Privacy Policy
This policy explains what personal data the Natsumar mobile app ("Natsumar", "the app") processes, why, on what legal basis, for how long, and the rights you have. It is written to meet Article 13 of the EU General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD). It also applies to the website natsumar.com.
In short: Natsumar has no ads or in-app purchases and does not sell your data. You can use it without an account. Usage analytics and crash reports are only collected if you say yes. The website uses no cookies. An optional account syncs your favorites, and you can delete it from the app at any time.
1. Who is responsible (data controller)
Omar Martín, an individual based in Spain. Contact for anything related to privacy: support@natsumar.com. No Data Protection Officer has been appointed, as none is required for this activity.
2. What data we process, why, and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account (only if you create one): email address, account ID, sign-in provider (Apple or Google) and, if the provider shares them, your name. | Create your account, sign you in, sync your favorites across devices. | Performance of the contract you request by creating an account (Art. 6.1.b GDPR). |
| Favorites: the IDs of the wallpapers you mark as favorite. Without an account they are stored only on your device. | Show and sync your favorites. | Contract (Art. 6.1.b). |
| Usage analytics (Firebase Analytics), only if you accept them: screens viewed, actions such as saving, setting or favouriting a wallpaper, search terms typed in Explore, and a pseudonymous app-instance ID, plus device model, OS version, app version, language and approximate country (derived from the IP address, which is not stored). | Understand which features and wallpapers are used so the app can be improved. | Your consent (Art. 6.1.a GDPR and Art. 22.2 LSSI). Off by default; you choose on first launch and can change it any time in the app (Settings). |
| Anonymous wallpaper counts: each time a wallpaper is viewed, previewed, saved, set, shared or favorited, a counter for that wallpaper and day goes up by one. Nothing identifies you or your device: no account, device or installation ID is sent or stored, and nothing is saved on your phone. | Know which wallpapers people like, to decide what to make next. | These totals are not personal data. Sending them only involves the same brief technical connection as loading a wallpaper (legitimate interest, Art. 6.1.f GDPR). |
| Crash reports (Firebase Crashlytics): stack trace, device model, OS and app version, and a pseudonymous installation ID. No account data. | Detect and fix crashes and errors. | Your consent (Art. 6.1.a GDPR and Art. 22.2 LSSI), with the same switch as usage analytics: off by default and changeable any time in Settings. |
| Marketing emails, only if you tick the separate, unticked box when creating your account and then confirm it from the email we send you (double opt-in): your email address and a record of your consent (date and time, where it was given, the exact wording shown, app version). | Send occasional news: new wallpaper collections, offers and the future Natsumar product store. | Your consent (Art. 6.1.a GDPR and Art. 21 LSSI). You can withdraw it at any time from the app or with the unsubscribe link in each email. |
| Website visits (natsumar.com), through Cloudflare Web Analytics: the page visited, the page you came from, browser, operating system, device type, approximate country and loading times. It uses no cookies, stores nothing on your device, uses no identifiers or fingerprinting and does not keep your IP address. Like any website, our host (GitHub Pages) also receives your IP address to deliver the pages and protect the service. If you pick a language in the footer menu, your browser remembers it (localStorage); it is not sent anywhere. | Deliver the website, keep it secure and count visits in aggregate to see which pages interest people. | Legitimate interest in running and improving the website (Art. 6.1.f GDPR). Remembering your language is a service you ask for, so it needs no consent (Art. 22.2 LSSI). |
| Messages you send us (for example to support@natsumar.com): your email address, the content of the message and anything you choose to include. | Answer you and handle your request. | Legitimate interest in answering the people who write to us, or the steps you ask us to take (Art. 6.1.f and 6.1.b GDPR). |
Data described as pseudonymous (app-instance and installation IDs) does not reveal who you are on its own, but it is still personal data under the GDPR, which is why we treat it as such.
What we do not do: we do not show ads, we do not collect the advertising ID (IDFA / Android Advertising ID), we do not track you across other companies' apps or websites, we do not build advertising profiles, and we do not sell or rent your data. We do not access your photo library: the app only adds the wallpapers you choose to save.
3. Who processes data on our behalf
We use these providers as data processors, under contracts that require them to protect your data and use it only on our instructions:
- Supabase, Inc. (USA): account, sign-in and favorites database. Servers in the United States (Virginia).
- Google Ireland Ltd. / Google LLC: Firebase Analytics and Firebase Crashlytics (only with your consent), and Gmail, the mailbox where your messages arrive.
- Apple Inc. or Google: only if you choose "Continue with Apple" or "Continue with Google", to verify your identity. If you use Apple's "Hide My Email", we receive a relay address, not your real one.
- Plus Five Five, Inc. (Resend) (USA): sends the confirmation email and the marketing emails you consented to, from servers in the European Union (Ireland).
- Cloudflare, Inc. (USA): website visit statistics, without cookies.
- GitHub, Inc. (USA): website hosting (GitHub Pages).
- Soluciones Corporativas IP, S.L. (DonDominio) (Spain): domain name, and forwarding the emails you send us to our mailbox.
We do not share data with anyone else unless the law requires it (for example, a request from a court).
4. International transfers
Some of these providers process data in the United States. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified (such as Google) and, in any case, on the European Commission's Standard Contractual Clauses included in each provider's data processing terms.
5. How long we keep it
- Account and favorites: while your account exists. Deleting your account from the app erases them immediately.
- Analytics: 14 months, then deleted automatically by Firebase.
- Crash reports: 90 days.
- Website statistics: Cloudflare only keeps aggregated figures, which identify no one. Your IP address is not stored for statistics.
- Website server logs: kept by GitHub for a limited time for security, under its own policy.
- Messages you send us: as long as needed to answer and follow up, and at most 2 years after the last message.
- Marketing consent record: while the consent is active and, after you withdraw it or delete your account, up to 3 years only as proof that it was given lawfully (the limitation period for LSSI infringements). Your email is no longer used to contact you.
- Data on your device (preferences, local favorites, image cache) stays there until you uninstall the app or clear its data.
6. Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw any consent at any time without affecting the lawfulness of processing before the withdrawal. To exercise them, write to support@natsumar.com; we answer within one month. You can also delete your account yourself from Account → Delete account (see how to delete your account).
If you believe your data has been processed unlawfully, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or with the supervisory authority of your country.
7. Children
Natsumar is not directed at children. Creating an account requires being at least 14 years old (the age of digital consent in Spain; in other countries, the age set by local law, and never under 13). If you believe a child has given us personal data, contact us and we will delete it.
8. Security
All communication between the app and our servers is encrypted in transit (HTTPS/TLS). Access to the database is restricted by per-user security rules, so each user can only read and change their own account and favorites.
9. Changes
If we change this policy in a meaningful way (for example, if one day the app showed ads), we will update this page and tell you in the app before the change applies, and we will ask for your consent again wherever the law requires it.