Privacy Policy

2. Data controller

3. Data we process

Account data

• Name: the one you give, or the one Google or Apple send us if you sign in with them (Apple sends it on the first sign-in only).
• Email address. With Apple it may be a private relay address; we treat it the same way.
• Password, of which we keep only a secure hash, never the text.
• Sign-in provider, time zone, language and app preferences.
• Plan, available credits and use of the artificial-intelligence features.

Your content

• Dreams, journal, notes, tags, characters, collections and day marks.
• Conversations with Alma and the Council readings you request.
• Your context (approximate age, life situation and whatever you choose to tell) and Alma’s memory: what Alma notes down to remember what you have told it. You can see and delete it in Settings › Alma.
• The questionnaire about how you dream, if you answer it.

Voice, audio and images

• Dictation: the audio is sent for transcription and not stored; only the resulting text is kept.
• Voice notes and audio you attach to an entry: kept with the entry until you delete it.
• Images you attach to an entry or to Alma, and your profile photo if you upload one.
• Read aloud: the text of Alma’s reply is turned into audio; the generated audio is kept so it is not generated twice and is deleted with your account.

Circles

What you share in a circle (a full dream, a summary or an anonymous version, as you choose), your messages and your comments are visible to the circle’s members and to its guide. Everything else is yours alone: nobody but you sees it, except authorised staff when needed to give you support.

Technical and usage data

• IP address: used for security, usage limits and to infer the country. It is not stored in visit measurement.
• Browser, operating system and device type.
• Pages visited and, only with your permission, clicks and reading time (see section 12).
• In the Android and iPhone apps: platform, app version and, if you allow it, the notification identifier (see section 9).

Newsletter and free guides

If you request a free guide or join the newsletter from the website, we keep:

• Your email address
• The date you gave your consent and the date you confirmed it from your inbox
• Whether you asked for the newsletter (on the guide pages it is a separate, optional checkbox)
• The page you signed up from, the guide you requested and, if you came from a campaign, its name

We use this data only to send you the guide you requested and, if you ticked it, the newsletter. The legal basis is your request for the guide and your consent for the newsletter, which you can withdraw at any time with the unsubscribe link in every email. Emails are sent through Resend. If you unsubscribe, we stop writing and keep only the record of the unsubscription.

Payment data

• On the web, Stripe processes the payment; we receive the billing identity and the purchase history.
• In the apps, Apple (App Store) or Google (Google Play) process the payment; we receive, through RevenueCat, the subscription status linked to your account.
• We never receive or store your card number.

Instagram and Facebook

When you comment on one of our posts, we read the comment through Meta’s API (your public name on Instagram or Facebook, the text and its identifier) to reply, for example to send you the guide you asked for. We keep only what is needed to reply and to avoid replying twice.

Support

What you write to us by email or through the contact form, and the Alma replies you flag with “Report this reply”.

4. What we use it for

• Providing the service: keeping your journal, searching it and showing you your own records.
• Generating Alma’s replies, the Council readings and the transcriptions of your dictations with artificial intelligence (section 6).
• Running the circles you join.
• Managing your plan, your credits and payments.
• Sending you notices about your account, your readings and your circles, and the notifications you turn on.
• Keeping the service secure, preventing abuse and applying usage limits.
• Measuring how many visits the site receives and improving the service.
• Meeting accounting, tax and legal obligations.

5. Legal basis

• Performance of a contract: the account, your journal, Alma, the readings, the circles and payments (Art. 6(1)(b) GDPR).
• Consent: sending your text and your voice to artificial-intelligence providers; the use of models served outside the European Union and the United States, which require a separate consent; visit measurement with identifiers; the newsletter; notifications (Art. 6(1)(a)). You can withdraw it at any time without affecting earlier processing.
• Legitimate interest: security, abuse prevention, usage limits, error reports without identity and the anonymous count of pages visited (Art. 6(1)(f)).
• Legal obligation: invoicing and accounting (Art. 6(1)(c)).

Special categories. What you write about your dreams and your life may reveal data about health, beliefs, orientation or emotional life. We process it only to provide the service you asked for and on the basis of your explicit consent (Art. 9(2)(a)): in the apps, the “Before you start” notice; on the web, by using Alma, dictation and the readings. If you withdraw it, those features stop being available, but you keep your journal.

6. Artificial intelligence

Alma, the Council readings, search, dictation and read-aloud run on models from external providers. For that we send those providers what is needed and nothing more:

• The text of the entries and questions Alma needs to answer you, and the dream series and profile you submit to the Council.
• The text of each entry, to compute the numerical representation that makes your journal searchable.
• The audio of your dictations and voice notes, to transcribe it.
• The text of an Alma reply, to turn it into speech if you ask to hear it.

Who processes it. OpenAI (the GPT-4o model of the “Balanced” level, transcription with Whisper, read-aloud and search), and OpenRouter, which routes calls to the models of Anthropic (Claude, used by the Council and by the “Maximum” level), OpenAI, Z.AI and Moonshot AI. The Z.AI and Moonshot AI models are served from Singapore and are used only if you choose them in Settings › Alma and give your express consent for each one.

These providers act as processors. Under their API terms they do not use your content to train their models and keep it only for as long as those terms set for abuse detection. Alma’s and the Council’s replies are generated by artificial intelligence, are labelled as such and do not replace the care of a professional. We make no automated decisions that produce legal effects on you.

Web lookups. To document an etymology, a myth, a number or a date, Alma and the Council may consult approved public reference sources. Only the term being looked up leaves — a word, the name of a myth, a number, a date — never your text or a person’s name; the code enforces this, not an instruction to the model. Crisis-language detection runs on our servers, sending nothing to third parties.

7. Recipients

We do not sell data, there is no advertising and we use no third-party analytics. We share data only with the processors we need to provide the service, each under its own processing agreement:

• Supabase: database, authentication and files. Your data is hosted in London (United Kingdom).
• Vercel: hosting and running the service in London (United Kingdom); a company based in the United States.
• OpenAI: language model, transcription, read-aloud and search (United States).
• OpenRouter and the model providers it routes to: Anthropic and OpenAI (United States), Z.AI and Moonshot AI (Singapore, only with your consent).
• Resend: sending account emails, notices and the newsletter (United States).
• Stripe: payments on the web (Ireland and United States).
• RevenueCat: status of subscriptions bought in the apps (United States).
• Apple: App Store purchases, Sign in with Apple and notifications on iPhone (United States).
• Google: Sign in with Google; Google Play purchases and Android notifications once active; and the YouTube videos embedded on the podcast pages (United States).
• Browser push services (Google, Apple, Mozilla, Microsoft): receive your subscription identifier and the text of each notice, if you turn on notifications on the web.

Only authorised staff access your data, and only when needed to give you support or maintain the service. We may disclose data to an authority when the law requires it.

8. International transfers

Some processors handle data outside the European Economic Area. In each case we rely on one of these safeguards:

• United Kingdom (Supabase, where the database is hosted): adequacy decision of the European Commission.
• United States: the adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified — Vercel, Stripe and Google are — and, in the other cases (OpenAI, OpenRouter, Anthropic, Resend, RevenueCat, Apple), the standard contractual clauses approved by the European Commission, with encryption in transit and the minimum necessary sent.
• Singapore (Z.AI and Moonshot AI models through OpenRouter): standard contractual clauses and your express consent before they are used.

You can ask us for a copy of the applicable safeguards by writing to privacidad@matematicadelalma.com.

9. Android and iPhone apps

The apps show the same service inside a native container: the account, the data and this policy are the same as on the web. What they add is this:

• Notifications: if you allow them, we store the device’s notification identifier with your account (Apple for iPhone; Google for Android, once active). Notices about readings and circles carry generic text, not their content. You can turn them off in Settings or in the system.
• Purchases: handled by Apple or Google; RevenueCat receives your account identifier and the subscription status. Cancellations and refunds are made in the store.
• Sign in with Apple: Apple sends us your name the first time and your email or a private relay address. When you delete the account we revoke that access with Apple.
• On the device: app preferences, drafts written offline and the fingerprint or face lock setting are stored only on your phone, outside the system backups. Biometrics are verified by the phone and never leave it.
• Error reports: if the app crashes, it sends us the platform, the screen and the error message, without your identity or your content.
• Deleting the account: in Settings › Data and privacy or, without the app installed, at Eliminar tu cuenta.

10. Data retention

• Account and content: for as long as you have an account. When you request deletion, the account is scheduled for deletion in 30 days; within that period you can cancel it. After that the account, entries, audio, images, conversations, Alma’s memory and context, readings and files are deleted; what you shared in circles is deleted or blanked.
• Backups: the database is backed up daily and each backup is kept for 7 days, so deleted data disappears from the backups within that period.
• Copy of your data: the archive you request in Settings can be downloaded for 7 days and is then deleted.
• Billing data: 5 years under accounting and tax obligations, even if you delete the account.
• Visit measurement: 13 months.
• Newsletter: until you unsubscribe; afterwards, only the record of the unsubscription.
• Server technical logs: deleted automatically within a few days.
• Artificial-intelligence providers: keep what is sent for as long as their API terms set for abuse detection, then delete it.

11. Your rights

Under the GDPR and the national rules that implement it, you have the right to:

• Access: know what data we process and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Portability: receive your data in a structured, commonly used format.
• Objection and restriction: object to a processing or ask us to restrict it.
• Withdrawing consent: at any time, without affecting earlier processing.

Much of this you can do without asking: in Settings › Data and privacy you download a full copy of your data, delete the account and give or withdraw the artificial-intelligence permission; in Settings › Alma you choose the model and delete the memory and the context; the newsletter’s unsubscribe link and the “Cookie preferences” button do the rest. For everything else, write to privacidad@matematicadelalma.com; we reply within one month at most.

You may also lodge a complaint with Latvia's Data State Inspectorate (Datu valsts inspekcija), the supervisory authority for Matemática del Alma, or with the data protection authority of your own country, such as the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

To request the deletion of your data (guides, newsletter, app, Instagram or Facebook), follow the steps at Eliminar tus datos (in Spanish, with an English summary).

12. Cookies and visit measurement

We use essential cookies for signing in and one first-party cookie, mda_consent, which remembers your choice about visit measurement.

Visit measurement. We use our own analytics, with no third-party services and no advertising. Without your permission, we only count which pages are visited, anonymously: with no identifiers and without storing anything on your device. With your permission, we store a random visitor identifier (mda_vid) in your browser’s local storage and also record clicks, reading time and, if you are signed in, the link to your account. We never record what you type into forms. The data is kept in our database (Supabase, London region) and is deleted automatically after 13 months. If your browser sends “Do Not Track” or “Global Privacy Control”, we treat it as a refusal.

Embedded videos. The podcast videos are embedded from youtube-nocookie.com, YouTube’s privacy-enhanced mode: Google sets no cookies until you press play.

You can change your choice at any time from the Cookie Policy (the “Cookie preferences” button) or from your browser settings.

13. Security

We apply technical and organisational measures to protect your data:

• TLS encryption on every connection, including with each processor.
• Passwords stored only as a secure hash (bcrypt).
• Row-level access rules in the database: each account sees only its own data.
• Staff access restricted and limited to support and maintenance.
• Encrypted backups; optional app lock with fingerprint or face.

14. Minimum age

Matemática del Alma is for adults: you must be 18 to create an account. We do not knowingly collect data from anyone under 18; if we find such an account, we delete it. If you think this has happened, write to privacidad@matematicadelalma.com.

15. Changes to this policy

We may update this policy when the service, the processors or the law change. If the change is significant, we will tell you by email or with a notice on the platform before it takes effect. The date of the last update is at the top of the page.

16. Contact

If you have questions about this policy or about how we process your data, write to us: