Privacy policy

The controller of your data is Juan Manuel Baracat (JMB Studio), owner of the Meditar app. For any privacy question, or to exercise your rights, write to us at contacto@meditar.app.

• Email address. When you create an account or sign in with a one-time code (OTP). We use it to identify you and give you access to your subscription.
• Device identifier. An anonymous identifier generated on your device (not your name, not your account). It lets us offer free trial meditations and count how many you've used without asking you to register.
• Subscription and payment data. If you subscribe, Stripe processes the payment. We don't store your card details; we only keep the state of your subscription (active, trialing, cancelled) and the identifiers needed to manage it.
• Technical usage data. The minimum needed for the app to work (for example, which meditation you requested so we can deliver the audio).

We show no ads, we don't sell your data, and we use no third-party advertising trackers.

If you leave your email on meditar.app so we can tell you about the launch, we store it for that purpose only, on the basis of your consent. We'll send you the launch notice and you can unsubscribe at any time: every email includes an unsubscribe link, and you can also write to us at contacto@meditar.app and we'll delete it.

To protect the form from bots we use Cloudflare Turnstile, which may process technical data about your browser and your interaction with the page to tell people apart from automated programs. You can read the Turnstile privacy policy.

• Giving you access to the app, your account, and your subscription.
• Applying the free meditation limit before you subscribe.
• Processing and managing payments and renewals.
• Sending you essential service emails (such as your sign-in code).
• Preventing abuse and keeping the service secure.

We process your data on the following legal bases under the General Data Protection Regulation (GDPR):

• Performance of a contract: to provide the service and manage your account and subscription.
• Legitimate interest: to apply the free usage limit, prevent fraud, and maintain security.
• Consent: where it applies, and you can withdraw it at any time.

We share data only with providers that help us run the service, and only what that function requires:

• Supabase — authentication and database.
• Stripe — payment and subscription processing.
• Cloudflare — audio storage and delivery, and bot protection (Turnstile) on the waiting-list form.
• Resend — sending service emails (sign-in codes).
• Vercel — hosting our website and server.
• Google Play / Apple App Store — app distribution.

Some of these providers may process data outside the European Economic Area. Where that happens, the safeguards required by the GDPR apply (such as standard contractual clauses).

We keep your data for as long as your account is active or as long as we need it to provide the service. If you ask us to delete your account, we erase your personal data, except what we must keep to meet legal obligations (billing records, for example).

You can exercise the following rights at any time:

• Access your data.
• Correct it if it's inaccurate.
• Ask us to delete it.
• Object to or ask us to restrict its processing.
• Ask for your data to be ported.
• Withdraw your consent where consent is the basis for processing.

To exercise them, write to us at contacto@meditar.app. If you are in Spain and believe we didn't handle your request properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es). If you are elsewhere in the EU, you can complain to your local supervisory authority.

Meditar is not directed at children under 14 and we do not knowingly collect their data. If you believe a child has given us data, write to us and we'll delete it.

We may update this policy to reflect changes in the service or in the law. We'll publish the version in force on this page, with its update date.