VualashPrivacy policy
Last updated: 27 August 2026
Vualash stores what you log so it can show it back to you later. It doesn't sell your data, doesn't use it for advertising and doesn't track you across apps or websites. This is everything there is, with no small print.
Who the controller is
Vualash is an independent project and the controller of this data. There's no team, no investors and nobody else with access. Write to hola@vualash.app about anything to do with this policy or your data.
What data is collected
Only what you put into the app. There are no hidden forms and nothing is taken from your phone behind your back.
| Data | When it's collected | What for |
|---|---|---|
| Email address and password | When you create your account | To identify you and let you in. The password is stored encrypted and nobody — us included — can read it. |
| Your name and profile photo | If you add them, and they're optional | So the app greets you by name. Only you see them. |
| Areas, habits and their targets | When you set them up | To know what you have to tick each day. |
| Your daily ticks | Every time you tick a habit | To count your streak, your consistency score and the calendar map. |
| Written notes | If you write one, and it's optional | Your journal, and the weekly reading. |
| Voice notes (audio) | If you record one, and it's optional | The same as written ones. They're transcribed so you can read them back. |
| Photos | If you add any, and it's optional | So you can see them later by date, next to that day. |
What the app does NOT collect
- No analytics and no advertising. There isn't a single third-party SDK inside the app: no Google Analytics, no Facebook, no advertising identifier.
- No location, contacts, calendar or Health data. The app doesn't ask for those permissions because it doesn't use them.
- Reminders never leave your phone. Your iPhone schedules them; there's no notification server and no token sent anywhere.
On what legal basis
- Performance of a contract (art. 6.1.b GDPR) for everything the app needs to work: your account, your habits and your entries. Without that there's no app.
- Your consent (art. 6.1.a) for the optional parts: notes, audio and photos. You give it by adding them and withdraw it by deleting them, with no explanation needed.
Who else sees it
Nobody else reads it. Three providers host or process it on our behalf, and none of them may use it for anything else:
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Hosts the database, the accounts and the files | Everything in the table above |
| Google (Gemini API) | Transcribes audio and writes the weekly review text | Only that week's notes and audio. Never your email, your photos or your name. |
| Apple | Distributes the app on the App Store | Download and crash data, under its own policy. We receive nothing of yours from there. |
Your notes, your audio and your photos don't train any model. They aren't used for that, not by us and not under our account with Google.
Where it lives and how long
Your account, your entries, your notes, your audio and your photos are hosted in the European Union, on Supabase servers in Ireland. They aren't stored anywhere else.
The only thing that leaves the Union is what's sent to Google to transcribe audio or write your weekly review. That transfer relies on the standard contractual clauses approved by the European Commission. Only that week's text and audio are sent — never your email, your name or your photos — and nothing is stored there.
Data is kept for as long as you have an account.
When you delete your account, everything is deleted immediately and permanently. The provider's backups may hold a copy for a few more days until they rotate on their own; they can't be queried and aren't used for anything.
How it's protected
- Everything travels encrypted (HTTPS) and is stored encrypted at rest by the provider.
- Photos and audio live in private buckets: no public address serves them. The app requests a signed link that expires on its own.
- The database has row level security enabled on every table: each query is tied to who makes it, so one account cannot read another's data, not even through a programming mistake.
How to delete your account
From inside the app, without asking anyone: Today tab → your avatar, top right → Your profile → Delete my account, at the very bottom.
Your entries, your notes, your audio, your photos and the account itself are deleted. No copy is kept “just in case” and it can't be undone.
If you no longer have the phone to hand, write to hola@vualash.app from the account's email address and we'll do it for you.
Your rights
You can exercise your rights of access, rectification, erasure, restriction, objection and portability at any time. Most of them you can settle yourself inside the app; for the rest, write to hola@vualash.app and you'll have an answer within a month.
If you believe your data isn't being handled properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the supervisory authority in your country.
Age
Vualash is for ages 9 and up. There's nothing inside that a child shouldn't see: no purchases, no advertising, no strangers, and nothing about bodies or weight.
Having an account is a different matter, because it means storing data. In Spain, below 14 it's a parent or guardian who gives permission for that data to be processed (article 7 of the LOPDGDD). So if you're under 14, one of them creates the account with you and gives the permission.
If you're a parent or guardian and would rather that account didn't exist, write to hola@vualash.app and it will be deleted in full, with everything in it.
Changes to this policy
If anything changes, the date at the top changes and it's explained here. If the change affects what data is collected or who receives it, you'll also be told inside the app before it takes effect.