Privacy Policy
Last updated October 13, 2026
This policy explains what personal data StickHits collects, why, and what rights you have. We collect as little as we can: StickHits does not sell your data, does not build advertising profiles and, unless you agree to optional cookies, does not use analytics or advertising trackers.
1. Who is responsible
The controller of your personal data is the operator of StickHits (“we”, “us”). For anything about your data, write to info@stickhits.com or use the contact form with the topic “Privacy request”.
2. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: email address, username, password (stored only as a secure hash), display name, @handle, chosen avatar, title color | To create and run your account, sign you in and show your profile | Contract, Art. 6(1)(b) |
| Practice data: what you played and for how long, Stick Hits, titles, badges, Mastered items, saved items, challenge results, app settings (kit, notation style) | To provide the core features: progress, rewards, history and syncing between your devices | Contract, Art. 6(1)(b) |
| Subscription and payments: plan, status, dates, amounts, a Stripe customer reference. Card details are handled by Stripe only — we never see or store them. | To sell and manage Premium, handle refunds and keep records | Contract, Art. 6(1)(b); legal obligations such as accounting and tax, Art. 6(1)(c) |
| Messages: what you send through the contact form or by email (name, email, message) | To answer you and handle requests | Legitimate interest in answering you, Art. 6(1)(f); contract where it concerns your account |
| Technical data: IP address, browser and device type, time of requests, in server and security logs | To run the site securely, prevent abuse and fix errors | Legitimate interest in security, Art. 6(1)(f) |
| Optional analytics or advertising (only if enabled and only if you agree) | To understand how the app is used, and to show ads to Free members | Consent, Art. 6(1)(a) — you can withdraw it at any time under “Cookie settings” |
You do not have to give us personal data, but without an email address and password we cannot create an account, and without payment details (given to Stripe) we cannot sell Premium.
We do not use your data for automated decision-making or profiling with legal or similarly significant effects.
3. Data stored on your device
StickHits keeps some data in your browser’s local storage so that it works quickly and offline-tolerant: your settings (for example dark or light mode, sound levels), a copy of your practice progress until it has been saved to your account, and your cookie choices. Signing in uses cookies. Details are in the Cookie Policy.
4. Who receives your data
We share data only with service providers who help us run StickHits and who process it on our behalf under a data processing agreement, or as independent controllers where stated:
- Web hosting provider — stores the website, its database and server logs.
- Email provider — sends account emails (for example password resets and receipts) and receives your messages.
- Stripe (Stripe Payments Europe Ltd., Ireland, with affiliates including Stripe, Inc. in the USA) — processes payments and, as an independent controller, uses data to prevent fraud and meet its legal obligations. See stripe.com/privacy.
- Analytics or advertising providers — only if such tools are enabled and you have agreed to them; they will be named in the cookie banner and the Cookie Policy.
- Authorities — only where the law requires it.
The fonts and scripts of the app are served from our own server; your browser does not contact Google Fonts or other font services when you use StickHits.
5. Transfers outside the EEA
Some providers (for example Stripe) may process data in the United States. Such transfers are protected by the EU–U.S. Data Privacy Framework where the recipient is certified, or by the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the safeguards.
6. How long we keep data
- Account and practice data: while your account exists. If you delete your account, we delete this data within 30 days (backups are overwritten within a further 30 days).
- Payment records: as long as tax and accounting rules require — in Poland generally five years from the end of the year of the payment.
- Messages: up to 12 months after the conversation ends, unless needed longer for an ongoing matter.
- Server and security logs: up to 30 days, unless needed to investigate an incident.
- Consent choices: 6 months, after which we ask again.
7. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it;
- correct inaccurate data — most of it you can change yourself in Account → Edit profile;
- delete your data (“right to be forgotten”);
- restrict how we process it;
- data portability — receive the data you gave us in a machine-readable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, without affecting processing before the withdrawal (use “Cookie settings” at the bottom of any page).
To use these rights, write to info@stickhits.com from the email address of your account. We answer within one month. You also have the right to lodge a complaint with a data protection authority — in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority in the EU country where you live or work.
8. Children
StickHits is not intended for children under 16 to sign up on their own. If you are under 16, a parent or legal guardian must create the account or give consent. If we learn that we hold data of a child under 16 without such consent, we delete it.
9. Security
The site uses encrypted connections (HTTPS). Passwords are stored as one-way hashes, access to the server and database is restricted, and payments are handled by Stripe, which is certified to PCI DSS Level 1. No system is perfectly secure; if a breach affects your data and puts you at risk, we will tell you and the authorities as the law requires.
10. Changes
We will update this policy when our practices or the law change. The date of the current version is shown at the top. For important changes we will also let registered users know by email or in the app.