Privacy Notice

• Account data (email address, login credentials, display name) — to create and secure your account. Legal basis: performance of our contract with you.
• App content (your 30-day goal, daily tasks, completions, chosen cause, impact ledger) — to provide the Service and show your journey and impact. Legal basis: contract.
• Membership data (subscription status, period dates, payment provider references) — to give you access to paid features. Legal basis: contract. Card details are never seen or stored by us; they are handled by our payment provider.
• Technical data (device type, browser, IP address, error and usage logs) — to keep the Service secure, prevent fraud and fix bugs. Legal basis: our legitimate interest in a safe, working product.
• Support messages you send us — to answer you. Legal basis: legitimate interest.
• Notifications (device reminder permissions) — only if you opt in. Legal basis: consent, which you can withdraw at any time in your profile.

• Payment processor: paid memberships are currently disabled. If we re-enable them, a third-party payment processor will handle the sale, subscription management, payments, invoicing and tax compliance.
• Service providers / subprocessors: our hosting and database provider, which stores your account and journey data on our behalf.
• Professional advisers (legal, accounting) where necessary.
• Authorities where we are legally required to disclose data.

We do not sell your personal data and we do not share individual habit data with the social organisations shown in the app; contributions are aggregated.

Our providers may process data outside the EEA/UK. Where that happens, transfers are protected by an adequacy decision or by Standard Contractual Clauses.

We keep account and journey data while your account exists and for a reasonable period afterwards so you can come back. If you delete your account, we delete or anonymise your personal data, except records we must keep for legal, accounting or fraud-prevention reasons (typically up to 6 years for transaction records).

Under the GDPR you have the right to access, rectify, erase, restrict or port your data, to object to processing based on legitimate interests, and to withdraw consent at any time. Write to areapetita@gmail.com and we will respond within one month. You also have the right to complain to your local supervisory authority (in Spain, the Agencia Española de Protección de Datos).

We use appropriate technical and organisational measures, including encrypted connections, hashed passwords, access controls and row-level database rules so that each account can only reach its own data.

We use essential cookies and browser local storage to keep you signed in and to store your journey progress on your device. We do not use advertising cookies. Our payment provider may set cookies required to complete checkout securely. You can clear this data at any time in your browser settings, though the app may then not work as expected.

We will update this notice when our processing changes and will indicate the date of the latest version at the top of this page.