Privacy Policy

Last updated: September 29, 2026

1. Data Controller

Note: CatDevs is a team of two independent developers without a formally incorporated legal entity as of this policy. This information will be updated once the incorporation process is complete.

2. What is this application?

My Mattress is a web application that allows users to manage the maintenance of their mattresses: record rotations and flips, set up periodic reminders, and share tracking with other members of a household.

3. Data we collect and how we use it

3.1 Account data

Data: email address, display name (optional), authentication method (email/password, Google, or Apple).

Purpose: to create and manage the user's account, verify their identity on each sign-in, and allow other users to invite them when sharing a home.

Legal basis: performance of a contract (Art. 6.1.b GDPR).

Retention period: while the account is active. Upon a deletion request, data is erased from our database immediately and synchronously, with no waiting period, and revocation of the associated Firebase Authentication account is requested in the same process.

3.2 Usage data

Data: home and mattress names (defined by the user), mattress type, dates of completed and scheduled rotations and flips.

Purpose: to provide the core maintenance-tracking service.

Legal basis: performance of a contract (Art. 6.1.b GDPR).

Retention period: until the user deletes the resource or requests account deletion.

3.3 Security and technical data

Data: device IP address (processed in memory to prevent abuse via rate limiting), timestamp of the last access, temporary authentication tokens (JWTs issued by Firebase, sent with each request but not stored in the database), and internal audit records of admin panel actions.

Purpose: service security, prevention of automated attacks, and session management.

Legal basis: legitimate interest (Art. 6.1.f GDPR).

Retention period: IP addresses are not persisted (they only exist in memory during the server session); last-access timestamps are kept on the account; admin panel audit records are kept for a maximum of 2 years, after which they are deleted automatically.

3.4 Application preferences

Data: language preference (cookie mattress_locale), visual theme preference (mattress-theme-mode in localStorage).

Purpose: to remember the user's preferences between sessions to improve the user experience.

Legal basis: legitimate interest (Art. 6.1.f GDPR) / technical exemption under Art. 5.3 ePrivacy Directive.

Retention period: the language cookie expires after 1 year. The theme preference has no programmed expiry and persists until the user changes it or clears the browser storage.

3.5 Invitations and blocks between users

Data: invitations to shared homes (who invites whom, their status and dates) and block relationships between users.

Purpose: to manage shared access to a home and to let a user block another.

Legal basis: performance of a contract (Art. 6.1.b GDPR) for shared homes, and legitimate interest (Art. 6.1.f GDPR) for block control.

Retention period: resolved invitations (accepted or rejected) are deleted automatically after 6 months; block relationships are kept while the block is active, and the technical rate-control data is deleted after 7 days. Deleting the account cascades and removes all of these relationships.

3.6 Usage analytics and JavaScript errors (Google Analytics 4)

Data: anonymous usage events (page views, clicks, 3D scene views) and JavaScript error events. Analytics does not collect personally identifiable data: IP addresses are anonymised before being sent and nothing is stored in the user's localStorage. Two third-party cookies (_ga, _ga_<container-id>) are set after explicit acceptance.

Purpose: to diagnose technical problems in the application and understand which features are used in order to prioritise improvements.

Legal basis: explicit consent — Art. 6.1.a GDPR. Analytics is NOT activated until the user accepts in the consent banner (GDPR Art. 7 + ePrivacy Art. 5.3). If the user rejects, the Google Analytics SDK is not mounted and no analytics cookie is set. The user can change their mind at any time from the Privacy page of their account; the change takes effect on the next navigation.

International transfer: data is processed on the infrastructure of Google LLC (USA). The transfer is covered by the adequacy decision of the EU–U.S. Data Privacy Framework of 10 July 2023 and, subsidiarily, by the European Commission's Standard Contractual Clauses.

Retention period: aggregated data in Google Analytics is kept for 14 months (GA4 default setting). The local record of the user's decision (user_consent_log) is kept while the account is active and is deleted with it; the log is needed to demonstrate consent under Art. 7.1 GDPR.

How to withdraw consent: from the account Privacy page, "Usage analytics" section, or by re-opening the consent banner. The system also re-prompts automatically 12 months after the last decision, or when this policy materially changes.

3.7 Mobile app crash reports (Firebase Crashlytics)

Data: stack traces generated when the mobile application (Android or iOS) closes unexpectedly or logs a non-fatal error, together with the device model, operating system version, app version and a technical installation identifier generated by the SDK itself, not linked to the user's account. No user, home or bed identifiers, email addresses, browsing data or usage behaviour are sent.

Purpose: to detect and fix technical failures in the mobile application to keep it stable and secure.

Legal basis: legitimate interest — Art. 6.1.f GDPR (maintaining the security and stability of the service). Unlike the analytics in section 3.6, this crash reporting does not depend on analytics consent and is not switched off with the "Usage analytics" setting on the account Privacy page: it is limited to technical diagnostic data needed for the app to work correctly, never to user behaviour data. The user may exercise their right to object (Art. 21 GDPR, see section 5) by contacting us.

International transfer: the same as for the rest of the Firebase services — see section 4.2.

Retention period: crash reports are kept for 90 days in Firebase Crashlytics (Google's default setting) and are then deleted automatically.

4. Recipients of your data

4.1 Other application users

When a user shares a home, other members can see their display name. The user controls who they share their home with through the invitation system.

4.2 Google LLC / Firebase, Google Analytics and Crashlytics (sub-processors)

For authentication we use Firebase Authentication, a service by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Firebase receives and processes the user's email address and password (email/password method only) during registration and sign-in. If the user chooses Google or Apple, Firebase manages that flow with the respective provider.

For usage analytics and error telemetry on the web we use Google Analytics 4, also operated by Google Ireland Ltd. on behalf of Google LLC. GA4 is only activated after the user's explicit consent (see section 3.6) and honours the four Google Consent Mode v2 signals (analytics_storage, ad_storage, ad_user_data, ad_personalization).

In the mobile applications (Android and iOS) we use Firebase Crashlytics for technical crash reports (see section 3.7), also operated by Google. Unlike GA4, Crashlytics is not subject to the consent banner: it relies on the legitimate interest in keeping the app operational and error-free.

International transfer: Google LLC is established in the United States. Transfers are covered by the adequacy decision of the EU–U.S. Data Privacy Framework of 10 July 2023 and, subsidiarily, by the Standard Contractual Clauses approved by the European Commission, in accordance with Art. 46 GDPR. For more information, see the Google Privacy Policy, the Firebase Data Processing Agreement and the documentation on Google Analytics 4 and GDPR.

4.3 Infrastructure provider

The server and database are hosted on infrastructure owned and managed directly by CatDevs, located in Spain. There are no third-party hosting providers in the current processing chain.

5. User rights

Users may exercise the following rights at any time:

• Access (Art. 15 GDPR): obtain confirmation and a copy of your data.
• Rectification (Art. 16 GDPR): correct inaccurate or incomplete data.
• Erasure / Right to be forgotten (Art. 17 GDPR): request deletion of your data. You can also do this directly from the app under Preferences → Delete account.
• Restriction of processing (Art. 18 GDPR): restrict processing under certain circumstances.
• Portability (Art. 20 GDPR): receive your data in a machine-readable format.
• Objection (Art. 21 GDPR): object to processing based on legitimate interest.

To exercise your rights, send an email to catdevsstudio@gmail.com with the subject line "GDPR rights request", stating the right you wish to exercise and attaching a copy of your identity document. We will respond within a maximum of 30 calendar days.

If you believe that the processing does not comply with applicable law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) at: www.aepd.es.

6. Data security

CatDevs applies the following technical and organisational measures:

• Encrypted transmission via HTTPS (TLS) for all communications.
• Authentication via short-lived JWT tokens issued by Firebase.
• Role-based access control in the database (Row Level Security in PostgreSQL).
• Limiting access attempts (IP-based rate limiting on authentication endpoints).
• Passwords are never stored in CatDevs systems; they are managed entirely by Firebase Authentication.

7. Cookies Policy

See the Cookies Policy for detailed information on the cookies and local storage used.

8. Changes to this policy

This policy may be updated to reflect changes in the application or in applicable law. Material changes will be communicated with reasonable notice through the application itself or by email.