Hrvatski  ·  English

Privacy Policy

Golden Boy mobile app · effective 1 October 2026

1. Who is responsible for your data

The data controller for the Golden Boy app, within the meaning of the General Data Protection Regulation (GDPR), is:

The foundation publishes the app on Google Play and the App Store and provides its content — audio recordings of children's stories. It decides the purposes and means of the processing described in this policy.

Data protection at the foundation is handled by s. M. Jelena Burić. All privacy questions and all requests to exercise your rights go to the email address above.

2. In short

3. What we collect and why

3.1 Firebase Analytics — usage statistics

The app uses Google Analytics for Firebase so we can understand how much and in what way the app is used. The following is collected:

• Usage events — for example first launch, session start, opening a screen, and app updates.
• App instance identifier (App Instance ID) — a pseudonymous identifier tied to a particular installation of the app, not to a person. It cannot be linked to you, or to other apps on the device.
• Device and operating system information — device model, OS version, app version, device language, and a country approximated from the IP address.

No advertising identifier (AAID on Android, IDFA on iOS) is collected. Its collection is explicitly disabled inside the app, as are ad-personalization signals. The app contains no advertising SDK of any kind.

The app instance identifier is erased when the app is uninstalled or its data is cleared; a new, unlinked identifier is generated afterwards.

3.2 Firebase Crashlytics — crash reports

When the app crashes or records a serious error, a report is sent containing:

• the technical error trace (stack trace) and the app version,
• the device type and model, and the operating system version,
• device state at the time of the crash — such as free memory, storage, battery level, and whether the app was in the foreground,
• the Crashlytics installation identifier, a pseudonymous identifier of the same kind as in 3.1,
• technical log entries the app records itself to help diagnose the fault — among them the name of the screen that was open and the internal key of the story that was playing. These contain only technical messages about the app's operation and no information about a person.

The sole purpose is detecting and fixing faults. This data is not used for any analysis of user behaviour.

3.3 Data that stays only on the device

The following is stored locally on your device. It is never sent to us, to Google, or to any third party:

• your interface language choice (Croatian or English),
• where you paused in each story,
• the last story you played,
• whether notification permission has already been requested,
• temporarily cached audio files and story images, so playback works without re-downloading and without an internet connection.

This data is deleted when you uninstall the app or clear its data in your device settings.

3.4 Audio content delivery

Stories and their images are downloaded from our server component running on the Cloudflare Workers platform. With every such request — as with any other internet request — the server sees your device's IP address and technical details of the request (time, the file requested, the client type).

We do not use this to identify users, we do not link it to the data described in 3.1 and 3.2, and we build no profiles from it. Cloudflare processes it as our infrastructure provider, in order to deliver content and protect against abuse. The app uses no cookies and no tracking pixels.

3.5 Notifications

The app requests notification permission solely so it can display playback controls while a story plays in the background. The app uses no push notifications, registers no device token, and sends no messages to anyone. Declining the permission affects nothing except the display of those controls.

4. Legal basis for processing

• Legitimate interest (Art. 6(1)(f) GDPR) — for usage statistics and crash reports. Our legitimate interest is keeping the app stable and improving it. The processing is kept to the minimum: pseudonymous, with no advertising and no profiling. You may object to this processing (see section 9), and you can act on that objection yourself, immediately, in the app: Settings → Diagnostics. Turning it off stops both the usage statistics and the crash reports.
• Performance of the service (Art. 6(1)(b) GDPR) — for fetching and playing the audio content, without which the app cannot function.

5. How long we keep data

• Usage statistics: 2 months from collection, after which individual records are deleted automatically. Aggregated, non-personal figures may be kept longer.
• Crash reports: up to 90 days.
• Server logs: short-term, per Cloudflare's standard settings, solely for operating the service and for security.
• Data on the device: until the app is uninstalled.

6. Data security

We protect the data with measures proportionate to its kind and volume:

• all of the app's communication — with our own server and with Google's services — runs exclusively over an encrypted connection (HTTPS/TLS); the app never sends data unencrypted,
• the audio content and images are not publicly reachable on the internet: they sit in a private bucket, and every request is checked against a key the app sends with it,
• data stored on the device sits in the app's private storage area, which other apps cannot reach, and is covered by the device encryption Android and iOS apply by default,
• usage statistics and crash reports are stored by Google on its own infrastructure, under the security measures described in its Firebase documentation,
• access to the Firebase and Cloudflare consoles is limited to the smallest possible number of people and tied to named accounts with individual sign-in,
• the app collects no passwords, no payment details and no special categories of personal data at all, so no such data exists on our side.

No system is completely secure. Should a personal data breach nevertheless occur that poses a risk to users' rights and freedoms, we will report it to the supervisory authority within 72 hours and, where required, notify users on this page.

7. Processors and transfers outside the EEA

We do not sell data and do not pass it to third parties for marketing. It is processed only by the following service providers, and only on our instructions:

• Google Ireland Limited and affiliated companies — Firebase Analytics and Firebase Crashlytics.
• Cloudflare, Inc. — delivery of audio content and images.

Both providers may process data outside the European Economic Area, primarily in the United States. Such transfers rely on the EU–U.S. Data Privacy Framework and on the European Commission's Standard Contractual Clauses.

8. Children's privacy — COPPA and GDPR-K

The app is intended for children and is declared as such in the app stores. Its content is audio recordings of children's stories. Stricter rules therefore apply, and we want to be explicit about the following.

We do not collect from children:

• first name, surname, nickname, or any other personal identifier,
• email address, phone number, or postal address,
• age or date of birth,
• photographs, voice recordings, or video,
• location, contact lists, or the contents of other apps,
• advertising identifiers (AAID, IDFA) — their collection is disabled in the app.

The app also has: no ads and no advertising SDKs, no in-app purchases, no profiling or content personalization, no chat, comments, sharing, or user-generated content of any kind, and no links to social networks.

The only data generated by using the app is the technical, pseudonymous data described in 3.1 and 3.2. It is not intended to identify a child and is not used to do so.

Why we do not ask for parental consent

COPPA and the GDPR both treat persistent pseudonymous identifiers, such as those in sections 3.1 and 3.2, as data relating to a child. COPPA expressly permits collecting them without parental consent where they serve only the support for the internal operations of the service — maintaining and analysing how the app functions, diagnosing faults, and security. Our use of these identifiers does not go beyond that:

• we never use them to contact a child, in any way,
• we never use them for advertising, behavioural tracking, or profiling,
• we never combine them with data from other sources, or with anything that would reveal a child's identity,
• we never disclose them to anyone other than the processors listed in section 7, and then only for the purposes stated.

The app is declared as directed to children in the app stores and complies with the Google Play Families policy. It shows no ads, contains no advertising SDKs, and transmits no advertising or persistent device identifiers — no AAID, IDFA, IMEI, IMSI, MAC, SSID, BSSID, device serial or SIM serial. It requests no permission for location, microphone, camera, contacts, or phone number.

For parents and guardians

As a parent or guardian you have the right to request access to data collected from your child's device, to have it deleted, and to stop any further collection.

You can also stop the collection without uninstalling: in the app, open Settings → Diagnostics and turn the switch off. From that moment the app sends neither usage statistics nor crash reports, and everything else keeps working.

The fastest and most complete way to stop all collection is to uninstall the app: this deletes all data stored on the device and ends the sending of statistics and crash reports. For data already collected, contact us at the address above and we will delete it. Because we collect no data that identifies a person, when handling a request we may ask for technical details that help us locate the relevant installation (for example the device model and the approximate period of use).

9. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. You can exercise the right to object directly in the app, under Settings → Diagnostics. For anything else, send your request to zlatni.djecak.stadler@gmail.com.

The app has no user accounts, so there is no account-deletion process. Deleting data is described in section 8.

If you believe your rights have been infringed, you have the right to lodge a complaint with the supervisory authority:

10. Changes to this policy

We may amend this policy from time to time, for example when the way the app works changes. The effective date is always shown at the top of the page. For material changes, a notice will be published on this page before the change takes effect.

11. Contact

For any questions about this policy or about how data is handled, write to zlatni.djecak.stadler@gmail.com.