Privacy Policy

Sortis is designed to do as little as possible with your data. The App does not require an account: there is no sign-up, no email, and no user profile of any kind. The categories below describe everything that is processed, including data that never leaves your device.

App data (stays on your device)

• saved pools and their entries (names and weights you type in);
• every draw's parameters, seed, commitment hash, and result (your draw history);
• display and behaviour settings, and achievement progress.

This data is stored only on your device, in a local database. None of it is transmitted anywhere unless you explicitly tap Share or Export.

Device and diagnostic data

• device model, operating system version, app version, approximate region, and a random, resettable app-instance identifier, collected by Firebase Analytics;
• device model, operating system version, app version, a random installation identifier, and the crash trace itself, collected by Firebase Crashlytics when the App crashes.

Neither is linked to you personally, and no advertising identifier is ever collected: it is explicitly disabled on both platforms.

Usage analytics

Analytics are on by default. Event parameters are restricted to counts, enums, booleans, and durations only, for example how many draws were run or which mode was opened, never a pool name, entry name, result, seed, or share code. If you prefer not to be measured at all, you can block the App's network access at the OS level; this does not disable any feature, since Sortisworks fully offline.

Purchase data

If you choose to leave a tip, the relevant app store (Apple App Store or Google Play) processes payment. We receive only the purchase confirmation, under a random on-device identifier, through RevenueCat. We do not receive your payment method or billing address.

Support correspondence

If you write to us, we receive your email address and the content of your message so we can reply.

Sortis requests no sensitive permissions.

iOS

No usage description keys are declared at all: no camera, photo library, location, contacts, or notifications access exists.

Android

Only INTERNET is declared, needed to reach Firebase and the tip-purchase stores. Advertising-ID permissions are explicitly removed from the app manifest.

We process data on the following lawful bases under GDPR Article 6:

Performance of a contract (Art. 6(1)(b))

Processing an optional tip purchase and confirming it went through.

Legitimate interests (Art. 6(1)(f))

Diagnosing and fixing bugs, and conducting limited internal analysis using the restricted analytics events described above to improve features. We balance these interests against your rights and freedoms; you can object at any time (see "Your Rights" below).

Legal obligation (Art. 6(1)(c))

Retaining purchase records to comply with Spanish tax law.

We rely on a small number of carefully selected sub-processors, each acting under a Data Processing Agreement consistent with GDPR Article 28:

Google Firebase Analytics

Provider: Google LLC (Google Ireland Limited for European users). Purpose: anonymous usage analytics, no advertising identifier. Privacy: firebase.google.com/support/privacy.

Google Firebase Crashlytics

Provider: Google LLC. Purpose: crash and diagnostic reporting. Data processed: anonymised installation identifiers, crash stack traces.

Google Firebase Remote Config

Provider: Google LLC. Purpose: fetches a remote flag once per launch that gates an in-app debug menu. Carries no personal data.

RevenueCat, Inc.

Provider: RevenueCat, Inc. (US). Purpose: processes the optional one-time tip purchase. Data processed: a random on-device identifier and purchase token. Privacy: revenuecat.com/privacy.

App distribution and billing

Apple Distribution International Ltd. (App Store) and Google Ireland Limited (Google Play) handle download and tip-purchase payment. Their privacy practices apply to data they collect directly through their stores; we never see your payment details.

What we do not do

We do not sell, rent, or trade your personal data. We do not share your data with advertising networks. We do not use your data to train machine-learning models.

As a data subject, you have the rights set out in Articles 15 to 22 of the GDPR:

• Right of access (Art. 15): request a copy of any personal data we hold about you. Note that Sortisgenerally does not hold personal data, since the App requires no account and your pools and draw history stay on your device.
• Right to rectification (Art. 16): ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17): ask us to delete data we hold, subject to legal-retention exceptions (for example, tax records relating to a tip purchase).
• Right to restriction (Art. 18): ask us to limit processing in certain cases.
• Right to data portability (Art. 20): receive your data in a structured, machine readable format. In practice, you already have this: use the in-App CSV export at any time.
• Right to object (Art. 21): object to processing based on legitimate interests, including the analytics described above. We will stop unless we can show compelling legitimate grounds.
• Right to lodge a complaint with a supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD) at www.aepd.es. You may also complain to the authority of your usual residence or place of work.

To exercise any of these rights, email zawilabcontact@gmail.com with the subject "GDPR request". We will respond within one month, as required by Article 12(3).

App data (pools, draw history, settings)

Stored on your device for as long as you keep the App installed. Never transmitted to us. Removed entirely when you uninstall the App.

Backups

We keep no backup copies; there is no server to back up to. Your device's own operating-system backup (iCloud or Google Account backup) may include the local app data, governed entirely by your own account settings, not by Zawilab.

Crash logs

90 days, then automatically deleted.

Anonymous analytics events

14 months, then automatically deleted.

Support correspondence

Up to 24 months from the last reply, unless a longer period is required by law.

Tax and accounting records related to tip purchases

Up to 6 years, where required under Spanish tax law (Ley General Tributaria).

You can request earlier deletion of any data we hold by emailing zawilabcontact@gmail.com.

Sortis is a general-audience utility, not directed at children under 13, and we do not knowingly collect personal data from anyone under that age. In Spain, the digital age of consent is 14under the LOPDGDD. Where the user is under the applicable age, the parent or legal guardian must give consent on the user's behalf.

Because Sortis requires no account and does not collect personally identifying information, this is largely procedural. If you believe a child has provided personal data to us by writing in, please contact zawilabcontact@gmail.com and we will delete it without undue delay.

Sortis is a mobile application and does not use traditional web cookies. The App may use:

• Local device storage for your pools, draw history, settings, and achievement progress;
• Anonymised installation identifiers (Firebase installation IDs) for crash reporting, analytics, and remote config delivery;
• Advertising identifiers: we do not use them. We do not request the iOS App Tracking Transparency permission.

We may update this Policy as the App evolves or as the law changes. When we do, we will update the "Last updated" date at the top of this page. For material changes that affect how we process your personal data, we will provide an in-app notice.

The data controller responsible for personal data processed by Sortis under the GDPR is:

Controller

Zawilab, Zawaar Abbas

Address

Barcelona, Spain

Email

zawilabcontact@gmail.com

We have not appointed a Data Protection Officer because the scale and nature of our processing does not require one under GDPR Article 37(1). All data protection enquiries are handled personally by Zawaar Abbas; please use the subject line "GDPR request" so we can prioritise your message.

For questions about the Terms of Service, see our Terms of Service.