Privacy Policy
Psyquoia is a free self-help tool for the “100 wishes” practice. We are built around data minimisation: the only personal data that identifies you is your email address. This policy explains, under the EU General Data Protection Regulation (GDPR), what we collect, why, how we use cookies and Google services, and the rights you have.
Who controls your data
The controller responsible for processing your personal data is:
C. Coronel Ivorra Ruiz 7, 1, 30720 San Javier, Murcia, España
What data we collect
Account data: your email address and a Google account identifier, received from Google when you sign in. Your email is the only piece of data that personally identifies you.
Content you create: your wishes, reflections and their status (active, fulfilled, released). This content is stored encrypted and is visible only to you. We do not read it, and it is never used to profile or target you. Administrators have no access to it.
Technical and analytics data: aggregate visit statistics collected through Google Analytics (see “Cookies” and “Google”). We do not build advertising profiles.
Why we use it and our legal bases
To provide the service — create your account and let you write, keep and review your wishes (Art. 6(1)(b) GDPR, performance of a contract).
To send reminder emails and marketing emails — only if you have given the corresponding consent (Art. 6(1)(a) GDPR). The two consents are separate and optional.
To measure visits with analytics — based on your consent (Art. 6(1)(a) GDPR).
To keep the service secure and prevent abuse (Art. 6(1)(f) GDPR, our legitimate interest).
Cookies
Essential cookies (no consent required): “psyquoia_session” keeps you signed in (HMAC-signed, HTTP-only, valid up to 60 days); “psyquoia_oauth” secures the Google sign-in exchange and lasts about 10 minutes; “NEXT_LOCALE” remembers your chosen language. The service cannot work without these.
Analytics cookies (consent-based): Google Analytics sets cookies such as “_ga” and “_ga_*” to count visits and sessions. These are only used to understand traffic in aggregate; we do not use them for advertising.
You can clear or block cookies in your browser at any time; blocking essential cookies will sign you out.
Google services
Sign-in (Google OAuth): when you log in with Google we receive your email address and a Google account identifier so we can create and recognise your account. We never receive your Google password.
Google Analytics 4: we use it to measure visits to the site. Google processes this data as a third party and may process it on servers outside the European Economic Area; such transfers are covered by appropriate safeguards (e.g. the EU Standard Contractual Clauses). See Google’s Privacy Policy at policies.google.com/privacy.
We do not sell your data and we do not share your wishes with Google or anyone else.
Email reminders and marketing
With your consent, we may send you gentle monthly reminder emails to continue your practice, and/or occasional news and offers. These are two separate choices.
You can turn each one on or off at any time inside the app, or by using the unsubscribe link in any email. Withdrawing consent does not affect processing carried out before the withdrawal.
How long we keep your data
We keep your account and content for as long as your account exists. If you ask us to delete your account, we erase your personal data without undue delay, except where we must keep something to comply with a legal obligation.
Your rights
Under the GDPR you have the right to access your data, to rectify it, to erase it (“right to be forgotten”), to restrict or object to processing, to data portability, and to withdraw any consent at any time.
To exercise these rights, contact the controller at the data-protection address above. We will respond within one month. You also have the right to lodge a complaint with your supervisory authority — in Spain, the Agencia Española de Protección de Datos (AEPD), www.aepd.es.
Data minimisation and security
We deliberately store as little as possible: your email is the only identifying personal data we hold. Your wishes are encrypted and accessible only to you. All traffic is served over HTTPS.
Children
Psyquoia is not intended for children under 16. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. We will post the new version here and update the date at the top. Significant changes affecting your rights will be communicated where appropriate.