Psoma Privacy Policy

Last updated: 20 September 2026

This is a translation of the Spanish version. If the two differ, the Spanish version prevails.

Psoma is a garden for tending to how you are. What you keep here speaks about your emotional state, so we treat it as what it is: sensitive information. This page explains, plainly, what data we store, what for, who can see it and how you can take it with you or delete it.

Who is the controller

Eric Moscoso León, a natural person, Barcelona (Spain). Contact for any privacy matter: hola@psoma.io

What data we process

Account data

• Your email address and your password. The password is handled by Firebase Authentication; we never see it or store it in plain text.
• Basic preferences: language, whether you have seen the introduction, and the dates of account creation and last access.

Your garden (data about how you are)

• Each planting: the emotion you choose, its intensity, the date, the visibility you give it and, if you write one, a note.
• The name you give your garden.

Your circle

• Your invitation code.
• The bonds you create or accept with other people, and the garden name under which you appear in them.
• The plants you decide to share with your circle: emotion, intensity, type, state and date. The note is never shared: it does not leave your garden, and our servers reject any attempt to include it.
• The presences (“accompany”) you leave on other people’s plants or that other people leave on yours. A presence contains no text.

On your device

• We store your language and a minimal copy of your most recent state locally so the app works offline.

What we don’t do

• We don’t use analytics, advertising or third-party trackers.
• We don’t access your location, contacts, camera, microphone or files.
• We don’t sell or hand over your data to anyone.
• We don’t build profiles or make automated decisions about you.

What we use it for and on what legal basis

You can withdraw your consent whenever you want: by ceasing to share a plant, revoking a bond or deleting your account. Withdrawing it does not affect the lawfulness of processing up to that moment.

Who can see what

• Your garden is private by default. Only you can read it. This is not just an interface rule: it is enforced by the database security rules.
• Your circle sees only the plants you share, and only while the bond is accepted. If you or the other person revoke the bond, access is cut off at once.
• Nobody can search for you. There is no directory of people. Knowing your invitation code allows someone to propose a bond, never to see anything of yours.
• Us. Psoma is designed to work without its controller reading individual gardens: there is no admin panel that displays them. As the infrastructure administrator, the technical possibility of accessing the database exists; the commitment is not to do so except under legal obligation or for an unavoidable technical incident, and never to look up personal states.

Processors and transfers

Psoma relies on Firebase, by Google Ireland Limited, as its infrastructure provider (data processor):

• Cloud Firestore: stores your garden and your bonds on servers located in the European Union (eur3 multi-region).
• Firebase Authentication: handles your email and password. This service may process data in Google data centres outside the European Economic Area, including the United States, under the EU–U.S. Data Privacy Framework and the European Commission’s standard contractual clauses.
• Google Fonts: the app downloads its typefaces from Google servers the first time it needs them. In that download Google receives your IP address, as in any web connection; it receives no data from your account or your garden.

How long we keep it

For as long as you have the account. When you delete it, your account data, your plantings and notes, your invitation code, the plants you were sharing and your name in bonds are removed immediately.

Because they also belong to the other person, two remnants stay with no content and no data that identifies you: the record that a bond existed (closed) and the presences you left on other people’s plants. Both contain only a random internal identifier which, once the account is deleted, is no longer associated with your email or any other data of yours.

The provider’s technical backups may take up to 180 days to be fully purged.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent, by writing to hola@psoma.io from your account’s email address. We reply within one month at most.

• Erasure: you can do it yourself in the app (Settings → Delete account) or from psoma.io/borrar-cuenta.
• Access and portability: we will send you a copy of your data in a structured, commonly used format.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Minors

Psoma is intended for people aged 18 or over. We do not knowingly collect data from minors. If you believe a minor has created an account, write to us and we will delete it.

Security

Communications are encrypted (TLS) and data is encrypted at rest on the provider’s servers. Access to each piece of data is restricted by server-side security rules, which are tested automatically before each deployment. No system is infallible: if a breach affecting your data were to occur, we will notify you and report it to the supervisory authority as required by law.

Psoma is not a health service

Psoma does not offer diagnosis, treatment or emergency care, and is no substitute for professional help. If you are in danger or thinking of harming yourself, call your local emergency number (112 in the EU). In Spain, 024 is the free, 24-hour suicide prevention line.

Changes to this policy

If we change anything relevant we will notify you by email or within the app before the change takes effect. The date above indicates the latest version.