Polski

Privacy policy

Version 2026-11-03

1. Who is responsible for your data

The controller of your personal data is Krzysztof Fiok, ul. Skalbmierska 14/9, 01-848 Warszawa, Poland, NIP 7010098607 ("we"). Contact for all privacy matters: contact@headlinehaha.com.

2. What we collect

• Account data from Google sign-in: your Google account identifier ("sub"), email address and name. We never see your Google password.
• Credits and free jokes: how many free jokes you have left, your credit balance and credit history (for example, once available, purchases).
• Usage records for each joke: date and time, AI model, number of input and output tokens, the cost in credits and the technical result (for example "completed" or "declined").
• API tokens (only if you create them): for each personal API token (an access key that lets an AI agent use the service for you): a one-way hash of the token (never the token itself), its first characters, the label you gave it, and when it was created, last used and revoked. Jokes requested with a token are recorded like any other joke (see the usage records above).
• Terms acceptance: which version of the terms you accepted, and when.
• Preferences: the website language, the joke language and the news region you chose (short codes such as "pl"). They are part of your account data and of the data download.
• Session cookie: a signed cookie containing your internal account number, so you stay signed in.

What we do not store: the topic you type or the headline you pick, and the jokes themselves. To write a joke, the topic (or the chosen news headline and its short summary) is sent to Anthropic, without your name, email or any account identifier, and is not saved by us. The same applies to the optional style instructions with which customers who bought credits can steer a joke ("steer the joke"): they are sent to Anthropic only to write that joke, and are neither stored nor logged by us.

Payments (once available): Paddle collects your payment details. We only receive the Paddle transaction id, amount, currency and which account to credit.

3. Why we use your data, and on what legal basis

• To provide the service you signed up for: sign-in, your account, credits and jokes (art. 6(1)(b) GDPR, performance of a contract).
• Once payments exist: to keep accounting and tax records required by law (art. 6(1)(c) GDPR, legal obligation, under Polish tax and accounting law).
• To keep the service secure and prevent abuse, for example rate limits and short-lived technical error logs that contain only your internal account number (art. 6(1)(f) GDPR, our legitimate interest).

We do not use your data for advertising or profiling, and we make no automated decisions that have legal or similarly significant effects on you.

4. Who receives your data

• Google (Google Ireland Limited / Google LLC): sign-in with your Google account.
• Anthropic (Anthropic, PBC, USA): generates the jokes (the Claude AI model). It receives only the joke topic or news item, never your name, email or account details.
• Hetzner (Hetzner Online GmbH, Germany): hosts our servers in the EU.
• Paddle (Paddle.com Market Limited, UK), once payments are available: our reseller and Merchant of Record. Paddle sells you the credit packs and processes your payment and billing data as an independent controller under its own privacy policy.

5. Transfers outside the EU

Google LLC and Anthropic, PBC are based in the USA. Transfers to them rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (art. 46(2)(c) GDPR). Paddle is based in the United Kingdom, which has an EU adequacy decision.

6. How long we keep data

• Account data, credit balance, usage records and API token records (also of revoked tokens): until you delete your account.
• Payment and accounting records (once payments exist): 5 years from the end of the calendar year of the payment, as required by Polish tax law. If you delete your account, these records are anonymized: they stay, but are no longer linked to you.
• Technical logs: a short time only; they are rotated automatically.

7. Your rights

You have the right to access your data, to have it corrected, to have it erased, to restrict processing, to data portability, and to object to processing based on our legitimate interest. On your account page you can download all your data (JSON) and delete your account yourself. Your name and email come from Google: change them there and sign in again, or write to us. For anything else, email contact@headlinehaha.com.

You also have the right to lodge a complaint with the Polish data protection authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

8. Cookies

We use only strictly necessary and functional cookies: the session cookie that keeps you signed in and protects the sign-in process (it expires after 14 days or when you log out), and the preference cookies lang and region that remember the website language and news region you chose. They hold only a short code, nothing that identifies you, and expire after one year. We use no analytics, advertising or tracking cookies, and our pages load no third-party scripts, fonts or images. Strictly necessary cookies do not require consent, so there is no cookie banner.

9. Changes

If we change this policy in an important way, we will ask you to review and accept it again the next time you use the service.