Privacy Policy

Information We Collect

Specko monitors the official gazette, the Croatian Employment Service, the Ministry of Health and Croatian hospital websites for specialisation tenders, and shows what they publish in the app. For residents it also gathers public guidelines, articles and professional events. Very little of what we hold is about you, and an account is optional.

Data We Collect:

Tender, publication and event information from public sources
A device identifier the app sends us, so a free trial or a gift code stays with your device
If you create an account: your email address and sign-in details, your profile (username, specialty, year of residency), the devices you link and the items you save
Support messages you send us, including an email address if you choose to give one
Website analytics, plus technical information such as IP addresses and browser details, for security and to measure use

How We Use Information

The information we collect is used to:

Provide and maintain the Specko service
Display tenders, and the guidelines, articles and events for each specialty
Run your account if you create one: sign-in, access, linked devices and saved items
Improve our service and user experience
Ensure service security and prevent abuse

Data Sources and Web Scraping

Specko aggregates tenders, publications and events from publicly available sources, including:

The official gazette (Narodne novine) and its tender adverts
Croatian Employment Service (HZZ) - Burza Rada job listings
Ministry of Health (Ministarstvo zdravstva) official announcements
Croatian hospital websites with publicly posted job openings
PDF and other documents published by those sources
PubMed, Hrčak and the guideline publishers and public-health bodies we follow, such as ECDC, the WHO, HZJZ and HALMED
The Croatian Medical Chamber's (HLK) list of accredited events, EACCME and professional societies' congress pages

Important: All tender, publication and event information displayed on Specko comes from publicly available websites and official announcements, and contains no personal data about you; publications carry their authors' names and events their organisers', as published. Users seeking to apply for positions should visit the original source websites directly. The personal data we do hold is your device identifier, your account if you create one, and anything you send us through support, all described below.

Automated Reading by an AI Model

To show a tender's positions, institution and deadline, to summarise guidelines and articles, and to sort events into specialties, we send public texts to Anthropic, whose AI model reads them and returns those details.

Only public texts are sent — tender documents, the titles, abstracts and other published details of publications, and event titles and congress pages — never anything about you, your account, your device or how you use the app
Some documents, such as a decision on selected candidates, name the people chosen; the model is told not to return names and its answer has no field for one, so no name is added to what Specko shows
The documents themselves are public, and are kept and linked as their publisher released them
Anthropic processes these texts under its commercial terms, which do not allow them to be used to train its models

Data Storage and Security

We store tenders, publications and events in our database to provide fast search and filtering. This data includes:

Tender titles and descriptions
Publication dates and deadlines
Employer information and locations
Positions and specialisations read from tender documents
Publications' titles, authors, journals, dates and abstracts, and our summaries of them
Events' titles, dates, places, organisers and HLK points
Links to original job postings

We implement appropriate security measures to protect stored data and regularly update our systems to maintain security standards. Our database is hosted by Supabase in the European Union.

Your Device Identity

Tenders, the calculator and reading the residency content need no account. Instead the app sends us an identifier generated on your device — a Keychain UUID on iOS, the Android ID on Android. It is what lets a free trial or a gift code stay attached to your device without you registering for anything.

What we store against it:

When your free trial started
When a gift-code grant expires, if you redeemed one, and the code itself
A count of failed code attempts, and any temporary lock, so a device cannot guess codes
Nothing else — no email, no contact details, and no record of what you viewed or searched for. If you sign in and link the device to your account, that link is stored too, as described under Your Account

Worth knowing:

The identifier is pseudonymous: on its own it does not tell us who you are, but it is still personal data under the GDPR and we treat it as such
If we gave you a gift code personally, we keep a short note of who it was for, and once you redeem it that note sits beside your device identifier
Until you sign in, it is deliberately the same identifier the app gives RevenueCat as its subscription user id, so there is one identity per device rather than two
Some of our endpoints carry it in the web address, so it appears in our hosting provider's standard server logs alongside every other request path
We never write it to our own application logs, and it is excluded from our error reports

Legal basis:

Performance of the service you asked for: without it we cannot tell whether your trial has already been used, and a gift code could not be honoured. You can ask us to delete it at any time — see Your Rights below.

Your Account (Optional)

You need an account only to save guidelines, articles and events, and for the community features we add; everything else works without one. You sign in with Apple, Google or a one-time code sent to your email address. Sign-in is run by Supabase Auth, and we never see a password, because there is none.

What an account holds:

Your email address and the way you sign in; with Sign in with Apple this can be a private relay address Apple creates for you
What your sign-in provider passes on, such as your name and profile picture with Google, or the name you give Apple, and the times you sign in, with the IP address and device or browser details that Supabase Auth keeps for security
Which of our apps the sign-in is used with, and whether it was created for Specko
Your profile: the username you choose, your specialty, your year of residency if you give it, and when you accepted the community rules
Up to three devices you link to it, by device identifier, and when each was last linked
When the account's free trial started — the earliest trial of the devices it has linked — and the last answer RevenueCat gave about its subscription, which we rely on for an hour at most before asking again
The guidelines, articles and events you save, and when you saved them
Your posts in community features, once those exist

Worth knowing:

Other members see your username; your email address is never shown to anyone
The sign-in is shared with Imenko, another app by the same developer, so the same email address can sign in to both; each app keeps its own profile, and Imenko does not use any of your Specko data
After you sign in, the app gives RevenueCat your account id as the subscription user id and restores your purchase onto it, so the subscription follows the account; we ask RevenueCat only whether the account has an active subscription
We never write your account id, email address or sign-in token to our own application logs or error reports

Retention and deletion:

We keep your account for as long as you have it. You can delete it at any time in the app's settings, which at once removes your profile, linked devices, the account's trial record, the stored subscription answer and your saved items. Posts in community features stay so that threads remain readable, but are shown under "[obrisani korisnik]" (deleted user) instead of your username. For now the sign-in itself — your email address and sign-in method — is kept, with Specko removed from it, because it may be the same sign-in you use for Imenko; if you use only Specko, email us and we will delete it too.

Legal basis:

Performance of the service you asked for: the account exists because you created it, to save items and take part in the community. Keeping posts after an account is deleted rests on our legitimate interest in threads that still make sense to the people who took part in them.

Push Notifications

Push notifications are sent through Google Firebase Cloud Messaging. We do not keep a list of devices or of anyone's notification choices.

If you allow notifications, your device registers with Firebase and joins a topic for all new tenders
If you choose to be notified only about some tenders, your device instead joins topics named after the specialisations, professions, counties and institutions you picked, and Google holds those subscriptions
If you switch the app to resident mode, it leaves the tender topics and joins one topic for your specialty, which carries new guidelines and the weekly, monthly and yearly digests; switching back reverses this
The app decides which topics to join, on your device; we only publish a message to a topic and never learn which devices receive it
Changing your choices, turning notifications off or uninstalling the app removes the subscriptions

Legal basis:

Your consent, given when you allow notifications on your device. You can withdraw it at any time in the app or in your phone's settings.

Support Messages

If you contact us through the support form or by email, we store what you send so we can reply and keep track of the issue.

What we store:

The subject and message you wrote
Your email address, but only if you chose to give one — it is optional and the form works without it
The date you sent it

Retention:

We keep support messages for as long as they are useful for handling the issue and any follow-up, and delete them on request.

Legal basis:

Our legitimate interest in answering people who contact us. Support messages are never published, never shown in the app, and never used for marketing.

Points Calculator

What you enter into the points calculator — grades, work history, publications and the like — is stored on your device only.

It is never sent to us or to any of the services listed below, and it is never included in analytics or error reports
The calculation happens on your device; the only thing it downloads from us is the rulebook itself
If analytics is on, we record only that the calculator was used, with your profession and the rulebook version, and which rule's explanation or document you opened — never a figure or a date you entered
Deleting the app, or clearing its data, deletes your entries

Mobile App Analytics and Crash Reporting

Our mobile app uses Firebase Analytics, Firebase Crashlytics and Sentry to help us understand how the app is used and to identify and fix technical issues.

Data We Collect:

Usage Events: Screen views, search queries, filter selections, and feature usage
Device Information: App version, device model, operating system version, and language settings
Crash Reports: Stack traces and error logs when the app crashes or encounters errors, and — through Sentry — the web address and method of a request our server failed, never its content
NOT Collected: We do not collect any personally identifiable information (names, emails, phone numbers, etc.)

Purpose:

Improve app performance and user experience
Identify and fix bugs and crashes
Understand which features are most used
Optimize app functionality

Your Rights:

You can opt out of analytics and crash reporting at any time, which switches off Firebase Analytics, Crashlytics and Sentry together:

Opening the app Settings menu
Navigate to Privacy section
Toggle off "Analytics & Crash Reports"

Data Retention:

Firebase Analytics data is automatically deleted after 14 months. Crash reports are retained for 90 days. You can request deletion of your data at any time by contacting us.

Legal Basis:

We process this data based on our legitimate interest in improving our app and fixing technical issues. This processing is GDPR-compliant and does not involve selling or sharing your data with third parties for marketing purposes.

Subscription and Payment Processing

Our mobile app offers a premium subscription (Specko Pro) that provides full access to all features, including tender listings, push notifications, filtering, the points calculator and the residency hub.

Payment Processing:

All payments are processed securely through the Apple App Store or Google Play Store
We do NOT have access to your payment card information - all payment details are handled directly by Apple or Google
Subscription management is handled through RevenueCat SDK, which securely communicates with app store APIs

Subscription Data We Collect:

Subscription status (active, expired, or in grace period)
Purchase history and entitlements
Your device identifier, which RevenueCat uses as your subscription user id — or, once you sign in, your account id
Subscription expiration dates

Data Retention:

RevenueCat holds subscription data on our behalf for as long as it is needed to honour your purchases. You can request deletion of your subscription data at any time by contacting us.

Third-Party Services

Specko may use third-party services for:

Database hosting, and sign-in and sign-in emails for accounts (Supabase)
Application hosting, website analytics and performance measurement (Vercel)
Website analytics (Umami)
Error and crash reporting (Sentry)
Mobile app analytics and crash reporting (Google Firebase Analytics & Crashlytics)
Push notifications and notification topics (Google Firebase Cloud Messaging)
Subscription and payment management (RevenueCat)
Sign-in with an Apple or Google account, if you choose it (Apple, Google)
Reading public tender documents, summarising public guidelines and articles, and sorting events into specialties (Anthropic)

Some of these providers process data outside the European Economic Area. Where they do, the transfer relies on the safeguards in their own data-processing terms, such as the European Commission's standard contractual clauses.

These services have their own privacy policies and we encourage users to review them:

Cookies and Tracking

Specko's website uses no advertising cookies and no cross-site tracking. What it does use:

A local setting remembering your dark-mode choice, stored in your browser and never sent to us
Umami, a cookieless analytics service that counts visits without profiling you or following you across other sites
Vercel Analytics and Speed Insights, which measure page views and loading performance

Because none of this sets an advertising or tracking cookie, there is no consent banner to click through. You can still block these scripts through your browser settings.

Your Rights

Under the General Data Protection Regulation you have the following rights over the personal data we hold about you — your device identifier and what we store beside it, your account if you have one, and anything you sent us through support:

Access — ask what we hold and receive a copy
Rectification — have inaccurate data corrected
Erasure — ask us to delete it
Restriction — ask us to stop using it while a concern is resolved
Portability — receive it in a machine-readable form
Objection — object to processing based on our legitimate interests

How to exercise them:

Email us and say what you want. For anything tied to your device, include the device identifier — the app shows it in Settings, under Privacy. We cannot find your record without it, because it is the only key we hold. You can delete your account yourself in the app's settings; for any other request about it, email us from the address you sign in with, so we can tell the account is yours.

Complaints:

If you believe we have mishandled your data, you can lodge a complaint with Croatia's supervisory authority: Agencija za zaštitu osobnih podataka (AZOP)

Contact Information

For privacy-related questions or concerns, please contact us at:

Email: developer@solar-blue.com

Changes to This Policy

We may update this privacy policy as the service changes. Changes are posted on this page with a new revision date, and if a change affects how we use your personal data we will tell you in the app or on this page before it takes effect.

Last updated: October 5, 2026