Privacy Policy

Information We Collect

Prosperity is local-first by design. The vast majority of your data stays on your device unless you explicitly turn on cloud sync from the Profile screen. We collect three categories of information:

• Information you provide. Account email, display name, habits, agenda entries, nutrition logs, training sessions, focus sessions, and any photos you choose to upload.
• Information collected automatically. Basic device information (OS version, App version), error logs, and authentication tokens. We do not collect advertising identifiers.
• Information from third parties. If you sign in with Google, we receive your name, email, and (with your consent) calendar events from Google's APIs.

How We Use Your Information

• To operate the App's six domains and the system health engine.
• To synchronise your data across devices when cloud sync is enabled.
• To power the AI assistant when you choose to use it.
• To deliver service notifications and respond to your support requests.
• To diagnose crashes and improve reliability.

We do not sell your data. We do not use it for advertising. We do not profile you for marketing.

Legal Basis for Processing

Under Article 6 of the General Data Protection Regulation (GDPR), we rely on the following legal bases:

• Article 6(1)(b) — Performance of a contract. Processing your data is necessary to deliver the App's core features you have signed up for.
• Article 6(1)(a) — Consent. For optional features such as the AI assistant, Google Calendar sync, and push notifications. You can withdraw consent at any time in the App's settings.
• Article 6(1)(f) — Legitimate interests. For security, fraud prevention, and improving service reliability via crash diagnostics. We balance these interests against your rights and can provide our assessment on request.
• Article 6(1)(c) — Legal obligation. For compliance with applicable Spanish and EU consumer, tax, and accounting law.

For special-category data (e.g., health-related fields you may log), we additionally rely on Article 9(2)(a) — your explicit consent.

Data Retention

Local data persists on your device for as long as the App is installed. Cloud data persists in Supabase until you delete your account or specific records. Deleted records are removed from active systems within 30 days and from backups within 90 days. Crash logs are retained for 12 months.

Sharing & Disclosure

We share data only with carefully chosen processors that are bound by data-processing agreements:

• Supabase (database, authentication, storage) — when cloud sync is enabled.
• Apple and Google as data controllers for billing, in-app purchases, and platform delivery.
• Groq as an AI inference provider — only when you actively use the assistant. Prompts are routed via our edge function and not used to train third-party models.
• Google as the OAuth provider when you choose to sign in with Google.

We may also disclose data when required by law, court order, or to protect our legal rights.

Your Rights

Under GDPR you have the following rights, free of charge, subject to legitimate limits:

• Access (Art. 15) — request a copy of your personal data.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure (Art. 17) — delete your account and associated cloud data.
• Restriction (Art. 18) — limit how we process your data.
• Portability (Art. 20) — export your data in a machine-readable format.
• Objection (Art. 21) — object to processing based on legitimate interests.
• Withdraw consent — at any time, without affecting the lawfulness of prior processing.

Exercise any right by emailing privacy@prosperity.app. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).

Data Transfers Outside the EU

Some of our processors are based outside the European Economic Area (EEA), including in the United States. Where we transfer data outside the EEA, we rely on:

• European Commission adequacy decisions where available.
• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Supplementary measures such as encryption in transit and at rest.

You can request a copy of the safeguards in place for any specific transfer.

Children's Privacy

Prosperity is not directed at children. The minimum age to use the App is 16 in accordance with the Spanish implementation of GDPR (Article 8 of the LOPDGDD) and at least 13 in jurisdictions following the United States Children's Online Privacy Protection Act (COPPA). We do not knowingly collect data from children below the applicable age. If we learn we have, we will delete the data without delay.

Cookies & Tracking Technologies

The mobile App does not use cookies. It uses local storage and the iOS / Android keychain to keep you signed in. The marketing website (this site) uses no third-party analytics or advertising trackers.

Changes to This Policy

We will notify you in-app and update the "Last updated" date at the top of this page when this policy changes materially. Where required, we will request fresh consent.

Contact & Data Controller

Data controller: Prosperity, Madrid, Spain.
Privacy email: privacy@prosperity.app
Postal address: available on request.

For questions, requests, or complaints, contact us first at the email above. You can also contact the Spanish Data Protection Agency directly.