Privacy Policy

Last updated: 29 September 2026

Maspax is operated by Bitu Corp S.L. (“we”, “us”, “our”), a company registered in Spain (CIF: B22939128), registered address C. de Hermosilla, 48, 1º Derecha, 28001 Madrid, Spain. We are the data controller for personal data processed through the Maspax app and website (the “Service”).

This Policy explains what personal data we process, why, who we share it with, how long we keep it and the rights you have. If anything is unclear, write to us at support@maspax.com.

In short

We use your data only to run Maspax. No ads, no analytics or crash-reporting tools, no tracking — and we never sell your data.
Your location is read once, only when you miss a Pax that has location sharing turned on. Never continuously.
You can delete your account in the app at any time (Settings → Privacy → Delete account).

1. Information We Collect

a. Information you give us

Account: your email address. You sign in with a one-time code we email to that address or, if you prefer, with Sign in with Apple or Google Sign-In, in which case Apple or Google share basic details of that account with us, such as your email address (with Apple, this can be a private relay address). We do not ask you for an account password.
Profile: your display name and, optionally, a profile photo (avatar). We also store your timezone, so your Paxes fire at the right local time, and your language, so we can send you notifications in it.
Paxes (check-ins): what you set up — titles, questions, schedules, reminders, categories and settings such as a safe phrase — and your answers, including any photos you add.
Your contacts, groups and family: the name and the email address or phone number you enter for each contact (or, once a contact accepts your invitation, the email address of their own Maspax account), any private note you add about them, and the groups or family you create or join.
Master password (optional): if you set one, we store only a one-way cryptographic hash of it, never the password itself.
Support messages: if you write to us, we use your email address and your message to reply.

b. Information collected automatically

Push-notification token: an identifier issued by Apple or Google that lets us deliver notifications to your device.
Subscription status: your plan (Free, Pro or Family) and whether it is active, renewing or expired, which we receive through RevenueCat. We never see your card or payment details — Apple or Google handle payment.
Server logs: like any online service, our hosting provider automatically records technical logs of requests to our servers (such as the time of a request and the IP address it came from). They are kept for a limited period set by the provider and used only to run and secure the Service.

Maspax contains no analytics, advertising or crash-reporting SDKs. We do not track you across other apps or websites, we do not build advertising profiles, and we do not sell your data.

c. Location — only when you miss a Pax

Sharing your location is optional and is switched on per Pax. When a Pax with location sharing turned on is missed, Maspax reads your device’s location once — even if the app is closed — and shares it with the contacts, group or family you chose for that Pax. Maspax never tracks your location continuously and does not read it at any other time.

Because a Pax can be missed while your phone is locked or the app is closed, Maspax asks for permission to use your location even when the app is not open (“Always” on iOS, “Allow all the time” on Android). It uses that permission only for this single reading. You can switch location sharing off for any Pax, and revoke the permission in your device settings at any time.

2. How We Use Your Information

We use personal data only to:

Create and maintain your account, sign you in and keep it secure.
Run your Paxes: fire them on schedule, send reminders and alarms, and save your answers.
When you miss a Pax, alert the contacts, group or family you chose — by push notification, email, SMS or voice call, depending on your settings and plan — with your location if you turned that on. If a Pax uses a safe phrase and a different phrase is entered, the same alert is sent silently.
Let you share Paxes, answers and photos with the contacts, groups and family you choose.
Manage your subscription and the features it unlocks.
Answer your messages and handle reports of objectionable content or abuse.
Keep the Service secure and prevent fraud and abuse.
Comply with our legal obligations.

We do not sell your personal data and we do not use it for advertising.

3. Legal Bases (GDPR)

Contract (Art. 6(1)(b) GDPR) — to provide the Service you signed up for: your account, Paxes, reminders, sharing and subscriptions.
Consent (Art. 6(1)(a)) — for location, push notifications and photos (camera and photo library access). You give it through your device’s permission prompts and the settings of each Pax, and you can withdraw it at any time in your device settings or in the app. Withdrawing consent does not affect processing that took place before.
Legitimate interests (Art. 6(1)(f)) — to alert the contacts you chose when you miss a Pax, and to keep the Service secure and prevent abuse. You can object to this processing (see Section 9).
Legal obligation (Art. 6(1)(c)) — when the law requires us to keep or disclose information.

Contacts who don’t use Maspax. When you add someone as a contact, we process their name and the email address or phone number you give us on the basis of your and our legitimate interest in alerting them if you miss a Pax (Art. 6(1)(f) GDPR). They can object at any time by writing to support@maspax.com. See Section 7.

Health information. Some Paxes — a medication reminder, for example — may reveal information about your health, depending on what you choose to write. We process that information only to provide the feature you set up, on the basis of your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time by editing or deleting that Pax. We never use it for any other purpose.

4. Who We Share It With

People you choose. The contacts, groups and family members you choose see what you decide to share with them: whether you answered or missed a Pax, your answers and photos and — if a Pax with location sharing on is missed — your location. Alerts sent to contacts include your name, the title of the Pax and, where applicable, a map link to your location.

Service providers. We use the following providers to run Maspax. Each receives only the data it needs to provide its service:

Supabase — database, sign-in, file storage (photos and avatars) and server functions. EU (Frankfurt, Germany).
Expo — relays push notifications to Apple and Google. USA.
Apple Push Notification service and Google Firebase Cloud Messaging — deliver notifications to devices.
RevenueCat — subscription management. USA.
Twilio — SMS and voice alerts. USA.
Resend — alert emails. EU region.
Mailgun — sign-in code emails. EU region.
Apple Maps and Google Maps — maps in the app and map links in alerts.
Sign in with Apple and Google Sign-In — optional sign-in.

App stores. Subscriptions are bought and paid for through the Apple App Store or Google Play, which process your payment under their own privacy policies. We never receive your payment card details.

Our website. The maspax.com website is hosted by Vercel (USA), which processes visitors’ IP addresses and standard request data to deliver the pages. The website loads its typeface from Google Fonts, so your browser also sends your IP address to Google. The website sets no cookies and runs no analytics.

Legal and safety. We may disclose information when the law requires it, in response to a valid request from a court or authority, or to protect the rights, safety and security of our users and others.

Business transfers. If Bitu Corp S.L. is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction and will remain protected by this Policy.

We never sell your personal data.

5. International Transfers

Our main infrastructure (Supabase) is in the European Union, in Frankfurt, and our email providers (Resend and Mailgun) use their EU regions. Expo, RevenueCat, Twilio and our website host Vercel are based in the USA, and Apple and Google may process data outside the European Economic Area to deliver notifications, maps, sign-in and web fonts. Transfers to the USA rely on the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

6. How Long We Keep Your Data

Account data, Paxes, answers and photos: for as long as you have an account. You can delete a Pax (with its questions and history) or a contact in the app at any time.
Location read at miss time: kept with that Pax’s history until you delete the Pax or your account.
Account deletion: when you delete your account (Settings → Privacy → Delete account), it is locked immediately. After a 30-day grace period, we permanently erase your account, answers, photos, avatar and subscription profile. Signing back in during those 30 days cancels the deletion.
Server logs: kept for a limited period set by our hosting provider, then deleted automatically.
Billing records: any billing records the law requires are held by Apple or Google, not by us.

More details: Delete your account.

7. If Someone Added You as a Contact

A Maspax user can add you as a contact so that you are alerted if they miss a Pax. In that case, we received your name and your email address or phone number from that user. We use them only to send you those alerts — by email, SMS or voice call — which include the user’s name, the title of the Pax and, if they turned it on, a map link to their location. If you accept their invitation in the app, the email address of your own Maspax account is used instead. We keep your details until the user removes you as a contact or deletes their account.

We process your details on the basis of the user’s and our legitimate interest in alerting you (Art. 6(1)(f) GDPR). You can object at any time, or exercise any of the rights in Section 9, by writing to support@maspax.com.

8. Security

We use industry-standard measures, including encryption in transit (HTTPS/TLS), encrypted storage provided by our infrastructure, one-way hashing of any master password, and strict access controls so that each user can reach only their own data and what others have shared with them. No system is perfectly secure, but we work hard to protect your data, and we will notify you and the relevant authorities of a personal data breach where the law requires it.

9. Your Rights

You have the right to:

Access the personal data we hold about you.
Rectify inaccurate data — you can edit most of it directly in the app.
Erase your data — you can delete your account in the app (Settings → Privacy → Delete account) or ask us to.
Restrict how we process your data.
Portability — receive your data in a structured, commonly used, machine-readable format. You can request a machine-readable copy free of charge at support@maspax.com; the app also includes an export feature (Settings → Privacy).
Object to processing based on legitimate interests.
Withdraw consent at any time for processing based on consent, without affecting processing that took place before.
Lodge a complaint with a supervisory authority — in Spain, the Agencia Española de Protección de Datos (AEPD, www.aepd.es).

Exercising your rights is free of charge. Write to support@maspax.com, ideally from the email address linked to your account so we can verify it’s you. We will reply within one month, as the GDPR requires; for complex requests this can be extended by two further months, in which case we will let you know.

10. Minimum Age

Maspax is not intended for anyone under 16. You must be at least 16 to create an account or to join a group or Family plan. We do not knowingly collect personal data from children under 16; if you believe a child under 16 has given us personal data, contact support@maspax.com and we will delete it.

11. Permissions

Maspax asks for your permission before it sends push notifications (for Paxes, reminders, invitations and alerts), uses your location (only for the miss-time reading described in Section 1c) or accesses your camera and photo library (for photo answers and your avatar). You can change these permissions at any time in your device settings; some features won’t work without them.

12. Changes to This Policy

We may update this Policy from time to time. If we make significant changes, we will tell you in the app or by email before they take effect. The date at the top shows when it was last updated.

13. Contact

Bitu Corp S.L. (CIF: B22939128)
C. de Hermosilla, 48, 1º Derecha, 28001 Madrid, Spain
Email: support@maspax.com