Privacy Policy

1. Data Controller

2. What is this application?

My Mattress is a web application that allows users to manage the maintenance of their mattresses: record rotations and flips, set up periodic reminders, and share tracking with other members of a household.

3. Data we collect and how we use it

3.1 Account data

Data: email address, display name (optional), authentication method (email/password, Google, or Apple).

Purpose: to create and manage the user's account, verify their identity on each sign-in, and allow other users to invite them when sharing a home.

Legal basis: performance of a contract (Art. 6.1.b GDPR).

Retention period: while the account is active. Upon a deletion request, data is erased within 30 calendar days.

3.2 Usage data

Data: home and mattress names (defined by the user), mattress type, dates of completed and scheduled rotations and flips.

Purpose: to provide the core maintenance-tracking service.

Legal basis: performance of a contract (Art. 6.1.b GDPR).

Retention period: until the user deletes the resource or requests account deletion.

3.3 Security and technical data

Data: device IP address (processed in memory to prevent abuse via rate limiting), timestamp of the last access, temporary authentication tokens (JWTs issued by Firebase, sent with each request but not stored in the database), and internal audit records of admin panel actions.

Purpose: service security, prevention of automated attacks, and session management.

Legal basis: legitimate interest (Art. 6.1.f GDPR).

Retention period: IP addresses are not persisted (they only exist in memory during the server session); last-access timestamps are kept on the account; admin panel audit records are kept for a maximum of 2 years, after which they are deleted automatically.

3.4 Application preferences

Data: language preference (cookie mattress_locale), visual theme preference (mattress-theme-mode in localStorage).

Purpose: to remember the user's preferences between sessions.

Legal basis: legitimate interest (Art. 6.1.f GDPR) / technical exemption under Art. 5.3 ePrivacy Directive. The language cookie expires after 1 year.

3.5 Invitations and blocks between users

Data: invitations to shared homes (who invites whom, their status and dates) and block relationships between users.

Purpose: to manage shared access to a home and to let a user block another.

Legal basis: performance of a contract (Art. 6.1.b GDPR) for shared homes, and legitimate interest (Art. 6.1.f GDPR) for block control.

Retention period: resolved invitations (accepted or rejected) are deleted automatically after 6 months; block relationships are kept while the block is active, and the technical rate-control data is deleted after 7 days. Deleting the account cascades and removes all of these relationships.

4. Recipients of your data

4.1 Other application users

When a user shares a home, other members can see their display name. The user controls who they share their home with through the invitation system.

4.2 Google LLC / Firebase Authentication

For authentication we use Firebase Authentication, a service by Google LLC (Mountain View, CA, USA). Firebase receives and processes the user's email during registration and sign-in. If the user chooses Google or Apple, Firebase manages that flow with the respective provider.

International transfer: covered by Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46 GDPR). More information:Google Privacy Policy and the Firebase Data Processing Agreement.

Firebase Crashlytics (planned): this service will be integrated in the future for technical crash detection. This policy will be updated before that integration is activated.

4.3 Infrastructure provider

The server and database are hosted on infrastructure owned and managed directly by CatDevs, located in Spain. There are no third-party hosting providers in the current processing chain.

5. User rights

Users may exercise the following rights at any time:

• Access (Art. 15 GDPR): obtain confirmation and a copy of your data.
• Rectification (Art. 16 GDPR): correct inaccurate or incomplete data.
• Erasure / Right to be forgotten (Art. 17 GDPR): request deletion of your data. You can also do this directly from the app under Preferences → Delete account.
• Restriction of processing (Art. 18 GDPR): restrict processing under certain circumstances.
• Portability (Art. 20 GDPR): receive your data in a machine-readable format.
• Objection (Art. 21 GDPR): object to processing based on legitimate interest.

To exercise your rights, send an email to catdevsstudio@gmail.com with the subject line "GDPR rights request", stating the right you wish to exercise and attaching a copy of your identity document. We will respond within a maximum of 30 calendar days.

If you believe that the processing does not comply with applicable law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) at: www.aepd.es.

6. Data security

CatDevs applies the following technical and organisational measures:

• Encrypted transmission via HTTPS (TLS) for all communications.
• Authentication via short-lived JWT tokens issued by Firebase.
• Role-based access control in the database (Row Level Security in PostgreSQL).
• Limiting access attempts (IP-based rate limiting on authentication endpoints).
• Passwords are never stored in CatDevs systems; they are managed entirely by Firebase Authentication.

7. Cookies Policy

This application uses only technically necessary cookies and local storage. There are no tracking or advertising cookies. See the Cookies Policy for more details.

8. Changes to this policy

This policy may be updated to reflect changes in the application or in applicable law. Material changes will be communicated with reasonable notice through the application itself or by email.