Privacy policy

Last updated: 23 October 2026

Spoonies is an app for logging anxiety episodes and discovering patterns. This policy explains what data we store, why, and what rights you have. It applies to the app and to this website.

1. Who handles your data

Aída Caravello Gómez, reachable at hello@spooniesapp.com, is the data controller for your data as a Spoonies user.

2. What data we collect

From your account:

Email (to create your account and sign in).
Password (encrypted; we never see it in plain text).

From your profile (all optional, you decide how much to fill in):

Sex, whether you have a related diagnosis and which, whether you take medication.
Sleep, caffeine and exercise habits.
Whether you stim and how.
Triggers you already know.
Name and contact details of your trusted contact (if you choose to add one).
Whether you want to receive news by email (newsletter), separately.

From each episode you log:

Anxiety level, symptoms and a context note if you write one.
Date and time.
If you grant location permission: your approximate location (rounded to 1–2 km, never the exact one), the area (neighbourhood or city) and the weather at the time, to match it with your patterns.
Whether you used SOS mode during that episode.
If you answer “How are you doing?” during SOS (every 10 minutes): what you feel, how you feel it, whether it’s getting better and how much it has changed. It is stored on your phone to show you how you usually progress and, if the SOS came from a check-in, also in that episode.

If you subscribe:

Your email, the plan (Founding or regular), whether it is monthly or annual, the status of your subscription and the date it is paid until.
If you pay on the website: your Stripe customer and subscription IDs. We never see or store your card details: Stripe handles them.
If you pay in the app: your Apple purchase ID, which reaches us through RevenueCat. We never see or store your payment details: Apple handles them.
If your company pays: the fact that you hold one of its seats.

Technical data: the minimum needed to sync your phone with our servers (sync timestamps).

What we do NOT collect: we don’t read or store your full contacts list (only the contact you explicitly choose as your trusted contact), and we don’t access your photos or your activity outside the app.

From your mood (if you log it):

The little face you pick in the morning, at midday and at night.
If your company uses Spoonies: your streak, the size of your little face and your badges are calculated from those logs and stored only on your phone. Nobody else sees them, your company included.

If you join your company on Spoonies (optional):

Which company you belong to and, if you want to say, your department.
Whether you have chosen to take part in the workplace climate, and since when.
The work topics you tick, from a closed list (never text written by you).

On this website: if you sign up for the Founding price, your email and, if you enter them, your mobile number and social handle, plus the plan you choose. You then pay on Stripe’s page (see “If you subscribe”).

3. What we use your data for

To provide the service: store your episodes, show you your patterns and send you the regular email summary.
To charge your subscription, know whether you have access and issue receipts and invoices.
To manage your Founding sign-up, if you sign up on this website.
To improve the app from aggregated patterns (we never sell or share your individual data).
If you gave separate consent: to send you news about Spoonies.

We never use your data for third-party advertising, and we never sell it.

Legal basis for each use:

Your account and the app working: providing the service you ask us for (art. 6.1.b GDPR).
Payments and invoicing: the subscription contract (art. 6.1.b GDPR) and our tax and accounting obligations (art. 6.1.c GDPR). Your Founding sign-up on this website: also the contract (art. 6.1.b GDPR).
Your episodes, symptoms, profile and mood are health data: we process them because you give us your explicit consent when you log them (art. 9.2.a GDPR). You can withdraw it by deleting that data or your account.
The newsletter: your separate consent (art. 6.1.a GDPR).
Taking part in your company’s workplace climate: a separate, explicit consent that you give or withdraw under Settings → Company (art. 9.2.a GDPR).

3a. If your company uses Spoonies

Joining your company is voluntary, and taking part in its workplace climate is a separate decision that you make yourself, expressly, and can withdraw whenever you want under Settings → Company.

If you take part, your company only sees aggregated data for the whole workforce: the average mood, how it splits across departments, which work topics come up most and a weekly consistency podium with the 3 departments that logged how they were on the most days (only the position and the department name; logging counts, never which state was picked). So that nobody can be identified:

No group with fewer than 5 people taking part is ever shown; small teams are merged with others.
Percentages are rounded and the exact number of participants is not shown.
Only what you log after accepting counts; if you stop taking part, your data leaves the aggregate immediately.
Your company doesn’t see your anxiety episodes, your symptoms, your notes, or whether you have joined or take part.
Your company never receives your personal data: only group statistics, calculated on our servers.
Every 3 months the app asks whether you are still at the company. If you don’t confirm within 2 weeks, what you log afterwards stops counting, so that nobody keeps adding to it without knowing after they leave.
If your company stops using Spoonies, its space is deleted (name, departments and memberships). Your personal data remains yours and is not touched.

Taking part or not can have no consequence for you at work. Companies that use Spoonies commit by contract not to use the workplace climate to assess, make decisions about or pressure anyone, and not to force anyone to join or take part.

No aggregation system removes the risk completely (for example, in a very small workforce); that is why the minimum of 5 people always applies and cannot be turned off.

We use these providers to run the app and this website, and only they process your data, under data protection agreements:

Supabase: hosts the database and authentication. If any data leaves the European Economic Area, it does so with GDPR safeguards (the European Commission’s standard contractual clauses).
Resend (servers in the European Union): sends the emails: confirming your account, resetting your password and your episode summary.
Apple (WeatherKit): tells us the weather. It only receives the approximate location (1–2 km), through our server, without your email or any other data of yours.
Apple / Google (the phone’s own system services): turn the approximate location into the name of your area.
Stripe: charges subscriptions paid on our website. It receives your email and payment details; we only receive the subscription status.
Apple (in-app purchases): charges subscriptions paid in the app, with your Apple account.
RevenueCat: tells us whether your Apple subscription is active. It receives your Spoonies account ID and the purchase details, never your entries.
Sentry (servers in the European Union): alerts us if the app crashes. It only receives the technical error and the screen where it happened: never your email, your account or anything you log.
Vercel: hosts this website and counts visits anonymously, without cookies.

We don’t share your data with anyone else, and we never sell it.

5. Where your data is stored

Locally on your phone (so the app works offline) and on Supabase’s servers, within the European Union (France). You can request complete deletion at any time (see section 7).

6. How long we keep it

As long as your account is active. If you delete your account, everything is deleted (see section 7) except what we are legally required to keep longer: payment and invoice records, which tax and commercial law requires us to keep for the years it sets (up to 6 years), only for that purpose.

From the app, under Settings → Privacy, you can:

Export everything we store about you, in a file you can save or send wherever you want.
Delete your account completely: episodes, profile, plan and your access (email/login). Deleting your account does not cancel a paid subscription: cancel it first (see the Terms of use).

You can also request access, rectification, restriction or objection by writing to hello@spooniesapp.com. You have the right to complain to your data protection authority (in Spain, the AEPD) if you think we haven’t handled your request properly.

8. Minors

Spoonies is not intended for people under 18. If you are a parent and believe a minor has created an account, write to us and we will delete it.

9. Changes to this policy

If we change anything important, we will let you know inside the app before it takes effect.

10. Contact

hello@spooniesapp.com