Privacy Policy
1. Who we are
Poka previews files, in a web app (https://poka.sh) and desktop apps, with paid formats you can buy once or through one subscription.
The controller of your personal data is Bartłomiej Tokarzewski, a sole proprietor in Poland ("we"): ul. Rudzka 5D lok. 85, 01-689 Warszawa, Polska. NIP 1182213149, REGON 386974941. Privacy contact: contact@modeltok.com. We have not appointed a Data Protection Officer or an EU representative.
2. The short version
- Your files never leave your device. The web app previews them in your browser, and the desktop app on your device. We do not receive their contents or names.
- You do not need an account to preview files.
- An account (your email address; you sign in with a link we email you, so there is no password) is only for paid formats.
- Stripe takes payments on its own page. We never see your card number.
- We do not use advertising, analytics or tracking cookies in the Poka apps.
- We do not sell your data.
3. What we use, why, and the legal basis
| What | Why | Basis (GDPR Art. 6(1)) |
|---|---|---|
| Technical request data (IP address, browser or app type, address requested, time), handled by Cloudflare when you load poka.sh or when the desktop app fetches the format catalogue or a format. No file name is sent | To deliver the site and formats, keep them secure and stop abuse | Legitimate interests (f) |
| Your email address and a random account ID | To run your account, send sign-in links, and contact you about your account or purchases | Contract (b) |
| Sign-in links (we keep a one-way hash and your email address) and login sessions (a hash of the session token, expiry, and a device label if the app gives one) | To let you sign in and stay signed in | Contract (b); legitimate interests in security (f) |
| Optional authenticator data: an encrypted secret and hashed recovery codes | To protect your account | Contract (b); legitimate interests (f) |
| Your IP address, in counters that limit sign-in attempts and emails sent | To stop abuse | Legitimate interests (f) |
| A short record of security events on your account (no email or IP address) | Security and support | Legitimate interests (f) |
| What you own or subscribe to, and a purchase record: the format or subscription, the Stripe payment reference, the amount and any refund, whether a chargeback is open, and when you ticked the two boxes at checkout and which terms you saw | To unlock what you bought, handle refunds and disputes, and keep proof of what you agreed to | Contract (b); legitimate interests (f); legal obligation (c) |
| Payment details you give to Stripe. We do not receive or store these. Stripe tells us that the payment worked and sends you the receipt | Payment, fraud prevention, tax and accounting rules | Stripe's own purposes and ours (section 5) |
| Invoices and accounting records | Tax and accounting law | Legal obligation (c) |
| Messages you send us | To answer you | Contract (b); legitimate interests (f) |
| Technical logs of our account service, kept by Cloudflare | Security and fixing faults | Legitimate interests (f) |
Sign-in emails are sent through Cloudflare Email Sending. They contain no images or tracking links.
If you paste a web address into the web app, your browser requests it directly from that site, which sees your IP address under its own policy. We are not part of that request.
You must give us an email address to have an account. Without one we cannot offer paid formats. Previewing files in the free apps needs no personal data from you beyond the technical data above.
We do not make decisions about you by automated means that have legal or similarly significant effects. If you sign up for Poka news on modeltok.com, that is covered by the ModelTok privacy policy there, not this one.
4. What stays on your device
- Web app: your login session and account details (ID, email, account type), and your language choice, in the browser's local storage. Log out or clear site data for poka.sh to remove them.
- Desktop app: a file with your login token, account ID and email, and your language choice. Cached previews and small thumbnails of files you opened, which can contain information from your files. A log file that can contain file names and paths. The format modules you installed. Log out, clear the cache, delete the files or uninstall to remove them.
Logging out removes the copy on your device and deletes the session record on our side. "Log out everywhere" deletes all your sessions. A session you do not log out of expires after 30 days. We keep at most 3 sessions per account: when you sign in on a 4th device, we delete the oldest session, and we write a short security record of it (the event and your account ID, nothing else).
5. Who receives your data
| Recipient | Role | Data |
|---|---|---|
| Cloudflare, Inc. | Our processor: hosting, network, database, logs, sign-in emails | Everything above that we hold |
| Stripe Payments Europe Limited (Ireland), the Stripe entity for customers in the EU | Takes and refunds payments, as a controller for payment, fraud and legal duties, and for the checkout it runs for us | Payment and billing details, your email, your account ID, what you bought |
| Advisers, tax authorities, courts | Controllers in their own right | What the law requires |
| A new owner, if Poka is sold | Controller | What is needed, under this policy |
We have accepted the data processing terms of Cloudflare and Stripe.
Cloudflare and Stripe are US companies and work in many countries. Transfers of data outside the EEA rely on the mechanism in the data processing agreement of the company concerned. You can ask us for a copy of the safeguards.
6. How long we keep data
| Data | Kept |
|---|---|
| Account (email, ID, account type) | Until you delete it or ask us to, or after 24 months of inactivity |
| Login sessions | At most 3 at a time. They expire after 30 days, and are deleted when you log out or when a 4th sign-in replaces the oldest |
| Sign-in link records, and IP counters | 7 days |
| Security event records | 6 months |
| Authenticator data | While it is switched on, and until the account is deleted |
| Purchase, ownership and subscription records | While you have an account, then 5 years from the end of the tax year, for refunds and legal claims. If you delete your account, the purchase record stays without the link to you |
| Accounting and tax records | 5 years from the end of the tax year |
| Support emails | 24 months |
| Server logs | 30 days |
| Data on your own device | Until you remove it |
7. Your rights
Under the GDPR you may:
- see and get a copy of your data (Art. 15);
- have wrong data corrected (Art. 16);
- have your data erased, in the cases the law allows (Art. 17);
- restrict how we use it (Art. 18);
- receive the data you gave us in a portable format (Art. 20);
- object to processing based on our legitimate interests (Art. 21);
- withdraw consent where we rely on it (Art. 7(3));
- complain to a data protection authority: in Poland, the President of the Personal Data Protection Office (UODO), or the authority where you live or work.
To use these rights, email contact@modeltok.com from your account address. We aim to reply within 14 days. The legal limit is one month, which can be extended in some cases. We may need to check it is you.
8. Cookies
The Poka apps set no cookies. They use local storage and files only for things you ask for or that are strictly needed: your login and your language choice, so we do not ask for consent. We use no advertising or analytics cookies, and will ask first if that changes. Stripe's checkout page and Cloudflare may use their own cookies on their own pages.
9. Children and security
You must be at least 18 to create an account or buy. Poka is not aimed at children. If you think a child has given us data, contact us and we will delete it.
We protect data with one-time sign-in links, hashed sign-in and session secrets, encrypted authenticator secrets, signed payment notices, encrypted connections (HTTPS) and sandboxed format modules. No system is perfectly secure. If a breach is likely to put your rights at risk, we will tell the authority and you as the law requires.
10. Changes and contact
We will post changes here with a new date, and email account holders about material ones.
Contact: contact@modeltok.com, Bartłomiej Tokarzewski, ul. Rudzka 5D lok. 85, 01-689 Warszawa, Polska.