Privacy policy

Updated: 30 September 2026

This notice covers the YoPiMat app and yopimat.com. The website and the app process different information; creating an app account does not create a website account.

Who is responsible and how to reach us

Pedro Manfredi, trading as Clutch Developer, Pau Alsina 64, bloque A, 3, 1, 08024 Barcelona, Spain. This is the operator and data controller for the processing described here. For privacy requests, contact info@yopimat.com; for product support, contact info@yopimat.com.

The website

Netlify hosts these pages and handles the contact form. Hosting and security can involve your IP address, browser information, request time, requested page and technical logs. We use this processing to deliver and protect the website, on the basis of our legitimate interests in a reliable, secure service.

If you send the contact form, we receive the name, email address, topic and message you provide. We use them to answer and handle your request, on the basis of steps you request before a contract or our legitimate interest in responding to other inquiries, as applicable. Please do not send diagnoses, injuries, payment credentials or practice logs. Sending a message does not subscribe you to marketing.

The support mailbox uses BanaHosting's business email service, and messages are forwarded to a Gmail account used by the controller. BanaHosting and Google therefore process that correspondence and contact details to deliver messages and handle support requests.

No Google Analytics or Plausible identifier is configured on this site, and our own scripts do not currently load optional analytics. Read the cookie notice for the distinction between optional analytics and technical hosting or form protection.

App account and sign-in

The app uses Firebase Authentication for email/password sign-in and supported Apple or Google sign-in. Account processing can include an account identifier, email address, credentials handled by the sign-in provider and profile information supplied by your chosen provider. The providers also process technical information needed for authentication and abuse prevention. We use account information to provide the account you request and secure access, on the basis of the service contract and legitimate interests in security. Apple and Google process their own sign-in services under their respective notices.

Practice information stays on your device

Practice plans, history, preferences, readiness answers, safety acknowledgements and in-app session feedback are stored locally. The current app does not upload those wellness records to Firebase Authentication or RevenueCat. They may reveal information about your wellbeing; protect access to your device and review its backup settings. We do not use these records for advertising. Voluntarily emailing feedback is different: the contents then leave the device and are processed as support correspondence.

Purchases and Premium

Apple handles App Store payments. RevenueCat processes a separate, pseudonymous purchase identity, purchase and transaction information, subscription status and entitlement checks to provide Premium and restore purchases. Its purchase identity is separate from the Firebase account; the current integration does not pass your Firebase email or local wellness history to RevenueCat. We use this processing to perform the purchase service and prevent fraud, and keep records where legal obligations apply. We do not receive your complete card details from the app store. Subscription prices and periods are those shown in the store checkout.

No advertising SDK, separate app analytics SDK or crash-reporting SDK is enabled in the current app configuration. This does not mean authentication, purchase or hosting providers keep no operational records.

Providers and international processing

Our service uses Netlify for website hosting/forms, BanaHosting for the support mailbox, Google/Firebase for authentication and Gmail forwarding, and RevenueCat for purchase administration; Apple operates the App Store; Apple and Google process sign-in services where you choose those options. Information may be processed outside your country or the European Economic Area. Applicable data protection rules require an appropriate transfer mechanism, such as an adequacy decision or standard contractual clauses, where relevant. Contact us for information about the safeguards applicable to your data. We do not claim that all processing is confined to the EU.

Provider information: Netlify, BanaHosting, Firebase, RevenueCat, Apple and Google.

How long information is kept

Local practice records remain on the device until cleared using the available app controls or removed with app/device data; device or operating-system backups may have separate retention. Account information is used while the account exists. Verified account deletion removes the Firebase Authentication account; provider security records and backups may follow separate retention schedules.

Support correspondence is kept while needed to handle the request and any related dispute or legal record obligation. Purchase records can outlive an app account where needed for subscription administration, fraud prevention, store rules or legal obligations. Provider technical logs follow the provider's applicable service retention. We assess requests against these purposes and explain any lawful exception; account deletion is not a promise that every provider record disappears immediately.

Your rights and deletion

Depending on applicable law, you can request access, correction, deletion, restriction or portability of personal data and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Contact the privacy address above. We may request proportionate proof that the request concerns you; never send your password or full payment details. We normally respond within one month; a lawful extension for a complex request will be explained.

See Delete account and data for in-app controls and a request route outside the app. Deleting an account, clearing local data and cancelling a store subscription are separate actions.

You may complain to your local data protection authority, including Spain's Agencia Española de Protección de Datos (AEPD). You can also contact us first.

Children, decisions and changes

YoPiMat is intended for adults; it is not a children's service. The current service does not use the remote account or purchase data to make automated decisions with legal or similarly significant effects. We will update this notice when relevant processing changes and provide additional notice where required.