Privacy Policy
Last updated: 29 October 2026
This policy explains how the MakingMyself app (the "App") processes your personal data, in line with the EU General Data Protection Regulation (GDPR) and Spanish law. This page uses no cookies and no tracking.
1. Data controller
Federico Fernández, self-employed individual (autónomo), NIF 46828066C, c/ Ciclisme 14, Rubí (Barcelona), Spain. Privacy and support contact: fredi@makingmyself.com.
2. Not medical advice; please do not enter health data
MakingMyself supports wellbeing and self-reflection. It is not medical or psychological advice, therapy or a crisis service. If you are in crisis, contact your local emergency services (in the EU, call 112).
The App is not designed to process health data. Please do not enter it in your goals or Moments.
3. Data we process
- Account data: email (only if you register), sign-in provider identifier (Apple, Google or email), and preferences (language, reminder times, rhythm). Passwords are stored hashed with bcrypt, never in plain text. Guests can use the App without an email.
- Content you write: goal texts and Moment event descriptions, plus the expectation texts and audio episodes generated from them.
- Purchase records: store transaction identifiers, subscription status and credit ledger. We do not receive your card details.
- Usage data: listening counts, used to enforce the weekly free limit.
- Analytics: the App includes Firebase Analytics (Google), which collects app usage events and device identifiers to help us understand and improve the App.
- Password reset: your email address and a 6-digit reset code are processed to send the code.
- Safety records: see section 4.
Reminders are local notifications scheduled on your device; their content and timing are not sent to us for delivery. The App contains no advertising SDKs.
4. Safety system
Goal and Moment text passes through an automated safety classifier. Text classified as crisis or self-harm is never stored: we keep only a minimal record consisting of a category (crisis, self_harm, eating_disorder or acute_illness) and a date. Goals and Moments classified as health-related are declined and their text is not stored.
5. Why we process data and legal bases
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Providing the App: account, generating content, enforcing limits, deleting your data | Performance of a contract (6.1.b) |
| Purchases, credits and subscription status | Performance of a contract (6.1.b); legal obligation for accounting and tax records (6.1.c) |
| Analytics (Firebase Analytics) | Consent where required (6.1.a), otherwise our legitimate interest in improving the App (6.1.f) |
| Safety classification, security and abuse prevention | Legitimate interest (6.1.f) |
| Responding to your requests and legal claims | Legitimate interest (6.1.f); legal obligation (6.1.c) |
Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
6. Who processes your data
- OpenAI: generates the texts and speech. Your goal and Moment text is sent to OpenAI to generate content.
- Neon (Databricks): database and file storage (including audio) in AWS eu-central-1, Frankfurt, Germany.
- Google Cloud Run: API hosting in europe-west3, Frankfurt.
- Google Firebase / Firestore: legacy sign-in data from a previous version of the App.
- Google (Firebase Analytics): analytics processor.
- RevenueCat: purchase state management.
- Apple and Google: payments, and Sign in with Apple / Google Sign-In.
- Resend: sends password-reset emails.
These providers act as our processors (or, for Apple and Google payments and sign-in, as independent controllers) and may process data only as needed to provide their service. We do not sell your data.
7. International transfers
Our database and API are hosted in the EU. Some providers, such as OpenAI, Google, RevenueCat and Resend, may process data outside the European Economic Area, including in the United States. Where that happens, transfers rely on appropriate safeguards under GDPR, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
8. Retention
- Account, content and audio are kept until you delete your account, or for as long as needed to provide the App.
- Account deletion is available inside the App. It deletes your account and your content (goals, expectations, audio and Moments), and completes server-side within 24 hours.
- Purchase and transaction records may be kept for the period required by law (for example tax and accounting rules).
- Safety records (category and date only) are kept for as long as needed for abuse prevention.
- Legacy sign-in data in Firebase is kept only as long as needed to let existing users sign in, and removed on account deletion.
- Analytics data is retained by Google according to the retention settings we configure.
9. Your rights
Under GDPR you have the rights of access, rectification, erasure, restriction, portability and objection, and to withdraw consent. To exercise them, email fredi@makingmyself.com; we will reply within one month. You can also delete your account directly in the App. You have the right to lodge a complaint with the Spanish data protection authority, the AEPD: aepd.es.
10. Security
We use measures such as encrypted connections, hashed passwords (bcrypt) and access controls. No system is completely secure, but we work to protect your data.
11. Children
The App is intended for people aged 16 or over. We do not knowingly collect data from younger users; if you believe a child has used the App, contact us and we will delete the data.
12. Changes to this policy
If we make material changes, we will notify you in the App and/or by email before they take effect and update the date above.
13. Contact
fredi@makingmyself.com. See also our Terms of Use.