Privacy policy

The controller of your data is Juan Manuel Baracat (JMB Studio), owner of the Meditar app. For any privacy question, or to exercise your rights, write to us at contacto@meditar.app.

• Email address. When you create an account or sign in with a one-time code (OTP). We use it to identify you and give you access to your subscription.
• Device identifier (no longer used). Older versions of the app sent an anonymous identifier generated on your device to count free meditations. That count is now tied to your user account: if your app still sends it, our server discards it and stores it nowhere.
• Subscription and payment data. If you subscribe, Stripe processes the payment. We don't store your card details; we only keep the state of your subscription (active, trialing, cancelled) and the identifiers needed to manage it.
• Technical usage data. The minimum needed for the app to work (for example, which meditation you requested so we can deliver the audio).
• App errors. When something fails — a purchase that doesn't go through, a meditation that won't load, an account that can't be deleted — we store the error's technical code, the message describing it (truncated, with any links reduced to their originating server), the app version, the platform, the date and how many times it recurred, linked to your account. It's what lets us find and fix the problem, and we delete it after 90 days. We collect no device identifiers and no advertising data.
• App usage. To know whether the product works — how many people start a meditation and finish it, with which voice, and whether the subscription screen shows up at a good moment — we store, linked to your account: which meditation and which voice you listened to, how long it played, how far you got and how long it was, which screen you opened it from, whether your subscription was active at the time, the platform and the date. Also whether the subscription screen was shown to you and whether you closed it. We delete this after 400 days; after that we keep only daily totals that aren't linked to any person. We collect no device identifiers, no location, no advertising data, and we use no third-party analytics tools.

We show no ads, we don't sell your data, and we use no third-party advertising trackers.

If you leave your email on meditar.app so we can tell you about the launch, we store it for that purpose only, on the basis of your consent. We'll send you the launch notice and you can unsubscribe at any time: every email includes an unsubscribe link, and you can also write to us at contacto@meditar.app and we'll delete it.

To protect the form from bots we use Cloudflare Turnstile, which may process technical data about your browser and your interaction with the page to tell people apart from automated programs. You can read the Turnstile privacy policy.

• Giving you access to the app, your account, and your subscription.
• Applying the free meditation limit before you subscribe.
• Processing and managing payments and renewals.
• Sending you essential service emails (such as your sign-in code).
• Preventing abuse and keeping the service secure.

We process your data on the following legal bases under the General Data Protection Regulation (GDPR):

• Performance of a contract: to provide the service and manage your account and subscription.
• Legitimate interest: to apply the free usage limit, prevent fraud, and maintain security.
• Consent: where it applies, and you can withdraw it at any time.

We share data only with providers that help us run the service, and only what that function requires:

• Supabase — authentication and database.
• Stripe — payment and subscription processing.
• Cloudflare — audio storage and delivery, and bot protection (Turnstile) on the waiting-list form.
• Resend — sending service emails (sign-in codes).
• Vercel — hosting our website and server.
• Google Play / Apple App Store — app distribution.

Some of these providers may process data outside the European Economic Area. Where that happens, the safeguards required by the GDPR apply (such as standard contractual clauses).

We keep your data for as long as your account is active or as long as we need it to provide the service. If you ask us to delete your account, we erase your personal data, except what we must keep to meet legal obligations (billing records, for example).

You can exercise the following rights at any time:

• Access your data.
• Correct it if it's inaccurate.
• Ask us to delete it.
• Object to or ask us to restrict its processing.
• Ask for your data to be ported.
• Withdraw your consent where consent is the basis for processing.

To exercise them, write to us at contacto@meditar.app. If you are in Spain and believe we didn't handle your request properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es). If you are elsewhere in the EU, you can complain to your local supervisory authority.

Meditar is not directed at children under 14 and we do not knowingly collect their data. If you believe a child has given us data, write to us and we'll delete it.

We may update this policy to reflect changes in the service or in the law. We'll publish the version in force on this page, with its update date.