Privacy at Labelador

Controller and contact

Tomasz Fiedoruk is the controller of personal data processed for this service. The project is in a private, free phase; the operator has decided not to publish an address. For data questions and requests, use https://fiedoruk.pl/#kontakt. This does not change the processing rules described below.

What stays in your browser

Designs, working photo sources, label and QR contents, favourites and editor choices are saved in the browser where its settings permit. You save PNGs and project files yourself on your device. With private project sharing disabled, ordinary editing does not send that content to Labelador’s server.

Local storage and settings necessary for a requested editor feature support the service. You may remove them in the app or browser, but can lose your design without a backup. A QR code may itself include personal details or a Wi-Fi password: review it before downloading or showing the file.

Local storage and public-page analytics

Local storage for designs, working photos and preferences needed by requested features is separate from analytics. The standard Plausible script loads automatically on every public Labelador page, without a separate consent gate in the interface and without being disabled by Do Not Track or Global Privacy Control. The absence of an analytics cookie does not mean there are no external requests or no personal data.

The legal basis and information duties for necessary local storage and automatic analytics need to be assessed against the real service configuration. This description of behaviour is neither a claim of full legal compliance nor a blanket exemption from legal duties.

What automatic analytics covers

Public pages load the exact script https://skad.click/js/script.file-downloads.hash.outbound-links.pageview-props.revenue.tagged-events.js for the 404.tf site. It automatically records pageviews, including URL-fragment changes, and outbound-link and file-download clicks. skad.click may receive the full page URL with query parameters and #hash, the referrer, and the clicked outbound or download URL. Do not put passwords, tokens, label contents or other confidential material in an address, parameter, fragment or file link. The script is not loaded in the admin panel or on private pages with a sharing token.

Labelador feature events use plausible() and 11 fixed labelador_* goals. Their properties are limited to five names: source, channel, downloadKind, elementKind and category, with allowlisted values. We do not put label text, photos, Wi-Fi passwords, project or printer IDs or Bluetooth data in those properties. The standard script and network connection can nevertheless provide skad.click with IP address, User-Agent and the information described above. Labelador does not use analytics to sell data or make consequential automated decisions; we do not claim analytics can never involve personal data.

Website connections, hosting and administration

Visiting the site may create technical logs at the hosting provider and Cloudflare, such as request time, IP address, resource path, status and browser headers. Security and service operation may rely on the controller’s legitimate interests, balanced against visitors’ rights. Current recipients, any transfers and real log periods appear in the separate Processing details block; they must be verified against supplier contracts and configuration before publication.

The private operator panel uses Cloudflare Access and JWT verification, a Secure/HttpOnly/SameSite=Strict session cookie and CSRF token for changes. A session lasts at most eight hours and expires after 30 minutes idle. Operator actions are recorded in an audit log. This is not a customer account for the editor.

Contact outside Labelador

The contact link opens a form on fiedoruk.pl. Data submitted there is handled under its separate policy: https://fiedoruk.pl/polityka-prywatnosci. Do not put passwords, identity document numbers or full private designs in a form unless necessary to resolve the matter.

Recipients, transfers and periods

Supplier categories include website hosting, traffic protection and the skad.click analytics operator on public pages. We do not assert unverified transfer locations or storage periods. The Processing details block gives current processors, locations and concrete periods or assessable criteria for each category, based on actual contracts and configuration.

Local data remains until you remove it, browser storage is lost or device capacity limits intervene; we have no remote copy to restore. Server-log, analytics-event and admin-audit retention must be confirmed and published separately.

Your rights

Depending on the legal basis and circumstances, you may seek access, rectification, erasure, restriction, portability or object to processing. Not every right applies in every case. You may complain to Poland’s data protection authority, the President of UODO. Current public-page analytics has no Labelador consent setting or DNT/GPC switch; send questions or objections through the operator form.

We respond to a personal-data request without undue delay, normally within one month. Complexity or volume can justify up to two further months; we will notify you of the extension and its reason within the first month. If data exists only in your browser and we cannot access it, we will explain this limit and how you can download or erase it yourself.