Privacy

Vratka keeps track of your returns and refunds. To do that it needs your orders, and nothing else.

In short. We never sell your data, show no ads and use no advertising or tracking SDKs. We only see what you send us: the e-mails you forward, the receipts you scan, the orders you type in. Original files are encrypted and deleted after 90 days at the latest (within 24 hours if they turn out not to be about an order). Data is stored in the European Union. You can export or delete everything from inside the app, at any time.

1. Who we are

Vratka is operated by Jan Horák, Prague, Czech Republic, who is the controller of your personal data. For anything on this page write to support@vratka.app.

2. What we process, and why

What	Exactly	Why	Legal basis
Account	A random device identifier. An e-mail address or an Apple ID only if you choose to sign in.	To give you an account without asking for anything, and to keep your orders when you change phones.	Contract, Art. 6(1)(b) GDPR
Settings	Country (and German state or US state), time zone, language, currency, reminder preferences.	Return deadlines depend on where you live; reminders arrive at the hour you choose.	Contract
Your orders	Shop, order number, order and delivery dates, items (name, size, colour, price), payment method type (never card numbers), shipping and tracking numbers, returns, claims and refunds you record.	To compute your deadlines and to check that refunds arrive.	Contract
Documents you add	E-mails you forward to your Vratka address, receipts, invoices, screenshots and PDFs you upload, text you paste.	To read the order details out of them so you don't have to type.	Contract, and your consent to AI reading (asked before the first document)
Notifications	A push token for your device.	To remind you before a deadline and to ask whether a refund arrived.	Contract
Subscription	Whether you have Vratka Pro and until when.	To unlock Pro features.	Contract
Crash reports	Technical error details (app version, device model, stack trace). No order content.	To fix bugs.	Legitimate interest, Art. 6(1)(f)
Usage statistics	Only if you turn on “Share anonymous usage stats”: anonymous named events, not linked to your account, such as “document added” or “refund confirmed”, never shops, items or amounts.	To understand which features help.	Consent, Art. 6(1)(a)

3. Your forwarding address and the documents you send

Your personal address (u-…@in.vratka.app) accepts e-mails you forward. Vratka never connects to your mailbox and cannot see anything you don't send. Anyone who knows the address can send to it, so treat it like a private address; you can change it in Settings at any time.

Original files are stored encrypted (AES-256-GCM) on our server.
Documents that turn out not to be about a purchase are deleted within 24 hours.
Other originals are deleted after 90 days, unless you choose to keep one (for example a receipt you need for a warranty claim). The order details read from them stay in your account until you delete them.
For shops that sell health products (pharmacies), item names are hidden by default.

4. Artificial intelligence

Order details are read from your documents by large language models from Google (Gemini) and OpenAI, accessed through OpenRouter (OpenRouter, Inc., USA), which acts as our processor.

We send only the document's content: the e-mail text, the image or the PDF. Never your account e-mail, your Apple ID or any device identifier.
Requests are configured for zero data retention: they are routed only to providers that neither store the content nor use it for training.
Processing may take place outside the EU, under the European Commission's standard contractual clauses.

AI does not compute your deadlines. Dates come from a deterministic engine built on the consumer law of your country and the shop's published rules, and every date shows where it came from. Anything the AI read with low confidence is highlighted for you to check.

5. What we do not do

No advertising, anywhere.
No selling, renting or sharing of your data for marketing, ever. Not even “anonymised” shopping statistics.
No tracking across other apps or websites.
No access to your bank, your mailbox or your shop accounts.
No location collection.

6. Who else is involved

INTERNET CZ, a.s. (Czech Republic): server hosting. Your data lives here, and our own mail server on it receives the e-mails you forward.
OpenRouter, Inc. (USA), routing to Google and OpenAI models: reading documents, zero data retention.
Resend: sends sign-in codes when you sign in with e-mail.
Expo (650 Industries, Inc.), with Apple and Google push services: delivers reminders.
RevenueCat, Inc.: subscription status. Receives a random account identifier and purchase status, never your orders.
Sentry: crash reports, configured to drop request bodies, screen content and query strings.
PostHog (EU hosting): usage statistics, only if you opt in.
Apple / Google: they sell the subscription and handle payment. We never see your card.

7. How long

Your account, orders and settings are kept until you delete them or delete your account. Original documents follow the rules in section 3. Usage records without content (which model read a document, how long it took, what it cost) are kept to run the service and are unlinked from you when you delete your account.

8. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and you may withdraw consent at any time. Two of them are buttons in the app: Settings → Privacy → Download my data and Settings → Privacy → Delete account (see deleting your account). You may also complain to the Czech supervisory authority, the Úřad pro ochranu osobních údajů (uoou.gov.cz), or to the authority where you live.

9. Children

Vratka is not directed at children under 16 and we do not knowingly create accounts for them.

10. Changes

If we change anything material, especially who reads your documents, the app shows you the change and asks for your consent again before the next document is read.

Last updated: 13 October 2026