Privacy Policy

Saunder — last updated 30 October 2026

This policy explains what personal data Saunder collects, why, and what your rights are. The controller is Juan Trinidad Jiménez Armesto (“we”, “us”), Avenida del Cid 82, 30, 46018 Valencia, Spain. Contact: saunderapp@gmail.com. Trader identification and contact details are in the Terms of Use.

1. What we collect and why

Without an account — an anonymous installation identifier. You can browse the catalogue and listen to every free sample without creating an account. Even then, the first time you open Saunder it creates a random identifier for your installation (an anonymous sign-in with Firebase Authentication). It does not contain your name or email, but it identifies your installation, so data-protection law treats it as personal data. These are tied to it:

• the feedback answers you choose to send (section 1.5);
• prices: without an account, RevenueCat assigns its own random identifier to show you prices; your Saunder identifier reaches RevenueCat only when you have an account, for purchases and restores (section 1.2);

Crash reports and stability data (section 1.4) use separate random installation identifiers. We do not send your Firebase Authentication identifier or account identity with them. Both kinds of identifier are personal data; the term “anonymous sign-in” describes the account type, not irreversible anonymisation.

If you create an account, the same identifier becomes your account’s, so your feedback and purchases stay with it. If you instead sign in to an account you already had, that account’s identifier is used from then on.

1.1 Account data. When you buy a guide, or if you choose to in Settings, you create an account. We store your email address and a display name: the one you type when you sign up with email, or the one Apple or Google share with us if you sign in with them (Apple lets you hide your email and share your name only if you agree; we then receive a relay address). We use this to keep your purchases tied to you, so they work on all your devices and on both iOS and Android. Legal basis: performance of the contract with you.

1.2 Purchase data. Payments are processed by Apple (App Store) or Google (Google Play). We never see your card details. We receive a purchase record (which product, when, which store, and the store’s transaction identifier) through RevenueCat, the service we use to validate purchases and unlock content. We keep this record linked to your account to give you what you paid for and to handle support. Restore purchases asks you to sign in first. A purchase belongs to the App Store or Google Play account that paid for it: if you buy or restore with that store account while signed in to a different Saunder account, RevenueCat moves the purchase record to that Saunder account and the previous one loses it. If you delete your account, we minimise the purchase record and retain a pseudonymised record as described in section 3. We also keep encrypted backup copies of these records and of your entitlements (sections 2 and 3). Legal basis: performance of the contract for purchase validation and access; for the pseudonymised record kept after account deletion, our legitimate interest in handling refunds, claims and fraud.

1.3 Downloaded content and progress. Which guides you have downloaded are stored only on your device. Your progress (where you left off in each audio, which audios you have listened to, and the last page you read in the guide) is stored only on your device. It never reaches our servers, so it does not follow you to another device. If you sign in to an account you already had, the progress you made in this app before signing in is carried over to that account on this device. Legal basis: performance of the contract.

1.4 Crash reports and stability data. When the app closes by itself, it sends a report to Firebase Crashlytics (Google): what went wrong in the app, the app version, the operating system and the device model, and random installation identifiers. Crashlytics also records when the app is opened to start a session, with the device manufacturer and model, the operating system and the network type, and uses this for crash and stability metrics. We do not add your name, email or account identifier to any of this. Google keeps crash reports and associated identifiers for 90 days before starting their removal. Legal basis: our legitimate interest in finding and fixing faults in the app. Only the published app sends this data, and it always does: there is no setting to turn it off. You can object to this processing by writing to saunderapp@gmail.com.

Saunder does not use usage analytics: the app includes the Firebase Analytics software, but it is switched off and sends nothing.

1.5 Feedback. If you answer the optional in-app questions (which country or language you would like next, free text), we store your answers, the country page you opened them from, and the platform and app version, tied to your account or to the anonymous installation identifier. Answers are stored only in our Firebase database (section 2), where we read them. Legal basis: your consent to sending the optional response. You can decline without losing access to Saunder and withdraw consent by contacting us; withdrawal does not affect the lawfulness of earlier processing. Please do not include sensitive information about yourself or other people.

1.6 Support. If you email us, we keep the correspondence for as long as needed to resolve your request. Legal basis: legitimate interest in providing support.

1.7 Invitations and coupons. If you have an account and invite friends, we create a personal invite code for you and a link that contains it. If you enter someone’s invite code, we store who invited whom, the code and when it was entered. For both of you we store the coupons issued (whether each is available, used or cancelled, when it was issued and expires, and a reference to the purchase that earned or used it). When you enter an invite code, the person who invited you receives a coupon once you make a purchase. We never tell them what you bought, but because their coupon arrives after your purchase, they may work out that you bought something. On Android, if you install Saunder from an invite link, the app reads the invite code from Google Play’s install referrer the first time it opens and keeps it on your device until you create an account and confirm it. On iPhone, the app reads your clipboard only when you tap the Paste button to paste a code, never otherwise. The invite web page checks the code in your browser and does not look it up on our servers. We keep all of this while your account exists and delete it when you delete your account; the coupon of the person who invited you is kept, and it holds only an internal identifier of your deleted account, which is not linked to any name, email or contact details; it is kept while that person’s account exists. Legal basis: performance of the contract (the invite programme in the Terms of Use).

We do not collect your precise location, contacts, photos or microphone. We do not use advertising identifiers and we do not show ads.

2. Who processes your data

We use the providers below. Providers acting as our processors process your data under data-processing agreements with us. Apple and Google also process store payments and account sign-in under their own terms and privacy policies.

We do not sell personal data and we do not share it with anyone for advertising.

3. How long we keep it

• Account data: while your account exists.
• Listening and reading progress: only on your device, until you delete your data or uninstall the app; we do not hold it.
• Without an account: after 2 years without using the app, we delete the feedback tied to the anonymous installation identifier, your customer record at RevenueCat (if there is one) and the identifier itself; purchase records are minimised as described below.
• Purchase records: while your account exists. On deletion, we remove the account identifier and the original transaction and RevenueCat event identifiers from the retained purchase record. We keep the country and product, store, purchase type and date, revocation date and reason, and the date of minimisation. The record’s identifier is derived from the transaction (or purchase event) and country using a hash, or is random if neither source identifier exists. A known transaction can therefore be matched to the derived identifier: this is pseudonymisation, not guaranteed anonymisation. The scheduled deletion removes records 6 years after purchase; if no purchase date is available, the current implementation counts from minimisation. The purposes and legal basis are described in section 1.2.
• Invite codes, who invited whom and your coupons: while your account exists; they are deleted when you delete your account. A coupon already issued to the person who invited you remains in that person’s account, with the limited internal reference described in section 1.7, while that account exists.
• Crash reports: 90 days before Google starts removing reports and associated identifiers.
• Stability data (session starts and the device details that go with them): Google does not publish a specific retention period for it; it is kept under Google’s own retention schedules for Crashlytics. You can ask us to request its deletion (section 4).
• Feedback: 2 years from when you sent it, then deleted from our database.
• Support emails: up to 2 years after the request is closed.
• Backups: every night we copy our purchase records and entitlements to private, encrypted storage (Cloudflare R2). We keep at most the last 30 copies, none older than 30 days, and they are deleted automatically, including the records of accounts you have deleted.
• Operational logs: they hold no account identifier and are kept for up to 7 days.

4. Your rights

You can access, correct, download or delete your data, restrict or object to its processing, and withdraw consent at any time. Things you can do yourself:

• Delete your account in the app: Settings → Delete account. In the app, this revokes the app’s access to your Apple Account if you signed in with Apple, and removes your account, your customer record at RevenueCat, your invite code, your invitations and your coupons, and your feedback answers in our database. We minimise retained purchase records as described in section 3. Purchases are also removed from your account (see the Terms of Use for what this means). Deletion is permanent; section 3 explains the limited records that remain.

Without an account you can do the same in Settings → Delete my data: it removes the feedback tied to the anonymous installation identifier, your customer record at RevenueCat (if there is one) and the identifier itself, and minimises retained purchase records (section 3). Both also remove the progress saved on your device. Continuing to use the app creates a new anonymous sign-in. Uninstalling the app removes only what is on your device.

Deleting your account or using Delete my data does not automatically delete crash reports or stability data, which use separate installation identifiers. You may also request erasure of that data by contacting us. We may need additional information to locate them and will explain what we can identify and any applicable retention exception; we do not require you to create an account solely for that purpose.

For these requests or any other privacy right, email saunderapp@gmail.com. We respond without undue delay and within one calendar month. If a lawful extension is necessary because of the complexity or number of requests, we will tell you within that first month, with the reason; the extension can be up to two further months. Requests are normally free, and we may seek proportionate identity verification where necessary. You can complain to a competent data protection authority, including the authority in your EU/EEA country of habitual residence or work, or where an alleged infringement occurred. In Spain, this is the Agencia Española de Protección de Datos (AEPD).

5. International transfers

We are based in Spain. For transfers outside the EU/EEA, the applicable safeguard depends on the recipient and service. An adequacy decision, including the EU–US Data Privacy Framework, applies only where the recipient and transfer fall within its scope. Otherwise, appropriate safeguards such as Standard Contractual Clauses, with supplementary measures where necessary, are required. You can ask us at saunderapp@gmail.com for information about the safeguard for a specific transfer and a copy of the relevant safeguards, with confidential information redacted where appropriate.

6. Security

Data is encrypted in transit (TLS) and at rest by our providers. Access to your data is limited to what is needed to run the service. Purchase entitlements are verified server-side and never editable from the app.

7. Children

Saunder is not directed at children under 16. If you are under 16, you need your parent’s or guardian’s permission to use Saunder. If you are a parent or guardian and your child has used Saunder without your permission, you can delete their data on their device (Settings → Delete account, or Delete my data if they have no account), or email us and we will delete it as described in section 4.

Where the law requires app stores to share a user’s age range with apps, as in some US states, Saunder asks the store for it while you use the app: on iPhone, only when the App Store tells us the requirement applies to you; on Android, only if your Google Play account is in the US. We use it only to confirm that requirement is met. It is never stored, sent to us or anyone else, linked to your account or used for analytics.

8. Changes

We will post any change here and update the date at the top. If a change materially affects your rights, we will tell you by email if you have an account, and in the release notes of the app version, before it takes effect.

Contact: Juan Trinidad Jiménez Armesto, Avenida del Cid 82, 30, 46018 Valencia, Spain · saunderapp@gmail.com

Back to the home page