Contents
1. Controller
The controller of your personal data is Ruslan Abdrakhmanov, a self-employed individual (autónomo) registered in Spain, with address at Carrer de Reig i Bonet 5, 08024 Barcelona, Spain ("Madrega", "we", "us"). Tax Identification Number (NIF): provided upon request for legitimate legal or contractual purposes. Contact for all data protection matters: privacy@madrega.app. Madrega has not appointed a data protection officer, as it is not required to do so under Article 37 of Regulation (EU) 2016/679 ("GDPR"). This Privacy Policy applies to the Madrega mobile application and the website madrega.app (together, the "Service"). This Privacy Policy covers both the app and the website. Where a rule applies only to one of them, the section says “in the app” or “on the website”.
2. Nature of the Service
Madrega is a free Service that supports users in the gradual observance of Jewish religious practice. We do not sell personal data, do not display advertising and do not use personal data for marketing or profiling for commercial purposes.
3. Personal data we process
In the app we process: (a) account data: email address, first name, and password stored only as a cryptographic hash (an optional profile photo stays only on your device and never reaches us); (b) practice data: the steps of practice you have started or mastered, your daily marks, your answers to the onboarding questionnaire, your selected pace and mentor; (c) location data limited to the city and time zone you enter or confirm, and the coordinates of the city centre, never your own position; (d) content you create: wishes addressed to other users, messages exchanged with the AI mentor and the support chat, and feedback; (e) technical data: push notification token, device model, operating system and application version, crash reports that do not contain the content of your entries, the dates on which you open the app, and the number of content files (prayer texts and recordings) your account downloads each day; (f) usage events, only where you have consented under section 9. On the website we process: (g) the technical data every visit sends, such as the IP address, browser and device type and the page requested; (h) website usage statistics, only where you have accepted analytics cookies under section 10; (i) what you write in a website form, such as a support request, together with your email address.
4. Data processed only on your device
Precise geolocation, sleep data read from Apple Health or Health Connect, calendar data and alarm settings are processed exclusively on your device to calculate times and reminders. These data are not transmitted to us or to any third party and are not stored on our servers.
5. Special categories of personal data
Practice data may reveal your religious beliefs and therefore constitute a special category of personal data under Article 9(1) GDPR. Storing and processing practice data is the purpose of the account and of the Service. We process such data on the basis of your explicit consent under Article 9(2)(a) GDPR, which you give, informed by this section, when you create your account by ticking the box by which you accept the Terms of Use and this Privacy Policy. You may withdraw your consent at any time by deleting your account. Withdrawal does not affect the lawfulness of processing carried out before it.
6. Purposes and legal bases
We process personal data for the following purposes and on the following legal bases. In the app: (a) creating and managing your account, authentication, synchronisation of your progress across devices and provision of the Service features: performance of the contract formed by the Terms of Use (Article 6(1)(b) GDPR) and, for practice data, your explicit consent (Article 9(2)(a) GDPR); (b) answers of the AI mentor and the support assistant: performance of the contract (Article 6(1)(b) GDPR) and your explicit consent for practice data (Article 9(2)(a) GDPR); (c) moderation and publication of wishes: performance of the contract (Article 6(1)(b) GDPR); (d) responding to support requests and feedback: performance of the contract (Article 6(1)(b) GDPR); (e) crash reporting, security of the Service and prevention of abuse, including a daily limit on content downloads, and the calculation of daily usage totals that do not identify any user, such as the number of active users and how many users return after 1, 7 and 30 days: our legitimate interest in operating a secure and functioning Service (Article 6(1)(f) GDPR); (f) usage analytics: your consent (Article 6(1)(a) GDPR and Article 22(2) of Spanish Law 34/2002, LSSI-CE); (g) push notifications: your consent given through the operating system settings of your device (Article 6(1)(a) GDPR). On the website: (h) delivering the pages, counting visits in aggregate without cookies and protecting the website and its forms against attacks and automated abuse: our legitimate interest in a secure website and in knowing, in aggregate, how it is used (Article 6(1)(f) GDPR); (i) website analytics: your consent to analytics cookies (Article 6(1)(a) GDPR and Article 22(2) LSSI-CE); (j) answering what you send through a website form: steps taken at your request and our legitimate interest in replying (Article 6(1)(b) and (f) GDPR). In both: (k) compliance with legal obligations and the establishment, exercise or defence of legal claims (Article 6(1)(c) and (f) GDPR).
7. Publication of wishes
Wishes you address to other users are visible to other users of the Service after moderation. They are published without your surname or contact details. Your first name is displayed only if you choose to sign the wish. Each wish is first screened by an automated filter and the decision on publication is taken by a person.
8. Artificial intelligence
The AI mentor and the support assistant generate answers using the Claude model provided by Anthropic. For this purpose we transmit the text of your question, your earlier messages in the same conversation from the last 30 days, so that the mentor can take them into account, the step you are currently on and your interface language. Your name and email address are not transmitted. Under Anthropic's commercial terms, these data are not used to train its models and may be retained by Anthropic only for a limited period for the purposes of security and abuse prevention. No decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you is taken within the meaning of Article 22 GDPR.
9. Analytics in the app
Analytics in the app are disabled by default. Only if you give your consent, at sign-up or at any later time in Settings under Account, do we collect pseudonymous usage events through Google Analytics for Firebase, provided by Google Ireland Limited: screens opened and features used. The text of your messages, wishes and chats is never collected, and screen recording is not used. Advertising features, Google signals and data sharing with Google for its own purposes are disabled, and the retention of analytics data is set to 2 months. You may withdraw your consent at any time with the same switch, without detriment. Crash reports are sent through Firebase Crashlytics without the content of your entries, on the basis described in section 6(e).
10. The website madrega.app and cookies
The website is hosted by Cloudflare, Inc., which processes the IP address and the technical data of every visit to deliver the pages and to protect the website against attacks. Cloudflare may set strictly necessary security cookies, such as __cf_bm, which lasts up to 30 minutes. Website forms are protected by Cloudflare Turnstile, which checks that a person and not an automated script is sending the form. Visits are counted with Cloudflare Web Analytics, which sets no cookies, stores nothing on your device and does not identify visitors: it records the page, the referring website, the country and the browser and device type in aggregate form. Google Analytics 4, provided by Google Ireland Limited, is loaded only after you accept analytics cookies in the banner shown on your first visit. It sets the cookies _ga and _ga_
11. Recipients and processors
We disclose personal data only to service providers acting as processors under data processing agreements in accordance with Article 28 GDPR, and only to the extent necessary for their tasks. For the app: Supabase, Inc. (database, authentication and file storage, data stored in the European Union); Anthropic, PBC (generation of AI answers, United States); Resend, Inc. (transactional email, United States); Google Ireland Limited and Google LLC (Firebase: push notifications to Android devices, crash reports through Firebase Crashlytics and, only with your consent, Google Analytics for Firebase); Apple Inc. (Apple Push Notification service for iPhone); OpenMeteo GmbH (city search, Switzerland), which receives through our server only the city name you type, without your IP address or any other data. For the website: Cloudflare, Inc. (hosting, security, Turnstile and visit statistics without cookies, United States), CookieYes Limited (cookie banner and record of your cookie choice, United Kingdom) and, only with your consent, Google Ireland Limited and Google LLC (Google Analytics 4). We may also disclose personal data to public authorities where required by law.
12. International transfers
Our primary data are stored in the European Union. Some of the providers listed in section 11 are established in the United States or may access data from there. Such transfers are carried out on the basis of the European Commission adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, for certified recipients, or on the basis of the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (Article 46(2)(c) GDPR). OpenMeteo GmbH is established in Switzerland, for which the European Commission has adopted an adequacy decision. CookieYes Limited is established in the United Kingdom, for which the European Commission has also adopted an adequacy decision. You may obtain a copy of the applicable safeguards by writing to privacy@madrega.app.
13. Retention periods
We keep personal data only for as long as necessary for the purposes described: account, practice and progress data, for as long as your account exists; conversations with the AI mentor, 30 days in pseudonymised form; support conversations, feedback and website form messages, 2 years from the last message; published wishes, until you delete them or your account; crash reports, 90 days; the date on which you last opened the app, for as long as your account exists, and the dates of earlier days, 31 days; the daily count of content downloads, 30 days; analytics data in the app, 2 months; analytics data on the website, 2 months for event data and 14 months from the last visit for data linked to the browser identifier; technical data of website visits, only for as long as Cloudflare needs it to deliver and secure the website. When you delete your account, your data are erased from the active systems immediately and from backups within 30 days, except where retention is required by law, in which case the data are blocked under Article 32 of Spanish Organic Law 3/2018 (LOPDGDD) for the legally required period.
14. Your rights
Under Articles 15 to 22 GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You may delete your account in Settings or at madrega.app. To exercise any other right, write to privacy@madrega.app. We will respond within one month of receipt, which may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you within the first month. We may request additional information to confirm your identity.
15. Right to lodge a complaint
If you consider that the processing of your personal data infringes the applicable law, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of your Member State of habitual residence, place of work or place of the alleged infringement.
16. Statutory or contractual requirement
Providing your email address and a password and accepting the Terms of Use and this Privacy Policy, which includes your explicit consent to the processing of practice data, is a contractual requirement for creating an account. Without them we cannot provide the Service. Providing any other data, including your city or consent to analytics, is optional and refusal does not prevent you from using the Service.
17. Minimum age
The Service is intended for persons aged 16 or over. We do not knowingly process personal data of persons under 16. If we become aware that an account belongs to a person under 16, we will delete it.
18. Deceased persons
In accordance with Article 3 of the LOPDGDD, persons linked to a deceased user by family or de facto relationship, and the deceased's heirs, may request access to, rectification or erasure of the deceased's personal data by writing to privacy@madrega.app, unless the deceased expressly prohibited it.
19. Security
We apply appropriate technical and organisational measures under Article 32 GDPR, including encryption of data in transit and at rest, storage of passwords only as hashes, restriction of access to personal data to authorised persons and logging of such access.
20. Changes and language
We may amend this Privacy Policy. We will inform you of material changes in the application before they take effect. This Privacy Policy is drafted in English. Translations are provided for convenience. In the event of any discrepancy between the English version and a translation, the English version shall prevail.
Last updated: 26 October 2026
↑ Back to top