Privacy policy
Last updated: October 7, 2026 · Draft pending legal review
This policy explains what data Consta (the app and the heyconsta.app website) processes, why, and what rights you have. Data controller: [OWNER: name / company name, tax ID, address]. Contact: hello@heyconsta.app.
What data we process
- Account: your email or your Sign in with Apple identifier. If you use Apple with "Hide My Email", we only receive a forwarding address.
- Profile: name, @username, profile photo, bio, time zone and app language.
- Content you create: goals, proofs (photos, short videos without sound and screenshots), comments, reactions, nudges, groups and contracts.
- Location: only if you create a goal with a place (for example, your gym). We store the goal's point and radius and, when you upload each proof, your position at that moment and the distance to the place, so your reviewers know you were there. We don't access your location in the background or outside that moment.
- Social graph: your friendships, requests, blocks and the groups you take part in.
- Notifications: your device's push notification token.
- Subscription: if you buy Premium, the status of your subscription (we never see your card: payment is processed by Apple or Google).
- Usage and diagnostics: app usage events (screens viewed, actions such as "goal created") and technical errors, linked to an internal identifier, never to the content of your photos or texts.
We don't use your data for advertising and we don't sell it. We don't track you across third-party apps.
What we use it for and legal basis
| Purpose | Legal basis |
|---|---|
| Providing the service: account, goals, proofs, reviews, friends, groups, notifications | Performance of the contract |
| Charging for and managing Premium | Performance of the contract |
| Security, abuse prevention and content moderation (reports, automatic filtering of text and images) | Legitimate interest |
| Usage analytics and error diagnostics to improve the app | Legitimate interest |
| Complying with legal obligations | Legal obligation |
Who can see your content
- Your proofs are seen by the people who review that goal and, if the goal is "visible to friends", by your friends. Nobody else sees "reviewers only" goals.
- In a group, members see the group's goals and proofs.
- Your name, @username and photo may be seen by other users when they search for you, unless you've blocked them.
- There are no public profiles on the web.
Processors
We use providers that process data on our behalf, with contractual safeguards (standard contractual clauses when data is transferred outside the EEA):
- Supabase (database, authentication, photo storage, functions), EU region.
- Expo (push notification delivery and app updates).
- Apple and Google (notification delivery, payments).
- RevenueCat (subscription management).
- PostHog (usage analytics), EU region.
- Sentry (error diagnostics).
- Vercel (hosting of the heyconsta.app website).
- OpenAI (automatic moderation: proof and profile photos are checked for sexual, violent or hateful content; they aren't used to train models).
The website
heyconsta.app has no accounts, ads, analytics or tracking cookies. We only store a technical cookie with your language if you change it manually. Our hosting provider (Vercel) logs technical data about each visit, such as your IP address, to serve the website and protect it from abuse. Invite links (/u/…, /g/…) don't show any profile data: only the @username or code contained in the link itself.
How long we keep it
For as long as you have an account. If you delete it (Settings → Delete account; more at heyconsta.app/delete-account), we immediately delete your profile, goals, proofs and photos, friendships and notifications, except what we must keep by law. Content reports may be kept for up to 12 months for security reasons. Backups are overwritten within 30 days at most.
Your rights
You can access, rectify, erase, object to, restrict the processing of and request the portability of your data by writing to hello@heyconsta.app. You can also file a complaint with the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority of your country.
Minors
The app isn't aimed at children under 13 (or the minimum age in your country). If we detect an account belonging to a minor without authorization, we'll delete it.
Changes
If we change this policy we'll let you know in the app before the change takes effect.