Privacy policy
Last updated: 23 October 2026
- No ads, and we don't sell data. The app has no third-party analytics or tracking, and nobody pays for your data. It only counts, without knowing whose they are, how many notifications go out and how many get opened.
- Your emotions and your medication are yours. They only leave your phone if you leave that switched on and, if you are under 14, with permission from your parent or guardian.
- What you can do without asking anyone: download all your data or delete your whole account from Settings, inside the app.
1. Who is responsible
Vira is an app and a website by Arnau Piñol, Spanish tax ID (NIF) 72827079V, address C/ del Futur, s/n, 17252 Sant Antoni de Calonge (Girona, Spain). For anything about your data, write to arnau@vira.com.es.
2. What data we process and why
| What | What for | Legal basis |
|---|---|---|
| Your account: email, nickname, whether you are a young person or family, your account ID (attached to every piece of data that is saved) and, if you sign in with Apple or Google, the ID that service gives you. | So you can use the app and lose nothing when you change phones. | It is needed to provide the service you ask for (art. 6.1.b GDPR). |
| Your plan: tasks, habits, focus sessions, XP, ViriCoins, streak, rewards and skins. | Saving it to your account and keeping it the same on all your devices. | It is needed to provide the service (art. 6.1.b GDPR). |
| Emotion log (emotion, intensity, note and time) and medication (name, dose, schedule and doses taken). | Saving them to your account. Only if the switch in Settings is on and, under 14, there is guardian permission. Otherwise they stay on your phone. | Your explicit consent (art. 9.2.a GDPR) and, under 14, your guardian's (art. 7 LOPDGDD, the Spanish data protection act). You can withdraw it whenever you want from Settings. |
| Guardian permission: their email, whether they gave permission and when. | Being able to prove the permission exists. | Legal obligation (art. 6.1.c and art. 8 GDPR). |
| Notifications: a device identifier, Apple's notification token and your time zone. | Sending you the 11 pm streak notification, if you have it on. | It is part of the service you turn on (art. 6.1.b GDPR). |
| Notification count: how many notifications go out and how many get opened, per day and per type. It carries no account, no device and no other identifier, so we can't tell whose it is. Medication and emotion notifications are only counted when those records can leave your phone (see the emotion log row); otherwise their count is deleted on the phone itself. | Knowing whether notifications help you or annoy you, and adjusting them. | Legitimate interest in improving the app (art. 6.1.f GDPR). |
| Family panel: the link with your parent, their messages of encouragement and the reminders they suggest. | So your family sees what you decide to share: usage, streak, habits and tasks done. For emotions and medication they only see how many entries there are, never what they say. Each part can be closed with one tap. | Your consent, which you give when you link up from your phone (art. 6.1.a and 9.2.a GDPR). |
| Viri's help: the text you choose when you tap a help option (what you type, a task title, the lines read from a sheet or today's tasks). | Splitting tasks, breaking them into steps or helping you get started. Emotions, medication, your email and the photo of the sheet are never sent. | Your consent, asked for the first time (art. 6.1.a GDPR). Under 14, only with guardian permission. You can turn it off in Settings → Modules. |
| Trial programme with professionals: if your psychologist suggests it and you sign, a code without your name, age, gender, ADHD type, other diagnoses, whether you take ADHD medication (only the type) and a monthly questionnaire. | Knowing who Vira helps and what to improve. It is not cross-checked with what you do in the app. | Your explicit consent and, if you are under 18, also your parent's or guardian's (art. 9.2.a GDPR). |
| Website waitlist: email, language, where you came from and when you accepted. | Telling you about what's new at Vira. | Your consent with the checkbox (art. 6.1.a GDPR). You can unsubscribe by replying to any email. |
| Website visits: pages viewed and clicks, and session recording with text fields hidden. No cookies. | Knowing which parts of the website work. | Legitimate interest in improving the website (art. 6.1.f GDPR). |
In earlier test versions, anyone sending feedback from the app could attach a screenshot along with their phone model and iOS version. That button no longer exists; what we received is kept only to fix bugs, and you can ask for it to be deleted.
3. What never leaves your phone
- Apple Health: if you turn it on, Vira writes your mood and reads your hours of sleep on the iPhone itself. Nothing reaches us.
- Calendar: the app shows your events, but doesn't copy or send them.
- Sheet scanning: the photo isn't saved. Only the lines you choose become tasks.
- Paused apps: Vira doesn't know which apps you choose. Apple only gives it codes it can't read.
- Your age: your age range stays on your phone. We don't ask for your real name or date of birth.
If you turn on Reminders import, imported reminders become tasks in your plan and are saved like any other task.
4. Minors
Vira is designed for young people aged 12 to 21. If you are under 14, Spanish law requires permission from your parent or guardian to process your health data: without that permission, your emotions and medication stay on your phone and Viri's help doesn't appear. The permission is stored on our server and the app can't change it by itself.
To ask for it, the app sends an email to the adult with a single-use link that expires after 7 days. We keep their email, their answer, when they answered and which version of the text they read. We don't keep their IP address.
We process minors' data in line with the GDPR and the LOPDGDD. Viri's help uses an AI model: the replies you get are written by a machine, not a person.
5. Who we share data with
Only with companies that provide technical services and process data on our behalf:
- Supabase: database, accounts and server functions. The data is in the European Union.
- Apple: Sign in with Apple, notifications and app distribution.
- Google: Sign in with Google.
- Anthropic: the AI model behind Viri's help. It only receives the text you choose and doesn't use it to train its models.
- TypeSafe: an AI model that checks whether a task you add looks big, so it can suggest breaking it into steps. It only receives the task title and the language, without your account or your email, and it is in the United States.
- Vercel: hosts the website. The server functions are in Dublin and the pages are served from its network around the world.
- Resend: sends the waitlist emails and the one asking the guardian for permission. It stores data in the United States.
- PostHog: website statistics, in its European cloud.
- Microsoft 365: the mailbox where your replies arrive.
Several of these companies are based in the United States. When data leaves the European Economic Area, it is protected with GDPR safeguards: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
We never sell your data or share it with anyone for advertising.
6. How long we keep it
As long as you have an account. If you delete it from Settings, everything on the server is deleted. The notification token is deleted when you turn the notification off, when you sign out or when Apple says it is no longer valid. Waitlist data, until you unsubscribe. Trial programme data, for as long as the programme lasts plus 12 months. The notification count carries no identifier: nobody can tell whose it is, so it isn't deleted with your account.
7. Your rights
You can access your data, correct it, delete it, take it with you, object to or restrict its use, and withdraw any consent. From the app you can already download everything (JSON and PDF) and delete your account. For anything else, write to arnau@vira.com.es and we'll reply within one month at most. If you think we haven't handled it properly, you can complain to the Spanish Data Protection Agency (AEPD).
8. Security
Each person can only read and write their own data on the server. Connections are encrypted and data is stored encrypted. On the phone, Vira's files are protected by iOS, you can lock the app with Face ID, and by default nothing sensitive appears in widgets, notifications or iPhone search.
9. Changes
If this policy changes in any important way, we'll tell you in the app before it applies. The date at the top shows the latest version.