Privacy policy

1. Introduction

Pausa is a self-care companion for noticing how you feel: you mark your state on a scale, write diary entries, and pick a professional role and a situation that shape what the app offers you.

This Privacy Policy explains what the Pausa mobile application (“App”) does with that information. It is written to describe what the App actually does. If you find behaviour that contradicts this text, that is a bug — please tell us (§12).

Pausa is not a medical, diagnostic, or therapeutic service.

2. You can use Pausa without an account

An account is optional. Without signing in, everything you create — diary entries, state check-ins, the roles and situation you pick, what you choose to tell the App about that situation, your activity history and settings — stays on your device only and is not copied to our cloud database. To stay up to date, the App also fetches shared settings, the same for everyone, from our server (Cloud Firestore, §5): the minimum supported version and which features are on, an announcement for the home screen, and up-to-date crisis helpline numbers. These requests carry no identifier of yours and none of your data; like any connection, they show Google, which runs the server, the technical details of the request, such as your IP address, and they are protected by App Check (§5). Apart from these requests, the only thing that can leave your device without an account is diagnostics, and only if you turn them on (§3.4): coarse events that may include your main professional role, but never your other roles, your entries, the levels of your check-ins, or the situation or focus you picked and your answers about it.

Signing in (Sign in with Apple, a Google account, or an email address and password) turns on cloud sync. From that moment the items marked “synced” in §3.1 are copied to our cloud database under your account identifier, so they survive a lost phone and appear on your other devices.

Signing out stops the sync for anything created afterwards. Deleting the account removes the cloud copy (§8).

Diagnostics (§3.4) are a separate decision, with or without an account, and are switched off until you turn them on.

3. What Pausa collects

The sections below list everything the App collects, in the order of how much it matters. Nothing outside this list is collected.

3.1 What you create in the App (well-being information)

This is the information the App exists for. All of it is stored on your device. When you are signed in, the items marked “synced” are also copied to our cloud database under your account identifier:

• state check-ins — synced: the levels you pick on the scales, before and after a practice, and the time you picked them
• diary entries and notes — synced: the text you write, exactly as you wrote it
• your activity history — synced: which practices, tools and journey steps you completed and when, plus the counters derived from them
• the professional roles you choose (for example creator, founder, student — one role, or up to three with Premium; the first one is your main role), and the situation or focus you pick (for example a relocation, a recovery, a job change), along with what you choose to tell the App about that situation (for example whether you're on sick leave or what's hardest right now) — these choices and answers themselves stay on your device and are not copied to the cloud; if you turn diagnostics on, your main role is also sent with analytics events when you set it or make another role your main one (§3.4); your other roles, the situation, your answers about it and the focus are not sent
• your settings — synced: language, theme, date and time format, nickname, avatar, which reminders are switched on and at what time, achievements
• programs for your work, the Room, the tools “Six areas”, “Workload talk” and “If–then”, and the “What suits me” shelf — device only: which program steps you completed, skipped or marked as not for you, your optional answers to a step’s question, what you chose to keep at hand, what you wrote or chose in these tools, and what you marked as suiting you. Which programs a person goes through can say a lot about their situation, so none of this is copied to the cloud, even when you are signed in; it is included in your data download and erased from the device when you delete your account (§8). If you turn diagnostics on, the App also sends coarse events about programs, these tools and the “What suits me” shelf — never anything you wrote and never which item you kept or marked; §3.4 lists exactly what they contain. The programs about a hard time send nothing at all — no program events and no record of completed steps. Steps of the other programs are also counted as a completed practice of the class “other”. Text from “Workload talk” leaves the device only if you copy it yourself.

This information describes your mental state and your life circumstances. We treat it as sensitive: under EU law it is a special category of personal data (GDPR Art. 9), the App Store classes it as “Health & Fitness”, and Google Play as “Health information”. §6 says what that means in practice.

An earlier version of this policy said that Pausa does not collect sensitive personal data. That was not true, and this section replaces it.

3.2 Account information

If you choose to create an account, we receive:

• your email address
• the name and identifier your provider passes to us (Apple or Google; Apple may pass a private relay address instead of your real one)
• an account identifier generated for you (Firebase uid), which is what all the data above is stored under

Passwords for email sign-in are handled by Firebase Authentication: they are stored hashed and we never see them.

If you choose to sign in with Google, the sign-in is carried out by Google: on iPhone by Google Sign-In, Google’s software built into the App, and on Android by Google Play services on your phone, together with Google’s own sign-in screens. What Google receives at this step is a property of this sign-in method, not something Pausa asks for. In its own privacy disclosure for Google Sign-In, Google declares that this software may collect your name, email address, user identifier, phone number, approximate location, a device identifier, other usage data and other data types, linked to you, to perform the sign-in and for Google’s own analytics. Google processes this data as the provider of your Google account, under Google’s privacy policy.

Pausa does not ask for your phone number or your location and does not receive or store them. From a Google sign-in, Pausa receives only what is listed above in this section; your Google profile may also include a link to your profile picture, which Firebase Authentication keeps with the account and the App does not use.

Google Sign-In takes no part when you sign in with Apple or with an email address and password, or when you use Pausa without an account (§2). Both of those sign-in methods turn on the same cloud sync.

3.3 Notifications

The current version of Pausa does not use server push notifications. Reminders are created and scheduled by the App on your device and shown by your device’s own notification system.

• We do not store a push token for your device and keep no record of your device for notifications.
• Which reminders you switched on and the time you chose are part of your settings (§3.1): they are kept on the device and, when you are signed in, synced with the rest of your settings.
• Billing reminders: if your subscription is set to renew, the App schedules on your device one reminder — 48 hours before a free trial ends, or 7 days before a yearly subscription renews — with the date and the amount of the upcoming charge as the App Store or Google Play report them. If you have cancelled the renewal, there is no reminder. If its time falls within three hours after a check-in at one of the two lowest levels or after you open “It's hard right now”, the App moves it later, by no more than three hours; this is decided on the device. The date, the amount and the reminders themselves are kept on the device and are not sent anywhere. If notifications are not allowed, the App shows the same reminder inside the App when you open it.

Notification texts are written in advance and are identical for everyone in a given language; the only exception is the date and the amount in a billing reminder. Nothing you wrote and nothing you marked is placed inside a notification.

3.4 Diagnostics — off by default

Product analytics and crash reports are switched off until you explicitly turn them on. This is not only a toggle in the interface: both SDKs are disabled in the App’s build configuration on iOS and Android, so nothing is collected before your decision. One switch controls both streams (Settings → Usage stats and crash reports).

If you do turn diagnostics on, we receive:

• event names, such as a screen being opened, a practice or a journey step completed, a check-in made (without its level), a situation brought to its end (without saying which), a program opened or one of its steps answered, something kept from a program’s final step, a tool opened, something marked in “What suits me”, a free journey chosen, a part of the day expanded on your role’s screen, the subscription screen shown, a purchase started, diagnostics turned on
• a fixed, published list of coarse parameters: the identifier of the tab you open and of the tab you came to it from (or a mark that it is the first tab after the App starts); the class of a completed practice (breathing, writing, a role ritual, a situation tool, or other) and its duration in seconds; the day of a journey step, without the name of the journey; for programs for your work: which program it is (only “Studying while working”, “Leading people, staying yourself” and “When your work is on display” are named; any other program is sent as “other”, and “When work has taken too much”, “After something hard at work” and “When someone close has died” send no program events at all), whether it was opened from the shelf or from a link in another program, the number of a step and your answer to it (done, skipped or doesn’t fit), whether the step is in the free part and whether it is the final one, and the kind of thing kept from the final step (a tool, a breathing practice or a step); which tool was opened (“Six areas”, “Workload talk”, “If–then” or “Threshold”); the kind of item marked in “What suits me” (a role practice, a breathing practice, an exercise, a tool or a program), without the item itself; whether a free journey was chosen from the list or from its card; which of the three parts of the day (before, between or after) you expanded on your role’s screen and whether it was the one the App had guessed; the step at which the “Show me around” tour ended or was stopped (a step identifier) and where it was started from (settings), without the total number of its steps; how many days passed since your previous visit; the local hour on your device (a number from 0 to 23, without minutes) when you open the App, finish a practice or open a tool; onboarding step; how many minutes passed between the first launch and the first completed practice, and whether that happened in the first session; how many hours passed between the first launch and the first time you went through “Threshold” — only as a range, from “less than an hour” to “a week or more”, not as an exact number; where the subscription screen was opened from, which subscription screen it was, and how it was closed; product identifier and the length of a free trial in days; your main professional role, when you set it or make another role your main one (your other roles are not sent); the kind and hour of a care reminder or prompt, and how that hour was chosen; for which kind of notifications (local or push) the permission was withdrawn, and its new state; where an action started (the app icon, a notification, a widget, a quick action, the system, or inside the App); and, if you take part in a product experiment, its name and your variant
• app version, device model and operating system version
• crash reports: stack traces and technical logs, linked to your account identifier
• an app instance identifier that Firebase Analytics assigns to this installation of the App to count events from the same installation; it is not linked to you: Analytics never receives your account identifier or email, and the App has no advertising identifier
• an approximate location, such as country or city, that Google Analytics derives from a masked IP address; the App does not use your device’s location services
• events that Firebase Analytics records on its own, without the App asking, such as the first launch, sessions and app updates, and purchases and subscriptions as the App Store or Google Play report them — with the product identifier, product name, price and currency

Analytics never receives the text of your diary entries, the level of your check-ins, the situation or focus you chose, what you tell the App about that situation, the name of a journey, emotion names, names of tasks you typed, or your email address. Nothing about “It's hard right now” is collected: opening it or going through it creates no analytics event. The events the App builds itself carry only parameters from the fixed list above; everything else is dropped before such an event is built, and automated tests keep it that way. The events Firebase Analytics records on its own (the last item in the list above) are not filtered by the App: we add nothing to them and they contain nothing from your diary or check-ins, but their parameters are set by Google, not by our list.

We never put your entries, check-in levels or email into crash reports either: a crash report carries the technical message of the failure and the code path that produced it. We cannot promise that a technical message never quotes a fragment of what you were writing when the App broke, so we keep crash reports off unless you allow them, and delete them on the platform’s schedule.

Turning diagnostics off stops the collection, deletes crash reports that have not been sent yet, and discards anything held in memory. Before you decide, events wait in the device’s memory only and are destroyed if you decline or close the App.

Separately from this switch, Google’s Firebase software attaches a technical label to its requests whenever the App talks to Firebase — when you sign in or sync, when it fetches the shared settings described in §2, and for diagnostics you allowed: which versions of Firebase components the App uses, on which platform, and on which days. Google uses it to maintain and improve Firebase and states that it is never linked to a user or device identifier.

3.5 Subscriptions and payments

Payments are processed by the Apple App Store or Google Play. We never see or store your card number, billing address, or any payment credentials.

The App learns the status of your subscription — product, period, trial, renewal, expiry, cancellation — from RevenueCat (§5) on your device, so that the paid features open for the account that paid for them. The App does not write that status to our cloud database.

To know whether a subscription can be bought at all, the App asks the App Store or Google Play, through RevenueCat’s software on your device, which country your store account belongs to, and keeps that country code on the device. It is asked again at every launch, so that the App knows the country before the store answers and without a connection; a code that has not been confirmed for 30 days is no longer used. Where the store does not take payments (currently Russia), Premium is open without a purchase. Pausa does not send the country to analytics or to our cloud database. Like the confirmation of a purchase, it belongs to your store account rather than to your Pausa account, so deleting your account does not erase it from the device (§7).

3.6 Feedback you send us

If you send feedback from inside the App, we receive your rating, the ratings of individual sections if you give them, your optional answer to “Tell us why” and your optional comment as written, your account identifier, and the app version, platform, language and the time you sent it. Please treat those fields as a message to a human: unlike your diary, they are meant to be read by us. We read them to look into the problem you describe and to understand which parts of the App work for people and what to change.

If a subscription is not affordable for you right now, you can ask us for a free code on the subscription screen. Tapping “Write an email” opens your email app with a ready letter to the address in §12 that names your store and the app version; we receive it, together with your email address, only if you send it. At the same tap the App notes the time on your device, to show when you can ask again; this note is erased with the rest of your data on the device (§8). If you are signed in, the App also records the request in our cloud database: an entry with your account identifier, language, app version, platform and time, kept alongside feedback, and a counter under your account with the times of your last two requests, which limits requests to one in 90 days and two a year. Neither has room for a reason or for anything about your state. Unlike other feedback (§7), both the entry and the counter are deleted together with your account (§8), and both are included in your data download. Your email is not: it stays in our mailbox — write to us if you want it deleted too.

3.7 What we do not collect

• your real name beyond what your sign-in provider passes to us
• your precise location: the App does not use your device’s location services and has no location permission. Approximate location appears only in the two cases described above: Google Analytics derives it from a masked IP address if you allow diagnostics (§3.4), and it is among the data Google declares for its sign-in if you choose to sign in with Google (§3.2)
• your contacts, calendar, photos, media, files, or microphone
• data from Apple Health / HealthKit or Google Fit — Pausa does not connect to them
• advertising identifiers: there is no IDFA on iPhone (the module that reads it is not in the App) and no Android Advertising ID on Android (its collection is switched off and the permission for it is removed), no App Tracking Transparency prompt, and no advertising SDK in the App

Pausa does not track you across apps and websites owned by other companies, does not sell personal data, and does not use anything you write or mark for advertising or marketing.

4. Why we use this information

• To provide what you asked for: keep your diary and check-ins, sync them between your devices, show your own history back to you, and show the reminders you switched on. Legal basis: performance of our agreement with you.
• To keep the information that describes your well-being (§3.1) in the cloud. Legal basis: your explicit consent — you give it by signing in, which is what turns cloud sync on, and you withdraw it by signing out or by deleting your account (§8).
• To collect diagnostics (§3.4). Legal basis: your separate, explicit consent, which you can withdraw at any moment in Settings; withdrawing it stops the collection.
• To open paid features for the account that bought them. Legal basis: performance of our agreement with you.
• To keep the App working — fix crashes, look into the problems you report and the requests you send us (§3.6), see which screens people open, decide what to build next. Only from the diagnostics you allowed (§3.4) and from the feedback and requests you sent us (§3.6).
• To protect our cloud database from automated abuse (App Check, §5) and to keep the free codes described in §3.6 available to the people who ask for them. Legal basis: our legitimate interest in keeping the service working and fair. Nothing from your diary or check-ins is used for this.

We do not use your information for advertising, for marketing profiles, or for any automated decision about you. We do not sell personal data.

5. Who else processes your data

Pausa is a small independent product built on third-party infrastructure. The services below act as our processors under contract and are not permitted to use your data for their own purposes:

• Firebase Authentication (Google) — your email, provider identifier and account identifier; sign-in only.
• Cloud Firestore (Google) — the well-being information in §3.1 together with your profile and settings, stored under your account identifier. This is where your diary lives once you are signed in. With or without an account, the App also reads from it the shared settings, announcement and crisis helpline numbers described in §2, which are the same for everyone; nothing about you is written for this.
• Firebase Cloud Messaging (Google) — not used in the current version: we send no notifications from our servers and store no push token. Reminders are scheduled on your device (§3.3).
• Firebase Analytics (Google) — only after you turn diagnostics on; event names and allowlisted parameters, the app instance identifier and the approximate location described in §3.4, without your account identifier attached.
• Firebase Crashlytics (Google) — only after you turn diagnostics on; crash traces and technical logs, linked to your account identifier.
• RevenueCat — subscription status. RevenueCat receives your Firebase account identifier (uid) as its app user identifier, so that a purchase follows your account across devices, together with the purchase data the stores report. It receives none of your diary entries, check-ins, role or situation.
• Apple and Google as providers of sign-in and payments — when you sign in with them and when you pay. Here they act under their own privacy policies rather than as our processors; for a Google sign-in, §3.2 describes what Google declares for Google Sign-In.
• Firebase App Check (Google), with App Attest on iPhone (Apple) and Play Integrity on Android (Google) — when the App connects to Firebase Authentication or Cloud Firestore (to fetch the shared settings described in §2, with or without an account; to sign in, sync, delete your account or send feedback), it asks your phone’s platform to confirm that the request comes from a genuine copy of Pausa on a genuine device. The confirmation is a short-lived token attached to those requests; it contains nothing you created in the App. To issue it, Apple or Google receive information about the App and your device under their own privacy policies; Pausa does not receive that information.

Data is stored on Google Cloud infrastructure and may be processed in the United States and in other countries where these providers operate, under the transfer safeguards in their terms, including the EU Standard Contractual Clauses.

We do not share your data with data brokers, advertising networks, or anyone else beyond the list above.

6. Well-being information: how we handle it

• It is never used for advertising, marketing, or personalising ads, and never shared for those purposes.
• It is not sold, and not disclosed to anyone beyond the processors named in §5.
• We do not read your diary. Nobody on our side reviews or moderates entries, and they are not used to build profiles about you. We would access them only if the law obliged us to.
• Your entries, the levels of your check-ins, and the situation or focus you chose are never sent into analytics, and the App does not put them into crash reports (§3.4 says where this promise ends). Of the choices described in §3.1, only your main professional role goes into analytics, and only if you turned diagnostics on; your other roles are not sent.
• The App is set up to keep it out of platform cloud backups: on iOS the App marks the folders where it stores this information as excluded from iCloud Backup, and on Android cloud backup is switched off. Pausa does not use iCloud, CloudKit, or Google Drive to store your entries. Android's direct phone-to-phone transfer stays on deliberately, so that when you change your Android phone your history moves across encrypted, from your old device to your new one, without passing through us. Because of the exclusion on iOS, if you change iPhones without an account, your history may not move to the new iPhone.
• Removing your account removes it (§8).

7. Storage, retention and security

• On your device, the data stays until you delete it in the App, delete your account, or uninstall the App. Deleting your account does not erase what you chose for this device rather than told about yourself — language, theme, date and time format, whether you finished the onboarding, and your diagnostics decision — nor the App's technical state on the device, such as whether notifications are allowed and whether a purchase was confirmed on it.
• In the cloud, it stays for as long as your account exists.
• Analytics events and crash reports, if you allowed them, are kept by Google for the retention period configured for the project and then deleted.
• Feedback you send (§3.6) is stored separately from your account data and is not removed by account deletion; write to us if you want it deleted too. The one exception is a request for a free code: it is deleted together with your account (§3.6, §8).
• Data travels over encrypted connections (HTTPS/TLS). Access rules on the cloud database allow an account to read and write only its own data.

No system can guarantee absolute security.

8. Your choices and your rights

• Download your data: Settings → Download my data. You get a JSON file with your profile, everything synced to the cloud, and what is held on the device.
• Delete your account: Settings → Account → Delete account. Before anything is deleted, the App asks you to confirm your sign-in: always if you signed in with Apple; with Google or email, only if your last sign-in was more than a few minutes ago. The App then deletes everything stored under your account identifier in our cloud database — diary, check-ins, activity history, settings, and any notification device records left by earlier versions of the App — checks that nothing is left there, and only then deletes your sign-in account; if you signed in with Apple, it also asks Apple to revoke the App's access to your Apple ID. If a cloud step does not finish, your sign-in account is kept and you can run the deletion again; it continues where it stopped. On the device you are using, the App erases your diary, check-ins, activity history, the role and situation you chose and everything created in them, your profile and achievements, and cancels the reminders already scheduled. What stays on the device is listed in §7. It cannot be undone.
• If you cannot open the App, ask us to delete your account and data by writing to the address in §12.
• Withdraw the diagnostics consent: Settings → Usage stats and crash reports. Switching it off stops collection immediately (§3.4).
• Stop cloud sync: sign out. Anything created afterwards stays on the device.
• If you are in the EU, the EEA or the UK, you also have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your data protection authority.

9. Children’s privacy

Pausa is not intended for children under the age of 13, and we do not knowingly collect personal data from them. Where local law sets a higher age for consent to data processing, that higher age applies.

10. Disclaimer

Pausa is intended for self-reflection and self-care only.

It does not provide medical, psychological or therapeutic services, does not diagnose or treat anything, and is not a substitute for professional care.

If you are experiencing significant distress, please seek support from a qualified professional. The App also lists crisis helplines.

11. Changes to this Policy

We may update this Privacy Policy. Any change is reflected in the “Last updated” date above. If we begin collecting something that is not named here, this policy will name it before that collection starts.

12. Contact us

Questions about this Privacy Policy, requests about your data, or a discrepancy between this text and what the App does: bych2007@gmail.com