Privacy Policy
Naviap stores only what you add to it, doesn’t sell data and doesn’t show ads. The Vault, lab results and measurements are encrypted on your device, so we can’t read them.
1. Who is responsible for the data
Data controller: Hanna Alesik, Spain. For any question about your data: hola@naviap.app.
2. What data we process
| What | Examples | Why |
|---|---|---|
| Account | email, name (from Google or entered), language, time zone | signing in, addressing you, reminders at the right time |
| Content | tasks, shopping, lists, habits, recipes, payments, people and dates, wishes, films and books, settings | running the app |
| Meds and doses | name, time, doses marked as taken | the Health section, reminders |
| Encrypted data | Vault, lab results, measurements and their files | storage; the server sees only encrypted data |
| Shared data | profile name, who added or ticked an item | shared lists and task groups |
| Notifications | browser subscription address, device type, time of the last delivery | sending reminders |
| Technical data | IP address and time of requests in server logs | security, abuse prevention, troubleshooting |
We don’t collect your location, phone contacts or advertising identifiers, and we don’t use advertising or tracking cookies. The browser stores only what the app needs to work: your sign-in and a copy of your data for offline use.
3. Health data
Health data is a special category under the GDPR, and we process it only with your explicit consent. Lab results and measurements are encrypted on your device with your master password: we don’t know the password and can’t read or recover them. Meds and doses marked as taken are stored on the server without this encryption so that reminders can be sent; notification texts don’t include medication names. Lab retest dates and the measuring day are stored on the server without encryption so that reminders can be sent; the values themselves are stored only in encrypted form. You can withdraw your consent by deleting the section’s data or your account.
4. Legal bases
- Performance of a contract (Art. 6(1)(b) GDPR): your account and content, without which the app can’t work.
- Explicit consent (Art. 9(2)(a) GDPR): health data.
- Legitimate interest (Art. 6(1)(f) GDPR): security logs and abuse prevention.
5. Other people’s data
In People and in shared lists you can store other people’s names and dates. Do this for personal purposes only. Members of a shared list see your profile name and what you add to that list, and nothing else.
6. Wishlist link
Through the link, friends see only your name and your open wishes (name, price, shop, photo, how much you want it) and, if turned on, Sizes & Preferences. A guest can give a name when reserving a gift: only other guests see it, you don’t. Reservations are deleted together with the wish. To prevent abuse, a hash of the guest’s IP address is kept for about an hour.
7. Who receives data
Only the services the app can’t work without:
| Service | Purpose | Location |
|---|---|---|
| Supabase | database, sign-in, files, server functions | EU (Ireland) |
| Vercel | website hosting | EU and US (CDN) |
| Cloudflare | DNS; forwarding email from hola@naviap.app to the owner’s mailbox | global |
| Resend | sign-in emails | EU (Ireland) |
| Sentry | app error reports, without the content of tasks, shopping, notes, your email or the Vault | EU (Germany) |
| Sign in with Google (if chosen) | EU and US | |
| Browser push services (Google, Apple, Mozilla) | delivering notifications | depends on the browser |
| TMDB | film search: only the search query is sent, with no data about you | US |
| Google Books | book search and covers: only the search query is sent | US |
Transfers outside the EU rely on the EU Standard Contractual Clauses or the Data Privacy Framework. Data is never sold or shared for advertising.
8. How long we keep data
- As long as your account exists.
- What you delete disappears from the app at once; right after deleting, you can tap “Undo”. In the database it is kept for up to 30 more days and then deleted permanently.
- When you delete your account, your data is deleted immediately.
- Server logs are kept for as long as the providers keep them, usually up to a few weeks.
9. Your rights
You can get a copy of your data (Settings → Data → “Download my data”), correct it, delete your account (Settings → Data → “Delete the account”), restrict or object to processing, and withdraw your consent for health data. For anything else, write to hola@naviap.app; we reply within one month. If you believe your rights have been violated, you can file a complaint with the Spanish Data Protection Agency (AEPD, aepd.es).
10. Security
Everything is transmitted over HTTPS. Each row in the database is accessible only to its owner and to the members of a shared list. The Vault, lab results and measurements are encrypted on your device; without the master password or the recovery key, no one can open them, including us.
11. Age
Naviap is intended for people aged 16 and over.
12. Changes
We will announce significant changes to this policy in the app (“What’s new”) before they take effect.
Version of 28 October 2026