Privacy Policy

Sortis is designed to do as little as possible with your data. The App does not require an account: there is no sign-up, no email, and no user profile of any kind. The categories below describe everything that is processed, including data that never leaves your device.

App data (stays on your device)

• saved pools and their entries (names and weights you type in), and the pairs you ask Teams to keep apart;
• every draw's parameters, seed, commitment hash, and result (your draw history);
• display and behaviour settings, and achievement progress.

This data is stored only on your device, in a local database. None of it is transmitted anywhere unless you explicitly tap Share or Export.

Sharing a pool: when you tap Share pool, Sortis builds a code (and a QR image) containing that pool's name and entries. It goes only where you send it. Importing a code or a QR image happens entirely on your device; Sortis uploads nothing.

Device and diagnostic data

• device model, operating system version, app version, approximate region, and a random, resettable app-instance identifier, collected by Firebase Analytics (including which store or campaign the App was installed from);
• device model, operating system version, app version, a random installation identifier, and the crash trace itself, collected by Firebase Crashlytics when the App crashes.

Neither is linked to you personally, and no advertising identifier is ever collected: it is explicitly disabled on both platforms.

Usage analytics

Analytics are on by default. Event parameters are restricted to counts, enums, booleans, and durations only, for example how many draws were run or which mode was opened, never a pool name, entry name, result, seed, or share code. If you prefer not to be measured at all, you can block the App's network access at the OS level; this does not disable any feature, since Sortis works fully offline.

Purchase data

If you choose to leave a tip, the relevant app store (Apple App Store or Google Play) processes payment. We receive only the purchase confirmation, under a random on-device identifier, through RevenueCat. We do not receive your payment method or billing address.

Support correspondence

If you write to us, we receive your email address and the content of your message so we can reply.

The only sensitive permission Sortis asks for is the camera on iOS, and only when you tap Scan QR code.

iOS

Camera, only when you tap Scan QR code (in Pools › Import a shared pool, or in Verify): iOS asks once, and you can turn it off any time in Settings › Sortis. The camera is used only while the scanner is open and only to read a Sortis QR code; nothing is recorded or stored, and no picture leaves your phone. There is no photo library, location, contacts, or notifications access. Importing a QR code from a screenshot uses the system photo picker, which hands Sortis only the one image you choose.

Android

Sortis asks for no runtime permissions. Its manifest contains only normal install-time permissions: internet and network-state access (Firebase and the tip store), wake lock (Firebase's background uploads), Google Play billing (optional tips), and the Play install-referrer service (Firebase Analytics), plus one app-internal permission. Advertising-ID permissions are explicitly removed from the app manifest. Scan QR code uses Google's code scanner, part of Google Play services, which reads the code in its own screen and hands Sortis only the code's text, so Sortis holds no camera permission.

Read results aloud

An optional setting, off by default. It uses your phone's built-in text-to-speech voice; Sortis itself sends nothing.

We process data on the following lawful bases under GDPR Article 6:

Performance of a contract (Art. 6(1)(b))

Processing an optional tip purchase and confirming it went through.

Legitimate interests (Art. 6(1)(f))

Diagnosing and fixing bugs, and conducting limited internal analysis using the restricted analytics events described above to improve features. We balance these interests against your rights and freedoms; you can object at any time (see "Your Rights" below).

Legal obligation (Art. 6(1)(c))

Retaining purchase records to comply with Spanish tax law.

We rely on a small number of carefully selected sub-processors, each acting under a Data Processing Agreement consistent with GDPR Article 28:

Google Firebase Analytics

Provider: Google LLC (Google Ireland Limited for European users). Purpose: anonymous usage analytics, no advertising identifier. Privacy: firebase.google.com/support/privacy.

Google Firebase Crashlytics

Provider: Google LLC. Purpose: crash and diagnostic reporting. Data processed: anonymised installation identifiers, crash stack traces.

Google Firebase Remote Config

Provider: Google LLC. Purpose: fetches a remote flag once per launch that gates an in-app debug menu. Carries no personal data.

RevenueCat, Inc.

Provider: RevenueCat, Inc. (US). Purpose: processes the optional one-time tip purchase. Data processed: a random on-device identifier and purchase token. Privacy: revenuecat.com/privacy.

App distribution and billing

Apple Distribution International Ltd. (App Store) and Google Ireland Limited (Google Play) handle download and tip-purchase payment. Their privacy practices apply to data they collect directly through their stores; we never see your payment details.

What we do not do

We do not sell, rent, or trade your personal data. We do not share your data with advertising networks. We do not use your data to train machine-learning models.

As a data subject, you have the rights set out in Articles 15 to 22 of the GDPR:

• Right of access (Art. 15): request a copy of any personal data we hold about you. Note that Sortis generally does not hold personal data, since the App requires no account and your pools and draw history stay on your device.
• Right to rectification (Art. 16): ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17): ask us to delete data we hold, subject to legal-retention exceptions (for example, tax records relating to a tip purchase).
• Right to restriction (Art. 18): ask us to limit processing in certain cases.
• Right to data portability (Art. 20): receive your data in a structured, machine readable format. In practice, you already have this: use the in-App CSV export at any time.
• Right to object (Art. 21): object to processing based on legitimate interests, including the analytics described above. We will stop unless we can show compelling legitimate grounds.
• Right to lodge a complaint with a supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD) at www.aepd.es. You may also complain to the authority of your usual residence or place of work.

To exercise any of these rights, email zawilabcontact@gmail.com with the subject "GDPR request". We will respond within one month, as required by Article 12(3).

App data (pools, draw history, settings)

Stored on your device for as long as you keep the App installed. Never transmitted to us. Removed entirely when you uninstall the App.

Backups

We keep no backup copies; there is no server to back up to. Your device's own operating-system backup (iCloud or Google Account backup) may include the local app data, governed entirely by your own account settings, not by Zawilab.

Crash logs

90 days, then automatically deleted.

Anonymous analytics events

14 months, then automatically deleted.

Support correspondence

Up to 24 months from the last reply, unless a longer period is required by law.

Tax and accounting records related to tip purchases

Up to 6 years, where required under Spanish tax law (Ley General Tributaria).

You can request earlier deletion of any data we hold by emailing zawilabcontact@gmail.com.

Sortis is a general-audience utility, not directed at children under 13, and we do not knowingly collect personal data from anyone under that age. In Spain, the digital age of consent is 14under the LOPDGDD. Where the user is under the applicable age, the parent or legal guardian must give consent on the user's behalf.

Because Sortis requires no account and does not collect personally identifying information, this is largely procedural. If you believe a child has provided personal data to us by writing in, please contact zawilabcontact@gmail.com and we will delete it without undue delay.

Sortis is a mobile application and does not use traditional web cookies. The App may use:

• Local device storage for your pools, draw history, settings, and achievement progress;
• Anonymised installation identifiers (Firebase installation IDs) for crash reporting, analytics, and remote config delivery;
• Advertising identifiers: we do not use them. We do not request the iOS App Tracking Transparency permission.

We may update this Policy as the App evolves or as the law changes. When we do, we will update the "Last updated" date at the top of this page. For material changes that affect how we process your personal data, we will provide an in-app notice.

The data controller responsible for personal data processed by Sortis under the GDPR is:

Controller

Zawilab, Zawaar Abbas

Address

Barcelona, Spain

Email

zawilabcontact@gmail.com

We have not appointed a Data Protection Officer because the scale and nature of our processing does not require one under GDPR Article 37(1). All data protection enquiries are handled personally by Zawaar Abbas; please use the subject line "GDPR request" so we can prioritise your message.

For questions about the Terms of Service, see our Terms of Service.