Privacy

Without an account

The schedule, the map, the permanent points, the blood reserves and a shared drive are read without an account and without leaving a trace of you on our side. An account is not required: without one there is only no donation log and no problem reports.

What is kept with an account

Your email address, and with a Google account also your name and picture from it; if you sign in with an email address and a password, the password is kept by Google (Firebase) in a form nobody can read back, us included; how you sign in, when the account was made and the time of your last visit; the app's language; the version of the app at the last visit and whether it was installed on the device; your donation log, if you turn it on; the messages you send from the app, with facts about the device that help find the fault (the browser, the screen size, the language and the time zone). The project administrator sees the list of accounts in the console: name, email, how the account signs in, the app's version and the last visit, never the donation log.

Why, and on what basis

The account and your messages are kept with your consent, given when you sign in, so the app can remember your language and your log and can answer what you report. The donation log only with a separate, explicit consent, described below. Statistics only with your consent on the card that asks. The nightly copies are made for safety, so that nothing is lost in a failure. We do not sell the data or give it to anyone beyond what this page says.

How long

The account and the log are kept until you delete the account yourself. A problem report and the conversation under it are kept until an administrator has dealt with it and deleted it, also after the account is deleted, but then without a name or an address attached. Every night a copy of all of it is made, encrypted so that only the project administrator can open it, and kept 90 days; a deleted account stays in those copies until they expire, and nothing is restored from them for it.

The donation log is asked for separately

The dates and places of donations say something about your health, so keeping them is agreed to on its own, with the button "I agree, keep the log with my account", and that agreement is recorded with the time it was given. Nothing is written before it. Only you can see the log: not even administrators can read it, and that holds in the database's own rules rather than in the app being polite. You withdraw that consent at any time with Stop keeping the log on the Donations screen, or by deleting the account; the whole log is then deleted. Withdrawing does not change what happened before it.

What never leaves your device

Your blood group and gender, your answers in the Can I donate check, and everything in the donor questionnaire including the personal identification number. The questionnaire is filled in and printed inside your browser; the answers are gone when you close the tab. The device remembers your Can I donate answers only if you turn that on. If you turn on Keep my details on this device, your name, date of birth, address, phone numbers, workplace and occupation stay on this device so you need not type them again, never the identification number and never an answer; the same switch turns them off. Your location is asked for only by the Near me filter, used at once, and sent nowhere.

Who else processes it

Google (Firebase): sign-in, the confirmation and new-password emails, the database in Frankfurt, and hosting. Google Analytics only if you allow it on the card that asks, and only screens and buttons, never anything you typed. The encrypted nightly copies are kept on GitHub, and only the project administrator can open them. When you open the map, your browser fetches tiles from OpenStreetMap servers.

Google and GitHub are American companies and part of this processing can take place outside Serbia, the United States included. Both take part in the framework for transfers between the European Union and the United States, which the European Union has found to give an adequate level of protection, and Serbian law allows such a transfer without a separate approval.

Your rights

Download my data in Settings writes a file with everything the account holds and everything that stayed on the device. Anything you entered can be corrected in the app. Delete account and all data removes everything at once and cannot be undone. A restriction of processing or an objection is asked for at the same address or through the Report a problem screen. You can withdraw a consent at any time, and that does not change what was processed before it. A complaint goes to the Commissioner for Information of Public Importance and Personal Data Protection.

The app makes no decisions about you: the Can I donate check only repeats the published rules, and whether you may give blood is decided by the doctor.

Children

Blood donation in Serbia starts at 18 and the app is meant for adults.

Changes

A change to what is kept or to who processes it will be said in the app, not only here.