Privacy Policy

Last updated: 25 August 2026

This is an English translation of our Spanish privacy policy, provided for convenience. In case of any discrepancy, the Spanish version prevails.

This policy explains what data the Discalia application (the "App") processes, for what purpose, and what rights you have over it.

Data controller: Sergio Diaz Marcos, trading as “Sergio Diaz Dev Solutions”, Andorran tax ID (NRT) F-404071-V, address Mirador d'Encamp, núm. 35, AD200 Encamp, Principality of Andorra, reachable at [email protected]. Further details in the legal notice.

1. Data we process

• Account data: email address, the display name you choose, and your password (stored using irreversible encryption).
• Profile and health data you record: your answers to the initial questionnaire (type of condition, area of pain, activity level), daily pain entries, completed exercises, water intake and the reminders you set up. This is health data and it is only processed because you enter it voluntarily in order to use the App.
• Subscription data: if you take out Discalia Premium, the status of your subscription is handled through the app store and through RevenueCat. Discalia never has access to your card details.
• Support: if you write to us from the support form, we process your email address and the content of your message in order to reply to you.

We do not collect location data, contacts or advertising data, and we do not use advertising tracking tools.

2. Purpose and legal basis

• Providing you with the service (creating your account, saving your progress, personalizing your routine): performance of the contract (art. 6.1.b GDPR) and, for health data, your explicit consent when you enter it (art. 9.2.a GDPR).
• Managing the Premium subscription: performance of the contract.
• Answering your support enquiries: legitimate interest in assisting you.

3. Where your data is stored

Data is stored on servers located in the European Union (Germany, provider Hetzner Online GmbH). Traffic is served through Cloudflare, which acts as a security proxy.

The controller is established in the Principality of Andorra, a country covered by an adequacy decision of the European Commission, so data flows between the European Union and Andorra require no additional safeguards. Where a provider located outside Andorra or the European Economic Area is involved, we apply the safeguards required by law (an adequacy decision or standard contractual clauses).

4. Who we share data with

We never sell your data, and we never share your health data — your pain, your exercises, your diagnosis or your routines — with anyone for advertising purposes. The providers that are essential to run the service are:

• Hetzner Online GmbH (Germany): server hosting and backups.
• Cloudflare, Inc.: delivery network and protection against attacks.
• Apple: processing of subscription payments on iOS.
• RevenueCat, Inc.: management of subscription status (it receives a user identifier, never your health data).
• Resend, Inc.: sending support emails.

Advertising measurement (only if you allow it)

We promote Discalia through ads. To learn which ads work, the App may share two specific facts with Meta Platforms, Inc.: that you installed the app, and that you created an account. Apple, as the payment processor, also tells Meta when a subscription starts.

This only happens if you accept. The first time you open the App we ask you explicitly; until you answer, and if you answer no, Meta's component stays switched off and sends nothing at all. You can change your mind at any time from Profile: withdrawing consent switches Meta's component off, so it stops collecting and stops sending anything.

What is shared is limited to those facts and to technical device identifiers. Your questionnaire answers, your pain levels, your routines and any other health data are never sent.

5. Retention

We keep your data for as long as you keep your account. If you delete it, your personal data and health entries are erased from our systems; they may persist temporarily in backups, which are deleted on a rotating basis.

6. Your rights and how to delete your data

You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by writing to [email protected]. If you believe we have not handled your request properly, you can lodge a complaint with the Andorran Data Protection Agency (apda.ad), which is the supervisory authority for the controller. In addition, if you live in the European Union, you can contact the data protection authority of your own country.

From within the App itself you can export your data (Profile → Export) and delete your account.

7. Security

All communication between the App and our servers is encrypted (HTTPS). Passwords are stored using secure hashing and access to the servers is restricted by cryptographic keys.

8. Minors

Discalia is intended for adults and is not designed for anyone under 16.

9. Changes to this policy

If this policy changes substantially, we will let you know inside the App before the change takes effect.