Privacy policy

Last updated: 19 October 2026

In short:

To create your account we only ask for your email address.
Your shifts, rotations, holidays and notes are stored only on your phone. We don’t send them to any server.
We don’t sell your data, show ads or use tracking tools.
You can delete your account at any time in the app: Settings → Account → Delete account.

1. Who is responsible

The data controller is Iker Pérez Goñi, owner of the Riturno app. For any privacy question, write to ikerperez555@gmail.com.

2. What data we process and why

Data	What we use it for	Legal basis
Email address	Creating your account, sending you the sign-in code and, if needed, replying to you or telling you about important changes to the service.	Performance of the contract (the terms of use you accept when signing up).
Technical session data (user ID, sign-up and last sign-in dates, IP address in server logs)	Keeping your session secure and preventing abuse, such as mass code requests.	Legitimate interest in the security of the service.

What stays on your phone

Shift types, rotations, shift changes, holidays and absences, public holidays, reminders and preferences are stored in a database on your own device. Riturno doesn’t receive them and can’t see them. If you uninstall the app or change phones, that data is lost unless you later turn on cloud backup (a paid feature that isn’t available yet). Before it becomes available, we will update this policy.

Shift reminders

Shift reminders are scheduled on your own phone. We only ask for notification permission if you turn a reminder on.

What we don’t do

We don’t ask for health data, weight or medical information.
We don’t use advertising or third-party analytics or tracking tools.
We don’t sell or hand over your data to third parties for commercial purposes.
We don’t make automated decisions with legal effects on you.

3. Who we share your data with

To run the service we use providers that process data on our behalf (data processors), under contracts and safeguards in line with the EU General Data Protection Regulation (GDPR):

Supabase: hosts user accounts. Data is stored on servers in the European Union.
Resend: sends the emails with your sign-in code. It is a US company; the transfer relies on the European Commission’s standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.

Apart from this, we would only disclose data to authorities when legally required.

4. How long we keep your data

For as long as you have an account. If you delete it in the app, we remove it immediately. Technical backups at our provider may remain for up to 30 days and are then deleted automatically. Server logs are kept for the minimum time needed to keep the service secure.

5. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time by writing to ikerperez555@gmail.com from your account email. We will reply within one month.

If you think we haven’t handled your request properly, you can complain to the Spanish Data Protection Agency (AEPD) or to the data protection authority in your country.

6. Children

Riturno is not intended for children under 14. If you are under 14, please don’t create an account.

7. Security

Communication between the app and our servers is encrypted, and each user can only access their own account. No system is completely infallible: if we detected a security problem affecting your data, we would tell you and notify the authority where required.

8. Changes to this policy

If we add features that change how we handle your data (such as cloud backup, subscriptions or AI-written tips), we will update this policy and let you know in the app before they affect you.