Privacy policy for the “Parts STL” app
Last updated: 16 October 2026
1. Controller
The controller of your personal data is Tomasz Pasak MTM, ul. Cieszkowskiego 15/36, 41-303 Dąbrowa Górnicza, e-mail: mtmandroidstudio@proton.me (“we”). For any data protection matter please write to this address.
2. What the app is
“Parts STL” is an Android app with a library of parametric spare-part designs. You enter dimensions, preview the part in 3D and save an STL file for 3D printing. The model and the STL file are created only on your phone – the dimensions you enter and the finished files are not sent to us. Saving or sharing a new project costs 1 token. After you sign in with Google you receive 1 free token (one per Google account and one per phone); you can buy more in Google Play.
3. What data we process
| Data | Purpose and legal basis |
|---|---|
| Account (Google sign-in): Firebase user ID, the e-mail address of your Google account and – if Google provides them – your name and profile picture URL (we do not use them). | Creating your account and assigning tokens to you. Contract (Art. 6(1)(b) GDPR). |
| Tokens: number of tokens, date and type of each operation (free token, purchase, project saved, refund) and cryptographic hashes of the projects a token was charged for. The hash does not contain the dimensions in readable form. | Providing the service (counting tokens, not charging twice for the same project). Contract (Art. 6(1)(b) GDPR). |
| Purchases: product ID, Google Play order ID, a hash of the purchase token, status and dates. We do not receive card or other payment details – Google Play processes the payment. | Verifying that a purchase is genuine, crediting tokens, handling refunds and accounting. Contract and legal obligation (Art. 6(1)(b) and (c) GDPR). |
| Abuse protection: a Firebase App Check / Google Play Integrity attestation that the request comes from the genuine app installed from Google Play on a real device (Google processes app and device data for this; we only receive the result) and two cryptographic hashes that we store so the free token can be claimed only once per Google account and only once per phone: a hash of your Google account ID and a hash of the device identifier (the ANDROID_ID that Android provides to the app). We do not store the device identifier itself, and the app does not read your IMEI, serial number or phone number at all. | Protection against fraud and tampered copies of the app. Legitimate interest (Art. 6(1)(f) GDPR). |
| Technical data in server logs: IP address, time and type of request, error codes (Google Cloud / Firebase). | Security and diagnostics. Legitimate interest (Art. 6(1)(f) GDPR). |
| Only on your phone (not sent): your language choice, a list of hashes of projects already paid for, temporary files when sharing. You save STL files yourself in Downloads/CzesciSTL. | Operation of the app. |
Providing account data is voluntary, but without signing in you cannot claim the free token or save a project.
4. What we do not do
- The app contains no ads and no analytics tools, and it does not track you.
- We do not sell data and do not use it for profiling or marketing.
- We have no access to your card or bank account details.
5. Recipients
Google services process data on our behalf: Firebase Authentication (sign-in), Cloud Firestore (balance and purchase records), Cloud Functions (token server), Firebase App Check and Google Play Integrity (security) and Google Play (store and payments). The database and the token server run in the European Union (Europe region). Some Google services may transfer data outside the European Economic Area – this is based on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses. We do not share data with anyone else unless the law requires it.
6. How long we keep data
- Account, balance and token history – until you delete your account.
- Server logs – usually up to 30 days.
- Anonymised purchase records (not linked to your account) – for the period required by accounting rules and to defend legal claims (up to 5 years).
- The hashes of your Google account and of your device used for the one-time free token – as long as we offer a free token, so that it cannot be claimed repeatedly by deleting and re-creating an account or by signing in with another Google account on the same phone.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest (Art. 15–21 GDPR). You may also lodge a complaint with a supervisory authority – in Poland the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) – or with the authority in your own country.
8. Deleting your account
You can delete your account and data yourself in the app: tap the token button → Delete account and data. You can also request deletion on the page Delete account and data. Unused tokens are forfeited. Details are on that page.
9. Children
The app is not directed at children. Using it requires a Google account.
10. Security
Connections to the server are encrypted (HTTPS). The app has no direct access to the database – the balance and purchases are changed and verified only by the server, which checks purchases directly with Google Play.
11. Changes
We will announce material changes to this policy in the app or on this page. The current version is always available at this address.