Privacy Policy

Seiday is a personal voice diary. What you record is yours and is private by default. This Privacy Policy explains what personal data we process, for what purpose, on what legal basis and what rights you have, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD) and other applicable law.

The controller of your personal data is José Luis de la Morena García, a natural person, owner and operator of the Seiday service in Spain.

For any matter relating to the protection of your data, and to exercise the rights described in section 12, you can write to us at privacidad@seiday.com.

No Data Protection Officer has been appointed, as none of the cases in Article 37(1) of the GDPR applies. You can send any privacy enquiry to the address above.

We process the following categories of personal data:

• Account data: username, email address and password (stored encrypted using a bcrypt hash; we never keep your password in plain text).
• Profile data: name and, optionally, date of birth, bio, link and profile and cover photos.
• Content you create: your audio recordings (Seidays and time capsules), optional images, the emotion you select, and the titles and dates of your entries.
• Third-party authentication data: if you sign up with Apple or Google, we receive an identifier and the basic data those providers share with us according to your settings.
• Technical data: push notification tokens, time zone, device type and operating system, and access logs needed for the security of the service. Your IP address is used transiently to limit abuse and is not stored persistently.
• Analytics data: aggregated or pseudonymised usage statistics to understand how the app is used and improve it. We do not send third parties the content of your recordings, their titles or any transcript.

Every Seiday entry necessarily includes an emotion that you select, and the app uses them to generate personal statistics (trends, distribution and summaries of your mood). This information can reveal aspects of your emotional wellbeing, so we handle it with particular care and we expressly inform you of it.

Selecting an emotion is an essential part of the service: without it, Seiday could not work as a mood diary. The legal basis for this processing is your explicit consent (Art. 9(2)(a) GDPR), which you give by accepting this policy during sign-up and which you can withdraw at any time by deleting your account.

These statistics are calculated only to show them to you. They are not shared with third parties, are not used for advertising or commercial profiling, and are not subject to automated decisions with legal effects within the meaning of Article 22 of the GDPR.

We process your data for the following purposes, based on the legal grounds in Article 6 of the GDPR:

• Providing the service (creating your account, storing and showing you your diary, calculating streaks, levels, achievements and summaries) — basis: performance of a contract (Art. 6(1)(b)).
• Processing of emotions and mood statistics — basis: explicit consent (Art. 6(1)(a) in conjunction with Art. 9(2)(a)), as set out in section 3.
• Security and prevention of fraud and abuse (access control, request limiting, logs) — basis: legitimate interest (Art. 6(1)(f)).
• Push notifications (reminders and alerts that you enable) — basis: consent (Art. 6(1)(a)), which you can withdraw at any time from the settings.
• Usage analytics to improve the app — basis: consent (Art. 6(1)(a)) or legitimate interest when the data is aggregated or pseudonymised.
• Compliance with legal obligations (e.g. responding to requests from authorities) — basis: legal obligation (Art. 6(1)(c)).

Seiday is designed for you to record your own voice. If a recording includes the voice or data of other people, you are the one who decides to include them and who must make sure you have their knowledge or consent where necessary, especially if you later decide to share that recording.

We do not analyse the content of your audio, we do not apply voice recognition or biometric identification, and we do not use it for any purpose other than storing it and showing it to you. If you believe a recording published by link affects your privacy, write to us at privacidad@seiday.com and we will act with the utmost diligence.

Your entries are private by default: only you can see and play them. Audio and image files are stored in a private space and served exclusively through signed, temporary links, so they are not publicly accessible.

If you decide to share a specific entry or a time capsule, a link with a random, unguessable identifier is generated. While sharing is active, anyone who has that link can access the content, so we recommend sharing it only with the people you want. You can revoke sharing at any time from the app, and the link will stop working. Shared content pages are published with no-indexing instructions so that search engines do not include them in their results.

The summaries you share (Seiday Wrapped) are generated as images and do not include your audio.

We do not sell or rent your personal data. To provide the service we use the following providers, who act as processors and are bound by a contract under Article 28 of the GDPR:

• Supabase (European Union) — database hosting.
• Render (European Union) — application server hosting.
• Cloudflare R2 — storage of audio and image files.
• Resend — sending of transactional emails (account verification, password recovery and security notices).
• Sentry — technical error logging, configured not to capture personal data from your content.
• PostHog (European Union) — usage analytics, with no screen recording and without sending the content of your entries.
• Expo, Apple and Google — delivery of push notifications to your device.

We may also disclose data to public authorities where there is a legal obligation or a valid request.

The application server and the database that holds your information are hosted in the European Union, so your content and account data are processed mainly within the European Economic Area. Some of the auxiliary providers listed in the previous section may process certain data outside the European Economic Area, mainly in the United States. In such cases we ensure an adequate level of protection through the European Commission's adequacy decision on the EU-US Data Privacy Framework, where the provider has joined it, or, failing that, through Standard Contractual Clauses and supplementary measures, in accordance with Articles 44 et seq. of the GDPR.

We keep your data for as long as you have an active Seiday account. If you delete your account, we will erase your personal data and your content (recordings, images and time capsules) from our systems within a maximum of 30 days.

Please note that we make encrypted backups of the database with a 30-day retention. After you delete your account, your data may remain in those backups until they expire, and is not used for any purpose other than restoring service after an incident. Technical security logs are kept for a maximum of 90 days.

Content removed by moderation is kept for 90 days before being permanently deleted, so that we can attend to you if you file a complaint — from the removal notice in the app or by writing to moderacion@seiday.com — and to respond to a possible request from an authority. Content subject to a legal hold — for example, following a court or police order — is not deleted when you delete your account and is kept for as long as that obligation lasts.

Data that we must keep to comply with legal obligations or to defend against claims will be kept blocked for the applicable limitation period.

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure. In particular: passwords are stored with a bcrypt hash, communications travel encrypted over HTTPS/TLS, access to content requires authentication through tokens with an expiry, files are kept in private storage encrypted at rest and are only served through temporary signed links, and backups are encrypted. No system is infallible, so we cannot guarantee absolute security. In the event of a security breach that poses a risk to your rights, we will notify you as required by Articles 33 and 34 of the GDPR.

• Your entries are private by default.
• You decide whether to share a specific recording by link, and you can stop sharing it whenever you want.
• You can edit or delete any entry at any time.
• You can turn push notifications on or off from the settings.
• You can export all your data or delete your account from the app settings. See how to delete your account and your data (Spanish).

Under the GDPR and the LOPDGDD, you can exercise at any time the rights of:

• Access to your personal data (Art. 15).
• Rectification of inaccurate or incomplete data (Art. 16).
• Erasure, or the right to be forgotten (Art. 17).
• Restriction of processing (Art. 18).
• Portability (Art. 20): you can export your data directly from the app settings.
• Objection to processing based on legitimate interest (Art. 21).
• Withdrawing the consent you have given at any time, without affecting the lawfulness of the earlier processing.

You can exercise these rights by writing to us at privacidad@seiday.com. We will reply within a maximum of one month from receiving your request. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if you consider that the processing does not comply with the law.

Seiday is aimed at people aged 14 or over, the minimum age to give consent to data processing in Spain under Article 7 of the LOPDGDD. If you live in another country of the European Economic Area, the minimum age set by its law will apply, which can be as high as 16; in that case you must reach that age or have the authorisation of the person who holds parental authority or guardianship over you.

We do not knowingly collect data from minors below that age. If we detect an account in that situation, we will delete it. Parents or guardians can contact us at privacidad@seiday.com.

The mobile app does not use advertising or third-party tracking cookies. It uses the device's local storage to keep your session and your preferences (language, theme and settings), which is essential for it to work.

This website uses necessary technical cookies and, only if you give your consent, analytics cookies. You can accept or reject the latter from the cookie notice, and change your decision at any time from the cookie settings link in the footer.

We may update this Privacy Policy to reflect changes in the law or in the service. We will publish the current version on this page and state its update date. If the changes are substantial, we will let you know through a notice in the app or by email.

If you have any questions about this policy or about the processing of your data, write to us at privacidad@seiday.com.