FactosPrivacy
1. Purpose, scope and data controller
This policy covers the Factos app and myfactos.com. Factos is the service brand; the controller is DevReef S.A.S., a commercial company duly incorporated in the Republic of Colombia, at CALLE 7 SUR 42 145, Medellín, Colombia, telephone +57 312 786 1813. Privacy and requests: hola@myfactos.com. Support: soporte@myfactos.com. The service is for adults aged 18 or over.
2. Legal framework and principles
This policy implements the habeas data right recognized by Article 15 of Colombia’s Constitution and is interpreted under Law 1581 of 2012, Decree 1074 of 2015 and other applicable provisions. Processing includes collection, storage, use, disclosure and deletion according to the features you use. It follows legality, informed purpose, freedom, information quality, transparency, restricted access, security and confidentiality. These principles also apply to providers processing data on the service’s behalf within their roles and obligations. Reference to Colombian rules does not exclude mandatory privacy or consumer-protection provisions of other territories where applicable.
3. Local content and optional backup
Thoughts, letters, drawings, images, favorites and emotional answers stay on your device and are excluded from Factos backup. Habits, goals and progress are also local by default. Only with Premium and explicit selection of categories are they backed up in Firebase under your account. Habit and goal names or descriptions may contain sensitive information; avoid unnecessary details. Backup is encrypted in transit and at rest, but is not end-to-end encrypted. Signing in does not enable backup. Operating-system backups depend on your device settings.
4. Account, purchases and providers
Firebase Authentication processes your account identifier, sign-in provider and available email; Google or Apple may provide a name, photo or Apple private email. RevenueCat receives the Firebase identifier and purchase/subscription data to verify Premium. Apple and Google process payments under their own terms; Factos does not receive your full card number. Firestore serves public programs by requested language and accompaniment and receives technical connection data. Downloaded programs may be cached.
5. App analytics and recording
The app uses Google Analytics for Firebase and Crashlytics for usage events and diagnostics, including installation identifiers, version, device and technical data. We do not deliberately add thoughts, names, emails, moods or accompaniment categories to custom events. The app currently has no separate toggle for these metrics. Clarity is enabled by default for onboarding and Home; a notice appears on the third launch and you can disable it in Settings → Navigation analysis. This does not disable Firebase. Strict masking applies and thought, reflection, answer, mood and account screens are excluded. Onboarding tap positions may reveal a selected option. An indicator shows active recording. Account identifiers and personal texts are not added to Clarity.
6. Website cookies and measurement
The site remembers language and cookie preferences in local storage. Analytics is optional and initially off; Tag Manager and Microsoft Clarity load only after acceptance. Google Analytics, when configured, helps us understand visits and website use. Clarity provides click maps and navigation recordings to identify difficulties; privacy and terms pages are excluded and the cookie panel is masked. This version does not enable advertising cookies or ad personalization. Providers may receive IP, URL, identifiers, browser/device data, timing and approximate location. Do not enter personal data into demonstrations. Accept or reject Analytics and change the choice through Cookie preferences in the footer. The choice lasts 180 days; blocked storage limits it to the current page. Withdrawal reloads the page and prevents future loading of these tools; it does not delete sent data or all external cookies. Hosting and distribution receive technical data needed to serve and protect the site.
7. Permissions, support and purposes
Camera and photo permissions are requested when you use those features; you may deny them in the operating system. Sharing sends selected content to your chosen recipient and provider. App contact prepares an email; we receive it only if you send it. We use the address, message and attachments to reply. Data supports requested features, accounts, Premium, requests and service security. Optional website tools depend on your choice; processing requiring authorization is subject to applicable authorization. Accepting terms does not replace specific consent. We do not sell data or send your reflections to AI services. We do not build advertising audiences from grief or emotional circumstances.
8. Retention
Our adopted policy for Analytics user-level and event data is 14 months; standard aggregated reports are not subject to that same period. Support emails are kept for 12 months after a request closes, except for legal duties or documented claim-handling needs. Clarity normally keeps playback for 30 days; samples, favorite or labeled sessions and heatmaps may be retained for up to 9 months under its policy. Crashlytics retains diagnostics and identifiers for 90 days before beginning removal from live and backup systems. Local content remains until deleted; accounts and selected backups remain while you keep those services or until deletion is requested, subject to legal exceptions and provider technical cycles. Purchase and infrastructure records follow applicable provider obligations and terms.
9. Deletion and security
Delete local content or your account in Settings; reauthentication may be required. You can stop, recover or delete backup; recovery and deletion remain available after Premium expires. Stopping backup does not delete its remote copy. Deletion may preserve minimal technical markers to prevent an older device uploading it again. Account deletion blocks new uploads and removes backup before identity; failures allow a retry while keeping local data. Deletion does not cancel subscriptions, remove shared copies or automatically erase previously sent metrics. You may also request deletion at hola@myfactos.com without purchasing Premium. We use secure connections and system isolation; the local thought database and preferences have no additional Factos encryption layer. No system is invulnerable and backup cycles prevent guaranteed immediate erasure.
10. Rights and international processing
You may request access, updates, correction, usage information, proof of authorization where applicable, withdrawal and deletion, and exercise mandatory rights in your place of residence. Write to hola@myfactos.com with minimal identifying information; proportionate identity verification may be needed, never your password. Use the app for local-only data because we hold no remote copy to return. In Colombia, queries are answered within 10 business days and claims within 15 business days, subject to notified statutory extensions. After the applicable prior procedure you may contact the SIC. Google/Firebase, Microsoft, RevenueCat, stores and infrastructure providers may process data abroad under their terms and safeguards; we do not promise storage in a single country.
11. Sensitive data and authorization
You need not answer questions about sensitive data or provide health, intimate-life or personal-circumstance information to use features that do not need it. Text you choose to write may contain such information; local storage does not authorize sending it to third parties. Sensitive-data processing requiring authorization must have explicit, prior and informed authorization, subject to statutory exceptions. Backup activation or analytics acceptance covers only the disclosed purposes and categories, not blanket permission for advertising, data sales or other uses. Request information or withdraw authorization through the stated channels where legally applicable.
12. Queries and complaints procedure
Factos handles privacy requests at hola@myfactos.com. The data subject, an accredited representative or another legally authorized person may provide the subject’s identity, a reply address, relevant facts and the right to exercise, with relevant documents but no passwords or unnecessary sensitive data. Access to personal data is free. Queries are answered within 10 business days of receipt; notified extensions state the reason and new date, up to 5 additional business days. Complaints are answered within 15 business days starting the day after receipt, with a notified extension of up to 8 additional business days. For incomplete complaints, missing information is requested within 5 days of receipt; no response within 2 months of that request means withdrawal. A recipient without competence forwards the complaint within 2 business days and informs the requester. A complete complaint is marked as pending in the relevant record within 2 business days. Deletion or withdrawal does not remove statutory retention duties. After the applicable procedure with the controller, you may contact the SIC.
13. Changes
This policy takes effect on the stated date. Changes will carry a date and version; important changes will be communicated through the app or website, with renewed consent where required. Contact hola@myfactos.com about privacy.