TraceEmotion Privacy Policy

1. Who is responsible

TraceEmotion is an app by MORDOBO TECHNOLOGIES LLC ("Mordobo", "we").

• Legal form: a limited liability company (LLC) organized in Florida, United States.
• Address: 2 S Biscayne Blvd, Ste 3200 #7229, Miami, FL 33131, United States.
• Contact: support@mordobo.com. For a privacy request, use the subject "Privacy".

Mordobo designs and publishes the app and is the controller of the processing that happens on your phone, even though we do not receive that data: in this version the app does not send it to us, so we do not see it or store it. What does leave the phone is described in section 2.5.

2. What data the app uses and where it is stored

What you write is stored in the app's private storage on the phone. The app is set up so that this information is included in the system backup: on Android, Google's backup, if you have it on; on iPhone, iCloud or the computer backup, if you have it on. You can turn that off in the system settings. We have no access to that copy.

2.1 Profile and settings

2.2 Mood, journal and practices

The mood log and the journal can describe how you feel. We treat them as intimate information. They stay on the phone and we do not use them for advertising or to build a commercial profile.

2.3 What the app does not do

• It does not ask for an account or a sign-in.
• It does not include analytics, advertising or a crash-reporting SDK.
• It does not ask for location, camera, microphone, contacts or photos. The microphone permission is blocked: the app plays sound, it does not record.
• It does not ask permission to track you across other companies' apps and websites.
• It does not sell data. This version has no purchases.

On Android, the permission list can include internet, seeing the network state, notifications, vibration, keeping the phone awake while audio plays, a foreground service for audio playback, and rescheduling reminders after a restart. Notifications are used only if you turn a reminder on, and from Android 13 the system asks you at that moment. The foreground service lets a practice or a mix keep playing with the screen locked, and shows the playback control. On iPhone, the app can ask for notifications when you turn a reminder on, and it declares the background-audio mode for the same reason: so the sound continues with the screen locked.

Reminders. If you turn on the practice reminder, the phone schedules a local alert on the days you chose, at 8:00, 14:00 or 21:30. If you turn on the mood check-in, it schedules another at 20:00. They are notifications on the phone itself: there is no push-notification identifier and nothing is sent to a server to display them. You can turn them off in the app or in the system settings.

2.4 Export and delete

Settings › Your data › "Export backup" prepares a JSON file of what is saved and opens the phone's share sheet. The file is yours: the app does not upload it. Settings › Your data › "Delete all" asks you to confirm and, if you confirm, deletes moods, the journal, sessions, saved practices, a session left halfway and the saved mix. Your name, theme, language and other settings stay. It cannot be undone inside the app.

2.5 What does leave the phone

• Public catalogue. When it opens, the app requests the practices, collections, sounds and the app's public configuration from a Supabase project in Frankfurt, Germany (European Union). The request is encrypted (HTTPS) and does not include your name, your mood, your journal or your sessions. Supabase can see the IP address of the connection, as any server can. With no network, the app uses the catalogue bundled inside it. Supabase's policy is at supabase.com/privacy.
• Update checks. The app asks Expo's update service whether an update is available. That request includes an identifier for this installation, the platform, the channel and the version. It is not the phone's advertising identifier and it is not tied to your name. Expo's policy is at expo.dev/privacy.
• If you write to us at support@mordobo.com: your email address, what you tell us and what you attach. We use it to reply. The mailbox is on Google (Google Workspace). Do not send us the contents of your journal: we do not need them to help you.
• If you post a review on Google Play or the App Store, we see the review and the public name on that account, as anyone can, and we can reply there.
• Store reports. Google Play and App Store Connect can show us aggregated install statistics and, for people who have agreed to share diagnostic data with the store, technical crash reports (model, system version and where it failed). Those reports do not include your name. We do not add a crash SDK of our own.
• If you visit this website: it does not use cookies or analytics. It is hosted on GitHub Pages (GitHub, Inc.), which may log the IP address of a visit for security, under its own privacy statement. We do not receive those logs.

3. What it is used for

• To show you the app, your practices, your mood and your journal, on the phone.
• To schedule the local reminders you turn on.
• To let you export or delete what you saved.
• To download the public catalogue and check whether an app update is available.
• To reply if you write to us, and to fix failures using the stores' reports.

We do not build profiles for advertising and we do not make automated decisions that have legal effects on you. What the app suggests you practise is calculated on the phone from what you logged, and you can choose not to do it.

4. Legal basis

In the European Economic Area, the United Kingdom and Switzerland:

• What you save on the phone (name, settings, mood, journal and practices) is necessary to provide the feature you use (GDPR art. 6.1.b). To the extent a mood or a journal entry reveals information about your health, that processing happens only on your phone, to show you your own record, and it is not transmitted to us.
• Catalogue and update checks: necessary for the app to work and stay current (GDPR art. 6.1.b).
• Email: if you exercise a data-protection right, our obligation to handle it (art. 6.1.c); otherwise, our legitimate interest in replying (art. 6.1.f).
• The stores' crash reports and this website's logs: legitimate interest in the app and the website working (art. 6.1.f).

In Mexico, the on-device processing is what is necessary to provide the service you ask for. In Colombia, your authorization by using the app (Law 1581 of 2012). In the Dominican Republic, what is necessary to provide the service (Law 172-13). In other countries, the basis your law provides.

5. Who it is shared with

We do not sell your data and we do not give it to advertising networks. These parties are involved:

• Google and Apple, which distribute the app on Google Play and the App Store, each under its own policy. They make the backup, in your account, if you have it turned on. We have no access.
• Supabase, which receives the public-catalogue request in Frankfurt. It does not receive your mood, your journal or your name.
• Expo, which receives the installation identifier and the technical data in section 2.5 in order to deliver updates.
• Google (Google Workspace), which stores, on our behalf, the email you send us.
• GitHub, Inc., which serves this website.
• Whoever you choose when you export a copy: from the share sheet, that copy is under your control and under the policy of whoever receives it.

6. International transfers

The catalogue request goes to Germany (European Union). The update check goes to Expo, which may process it in the United States. If you write to us, the email reaches us in the United States and may be stored on Google's servers in the United States or other countries. GitHub serves this website from the United States and other countries. For data that arrives from the European Economic Area, the United Kingdom and Switzerland, those providers state transfer mechanisms such as the Data Privacy Framework or standard contractual clauses, as described in their own policies. A Google or Apple backup may be stored in other countries, under their policy and your account.

7. How long it is kept

• On the phone: until you use "Delete all", clear the app's storage in Android settings, or uninstall it (on iPhone, "Delete App"). "Offload App" on iPhone removes the app and can keep the data: to delete the data you have to delete the app.
• Backups: Google's or Apple's own retention, not the button in the app. Deleting in the app does not instantly delete a backup that already exists. You can manage it in your Google account settings or, on iPhone, in Settings › your name › iCloud.
• Installation identifier: for as long as that installation exists. Clearing storage or reinstalling creates another one. We cannot tie it to a person.
• Email: as long as needed to handle your message and, after that, up to 3 years, so we can show how we handled the request.
• Cached catalogue: public content, not your data. It is replaced when a new one arrives.

8. Your rights

Because we do not receive your mood or your journal, we cannot see or change them for you. You exercise those rights on the phone:

• Access and portability: Settings › Your data › "Export backup".
• Correction: your name, theme, language and reminders are changed in Settings. A single journal entry cannot be edited in this version: you can delete everything, or write to us and we will tell you what the options are.
• Deletion: Settings › Your data › "Delete all". There is no account to delete.
• Reminders: turn them off in Settings or in the phone's notification settings.
• Objection and restriction: you can choose not to log a mood, turn reminders off, delete the data or stop using the app.

For email you send us, you can exercise your rights by writing to us. We reply within the time your law sets: at most one month in the European Economic Area, unless extended. Exercising them is free.

In Spain and the rest of the European Economic Area you can complain to the Agencia Española de Protección de Datos (www.aepd.es) or to the authority in your country. In Mexico, ARCO rights can also be taken to the competent authority if we do not answer in time. In Colombia, to the Superintendence of Industry and Commerce, after you have asked us. In the Dominican Republic, you can go to the courts through habeas data if we do not answer in time.

9. Children

TraceEmotion is intended for people aged 18 or older. It is not directed at children and we do not knowingly ask them for data. The app does not check age. If you are a parent or guardian and you believe a child is using it, delete the data with "Delete all" or delete the app, and remember the backup (section 7). You can also write to us.

10. Security

• The data is in the app's private storage. In ordinary conditions, the system stops other apps from reading it.
• The app does not add encryption of its own. The phone protects it with the screen lock and the system's encryption. Anyone who can use the unlocked phone can open the app.
• What travels over the network (the catalogue and the update check) uses HTTPS.
• The file you export contains your journal. Keep it and share it carefully.

11. How to exercise your rights

• In the app: export or delete, in Settings › Your data.
• By email: support@mordobo.com, with the subject "Privacy". Include your name, the country you are writing from, what you are asking for and an address for the reply. Do not send us the journal.

This page is the privacy policy. In the app it opens from Settings › About › "Privacy policy", in the app's language.

12. Changes

If the processing changes, we will update the version and the date on this page, and we will say so in the store release notes of the version that includes the change, before it applies. This version has no purchases. If a paid plan is offered later, Google Play or the App Store will bill it, and we will update this policy before turning it on.

13. Notice

TraceEmotion is not a medical device. Meditation, breathing, yoga, sounds and the journal do not diagnose, treat, cure or prevent any condition, and they do not replace care from a professional. If you have a health concern, talk to a professional.

14. Licenses

The interface icons are Phosphor, under the MIT license. The typeface is Inter, under the SIL Open Font License 1.1. Those licenses cover the interface design; they do not change what this policy says about your data.