Privacy Policy

This is a translation of the Estonian version; if they differ, the Estonian version prevails.

Last updated: 02.11.2026

1. General

This privacy policy explains what personal data the Themis mobile app and its web version (together "the App", "we") process, why and for how long, who it is shared with, and what rights you have. It is based on the General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.

Themis shows you the laws that apply to you and notifies you when they change. The App has two modes: personal (laws by age, place of residence and interests) and work (laws by field of work).

The controller is Taavi Varb (an adult natural person acting within the student company Themis and JA Estonia activity licence no. 7566), address Nõmme tee 3-1, 11315 Tallinn, contact: info@ofthemis.ee. Themis was developed in Junior Achievement Estonia's student company programme (student company Themis, JA Estonia activity licence no. 7566); the controller is not the student company but the person named above. We have not appointed a data protection officer, as our processing doesn't meet the conditions in GDPR Article 37; send any data protection questions to the address above.

2. What we store on our servers

Account:

• email address and password — the password is stored only as a cryptographic hash; we cannot see it;
• when you sign in with Google: your Google account identifier, email address and a note that Google has verified it. We do not store your name or profile picture — the name and picture address Google sends are deleted automatically at sign-in. We never see your Google password;
• when you sign in with Apple (on iPhone): your Apple account identifier and email address (or Apple's "Hide My Email" relay address, if you choose it). We don't ask Apple for your name and never see your Apple ID password;
• the account language (Estonian or English), so we can send emails in the language you chose.

Profile (asked when you first use the App, editable in your profile):

• mode: personal or work;
• date of birth (required) — to calculate your exact age, because many laws start to apply on a specific birthday (e.g. turning 16 or 18), to show laws for your age, to notify you on a birthday when new laws start to apply to you, and to keep the App from being used by under-13s (section 10). Accounts created before 09.10.2026 have only the birth year and month stored;
• the city or rural municipality you live in (required) — to show local rules;
• gender (optional, personal mode only) — only for the few laws that depend on it (e.g. military service). You can choose "Prefer not to say";
• fields of work (work mode), e.g. marketing, IT or architecture;
• topics you follow (e.g. traffic, housing, tax);
• the company you have joined (optional, work mode) if you enter a company code from your employer. The company does not see your data — not your name, email, profile or what you view in the App. We only tell the company how many people have joined. You can leave the company in your profile at any time;
• the App language.

When you use the App:

• notifications we create when a law that applies to you is added or changed: which law, when it was created, whether it was sent as a push notification and whether you have opened it;
• push notifications (if you allow them): your device's notification token, platform (iOS or Android) and when the token was added and last used. One account can have several devices;
• subscription: whether you have access and until when, how you got it (a subscription bought through Apple or Google, a company account, or a free account we gave you), the plan (monthly or yearly), whether it's a free trial and whether it renews. We don't see or store payment details (e.g. card numbers) — Apple or Google takes the payment;
• messages you send: general feedback, suggestions for laws to add (with the search text if you send the suggestion from a search) and reports of mistakes in a specific law (with whether we have reviewed it).

For security and reliability:

• wrong company code attempts (only the time of the attempt, to limit attempts to ten per hour);
• technical server logs (e.g. IP address, time and result of a request), kept by our provider Supabase for up to 7 days for security and troubleshooting.

If you email us at info@ofthemis.ee, we keep the correspondence and your email address to answer you.

What we do NOT collect: we do not store your searches (the search is carried out, but the search text is not kept unless you send it yourself as a law suggestion). We do not collect your name, personal identification code, phone number, health or financial data, precise location (GPS) or contacts. The App has no advertising, analytics, tracking or crash reporting.

Please don't include sensitive data (e.g. health data, personal identification codes or other people's data) in feedback, mistake reports or emails to us — Themis doesn't need it. If it reaches us anyway, we use it only to reply to your message and delete it as soon as possible.

Required and optional data: creating an account requires an email address and password (or a Google or Apple account), and using the App requires the mode, date of birth and municipality — without them we can't choose the laws that apply to you or exclude under-13s, so the App can't be used. Gender, joining a company, push notifications and sending messages are optional; declining them doesn't stop you from using the App. No law requires you to provide this data.

3. What is kept only on your device

This data never reaches us or any service provider:

• your sign-in session — encrypted in the mobile app (with the key in the device's secure storage), in browser storage (localStorage) in the web version;
• the language chosen at sign-in and the appearance (light, dark or same as phone);
• topic suggestions: to suggest a topic you don't follow yet, the App remembers which topics you searched laws for in the last 30 days — only the topic name and time, not the search text. You can decline a suggestion ("Not now"). This data is deleted with your account.

4. Why we use data and on what legal basis

5. Who we share data with

We do not sell your personal data or share it for advertising. Data is processed on our behalf only by these service providers (processors):

• Supabase — database, authentication, server functions and scheduled jobs (e.g. creating notifications); stores account and profile data, notifications, device notification tokens and your messages;

• RevenueCat — subscription management: receives your subscription status and purchase history from Apple or Google and tells us whether your subscription is valid. RevenueCat sees your account's random identifier (not your name or email address), purchase details and technical device and app data (e.g. app version, country and currency, IP address);

• Apple (App Store) and Google (Google Play) — sell subscriptions bought in the App and take payment under their own terms (including invoices and refunds). They process payment details as independent controllers under their own privacy policies;

• Google — sign-in if you use a Google account; Google processes sign-in under its own privacy policy;

• Apple — sign-in if you use an Apple account (Sign in with Apple); Apple processes sign-in under its own privacy policy;

• Expo and Apple Push Notification service / Google Firebase Cloud Messaging — delivering push notifications to your device (the device notification token and the notification content, i.e. the law's title);

• Resend — sending the App's emails (confirmation and reset codes, security notices) from noreply@ofthemis.ee; your email address and the message content are processed;

• Apple (iCloud Mail) — receiving and answering emails you send us at info@ofthemis.ee; your email address and the message content are processed;

• Fontshare (Indian Type Foundry) — the typeface in the App's web version and our emails. When you open the web version, or an email in an email app that loads web fonts, your device requests the typeface from Fontshare's server, which sees your IP address and browser or email app type. The logo in emails is loaded from our Supabase server.

• Netlify — hosting our website (ofthemis.ee) and the App's web version (app.ofthemis.ee). When you open a page, Netlify sees your IP address and technical browser data (server logs); Netlify doesn't store account data.

Links to other websites: every law links to its official source (Riigi Teataja, EUR-Lex). Those sites' own privacy policies apply when you open them.

Transfer of the service: if the service is transferred to another adult service provider (e.g. a company), users' data moves with the service to the new controller, which continues to process it under this policy. We will tell you in advance in the App and by email, so you can delete your account first if you wish.

A company you joined with a company code does not receive your personal data. If we add new service providers (e.g. a payment processor for subscribing on the website), we will update this policy before using them.

6. Where data is located and international transfers

The database is located in the European Union (Supabase, Frankfurt, Germany). When push notifications and emails are delivered, when the website and web version are hosted (Netlify, USA), when subscriptions are managed (RevenueCat, USA) and when you sign in with Google or Apple, data (e.g. the device notification token, notification content, email address) may be processed outside the European Economic Area, including in the United States. In that case the transfer relies on safeguards that comply with the GDPR (e.g. the European Commission's standard contractual clauses or the EU–US Data Privacy Framework).

7. How we protect data

• Access in the database is restricted at rule level (row-level security): each user can see and change only their own data, and can change only the profile fields the App lets them edit. Feedback and mistake reports cannot be read or changed after sending.
• Only our team's administrator, who is bound to keep data confidential, has access to the database. We use it only to maintain the App, review feedback, suggestions and mistake reports, manage company accounts and meet legal obligations.
• Data travels between your device and the server over an encrypted connection, and the database is also encrypted at rest. How the sign-in session is kept is described in section 3; on a shared computer, sign out after use.
• To prevent abuse, we limit the number of messages (up to 10 feedback messages and 10 mistake reports per day), email resends and wrong company code attempts (10 per hour).

No system is 100% secure, but we take reasonable technical and organisational measures to protect your data.

8. How long we keep data

You can delete your account at any time in the App (Profile → "Delete account"). Deletion immediately and permanently removes your account and all data linked to it: profile, notifications, device notification tokens and the feedback, suggestions and mistake reports you sent; the topic suggestion data is removed from your device and your subscription data from RevenueCat. Deleting your account doesn't cancel a subscription bought through Apple or Google — cancel it first in your Apple ID or Google Play account settings. If you delete your account in the mobile app and signed in with Google, we also disconnect the App from your Google account (in the web version you can do this in your Google account settings). If you signed in with Apple, the App briefly asks Apple to confirm and then revokes the App's access to your Apple account (you can also do this in iPhone Settings: your name → Sign-In & Security → Sign in with Apple).

Automatic daily backups of the database may be made so it can be restored after a failure. Deleted data may remain in backups for up to 7 days, after which it is removed automatically. Backups are used only for restoring data, and if we ever restore the database from a backup, we delete again any data whose deletion was requested in the meantime.

If we correct a law summary based on a mistake report, only the corrected summary remains, not your data.

9. Your rights

Under the GDPR and the Estonian Personal Data Protection Act you have the right to:

• know what data we process about you and get a copy of it;
• have incorrect data corrected — you can edit your profile data yourself in the App;
• have your data erased ("right to be forgotten") — you can also do this yourself by deleting your account;
• restrict processing or object to processing based on legitimate interest;
• receive your data in a structured, machine-readable format (data portability);
• withdraw consent to processing your gender;
• lodge a complaint with the Data Protection Inspectorate (www.aki.ee) if you believe your data has been processed unlawfully.

To use these rights, write to info@ofthemis.ee from the email address your account was created with. If we can't otherwise confirm it's you, we may ask for additional confirmation before giving out or deleting data, so that no one else can access your data. We reply within one month at the latest (in complex cases we may extend this by up to two months and will tell you). You can also send a complaint by email: info@aki.ee.

10. Minors

People aged 13 and over may use the App, in line with § 8 of the Personal Data Protection Act, which sets this as the age of a child's consent for information society services. The App asks for your date of birth when you create your profile. If it shows the user is under 13, their account and all data are deleted immediately and the App cannot be used. If we otherwise learn that we have collected data from someone under 13, we delete it as soon as possible. If you are under 18, we recommend talking to your parent about using Themis; a paid subscription needs the consent of your legal representative (see the terms of use).

11. Cookies and on-device storage

The App does not use cookies. We use device or browser storage only for the purposes in section 3: keeping you signed in, remembering your chosen language and appearance, and topic suggestions. This is necessary for the service or happens at your own choice, so no separate consent is asked. We do not use any third-party advertising, analytics or tracking technologies.

12. Automated decisions

Based on the data you provide (mode, age, municipality, topics, fields of work and gender if you entered it), the App chooses which laws to show you and which changes to notify you about; topic suggestions are made on your device from the topics of your searches and are only suggestions. This is simple filtering, not an automated individual decision with legal effects on you within the meaning of GDPR Article 22. Excluding under-13s is based on the birth date you entered and is a legal requirement.

13. Changes to this privacy policy

We update this policy when the App's data processing changes (e.g. a new feature or service provider). We will notify you of significant changes in the App. The date of the current version is shown at the top of this document.

14. Contact

For questions about your personal data, write to info@ofthemis.ee.