who agree. Everyone else gets non-personalised ads, based on the context only. If you are under 18, or we don't know your age, every ad request is also marked as child-directed and under the age of consent, which limits what Google may collect and show.
• What AdMob receives: your device's advertising ID, your IP address (used for approximate location), device and app information, and how you interact with ads. You can reset or delete the advertising ID in your Android settings. The content of your planner (timetable, tasks, grades, notes, recordings, files) is never shared with AdMob.
• For personalised ads, Google decides how it uses this data as an independent controller: see how Google uses information from apps that use its services at https://policies.google.com/technologies/partner-sites.
• Legal basis: your consent (Art. 6(1)(a) GDPR and the ePrivacy rules) for personalised ads and for accessing information on your device where consent is required; otherwise our legitimate interest (Art. 6(1)(f)) in funding the free plan with non-personalised ads. Choosing Plus removes ads entirely.

3.9 Class groups (optional, account and your consent required)

If you create or join a class group, other members of that group see the display name you choose for it and the posts you write there (homework, exams, events, announcements). Nothing else about you or your planner is shared: no email address, account identifier, grades, tasks or timetable unless an admin publishes a group timetable. Group data is stored on Google Firebase servers in the EU. If you leave a group, your membership is removed. If you delete your account, you leave all groups and your posts stay for the other members as "Former member", with no link to you. Reporting a post sends us the report text and your account identifier so we can review it. Group features need your consent in the app, which you can withdraw by leaving your groups.

4. Recordings: your responsibility

HalfPast lets you record lectures and classes. Recording other people may require their consent, or may be forbidden by your school or by local law. You are responsible for:

• getting any permission you need, from the lecturer, the other participants and the institution;
• using the recordings only for your own study.

When you sync a recording, we store it for you as part of your planner. We don't listen to it, share it or use it for anything else. AI processing happens only when you ask for notes.

5. Who receives your data (processors)

We use these service providers. They process data on our behalf, under data processing terms:

Some of these Google services may process data outside the EU/EEA, for example in the USA. Such transfers rely on:

• the EU–US Data Privacy Framework (Google is certified); and/or
• the European Commission's Standard Contractual Clauses.

We don't sell or rent personal data, and we don't share it with anyone else except where the law requires it.

6. Children and teenagers

HalfPast is for students, including school students. When you start the app, it asks for your year of birth.

If you are under the digital-consent age for your country, the app works like this:

• analytics and crash reports stay off;
• AI features need a parent's or guardian's confirmation before they can be switched on;
• ads are non-personalised and child-directed (this applies to everyone under 18).

The digital-consent age is 16 in most of the EU (13 to 16 depending on the country), 13 elsewhere, and 16 when we can't tell your country.

If you are below the age at which you may agree to these terms yourself, a parent or guardian must agree for you.

If you are a parent and believe your child has given us data without the consent the law requires, contact privacy@halfpast.io and we will delete it.

7. How long we keep data

8. Your rights

Under the GDPR and similar laws you have the right to:

• access your data, and get it in a portable format: Settings → Backup & restore → Export backup;
• correct it: edit it directly in the app;
• delete it:
• Settings → Account → Delete account removes the account and all cloud data;
• uninstalling the app or clearing its data removes the local copy;
• withdraw consent at any time, for AI, analytics or crash reports, in Settings → Privacy. This does not affect processing that already happened;
• object to processing based on legitimate interest, such as the trial ledger;
• restrict processing;
• lodge a complaint with a data protection supervisory authority, in particular in your country of residence. Our lead authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, https://uoou.gov.cz).

For anything you can't do in the app, write to privacy@halfpast.io. We answer within one month. We may need to confirm that the request comes from the account holder.

9. Security

• Data in transit is encrypted (TLS).
• Data in Google's data centres is encrypted at rest.
• Server access rules let each account read and write only its own data.
• App Check blocks requests that don't come from the genuine app.
• On the device, your data sits in the app's private storage, protected by Android's app sandbox. You can additionally lock the app with your fingerprint or screen lock.

10. Changes to this policy

If we change this policy, we will publish the new version at https://planner.halfpast.io/privacy with a new effective date. If the changes are significant, we will tell you in the app before they apply.

11. Contact

privacy@halfpast.io
Sergiy Bondarev, IČO 23604280, Bachmačská 691, 280 02 Kolín, Czechia