App privacy
This policy covers the Metamorphosis web app at metamorfosa.app. In short: everything you enter stays in your browser. There is no server holding your data, no account and no tracking; app starts are only counted anonymously (see “Visit counter”).
Controller
irespect LTD, Anthipolochagou Georgiou M. Savva 26, Shop 1-2, 8201 Paphos, Cyprus. Represented by its director Rudolf Nordheimer. E-mail: info@metamorfosa.app
Where the data lives
Habits, ticks, notes on days, pauses, the archive and settings (language, theme) are kept in your browser’s local storage on this device. The app sends them neither to us nor to anyone else. There is no tracking, no advertising and no cookies. The exceptions: short error reports without your entries (see “Error reports”) and an anonymous count at start-up (see “Visit counter”). When opened from the Home Screen, the app asks the browser once not to clear its storage on its own. Nothing leaves the device in the process. Legal basis: Art. 6(1)(b) GDPR; storing on the device under § 25(2) no. 2 TDDDG, as it is strictly necessary for the function you use.
Wellbeing (optional)
In Settings you can turn on wellbeing: Today and the day sheet then save one of five words — from “very rough” to “great” — with the date and, if you choose, up to three tags for what affects the day (such as “sleep” or “weather”), and the day sheet also saves hours of sleep the night before (from “5 or less” to “9 or more”). “A few words about the day” then also saves, if you choose, the mood — one or two of ten words (such as “joy” or “anxious”) — with the date. This is health data (Art. 9 GDPR), so the feature stays off until you turn it on yourself on the “what is saved and where” screen. The legal basis is your explicit consent, Art. 9(2)(a) GDPR. The entries are kept only in the browser storage on this device. They go neither to a server nor into error reports. They are included in the export only while wellbeing is on. To withdraw consent, use the same place: “Turn off and delete wellbeing entries”. The entries are deleted at once; habits and check-ins stay.
Error reports
If a technical error occurs, the app may send a short report: error type and text, the technical call stack, app version, language and platform. Email addresses and long numbers are removed from the text before sending. Your entries, habit names, storage contents and device or account identifiers are not included; at most five reports per session, none when offline. Recipient: GlitchTip (processor: Burke Software), stored in Frankfurt am Main, Germany (DigitalOcean FRA1); sub-processor: Cloudflare (CDN). GlitchTip and Cloudflare see your IP address when connecting; it is stored only in shortened form, so it identifies neither a person nor a device. Reports are kept for at most 90 days and deleted monthly. Purpose: finding and fixing errors. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable app). Objection under Art. 21 GDPR: info@metamorfosa.app.
Visit counter
We count visits anonymously. Nothing is stored on your device for this — no cookies, no identifiers. When a page of this website is opened, the counter sends our own server at metamorfosa.app the address of the page, the language of the page and — if you followed a link — the address of the referring website as your browser reports it; the server keeps only its group (for example “Google search engine” or “other website”). When the app button is tapped, it sends a note of this with the page address and language. When the web app starts, it sends only that it was started and whether you came from the website metamorfosa.app. The server only increases daily totals; no IP address, cookies, identifiers or data from the app are stored, and individual visitors cannot be told apart. If Do Not Track or Global Privacy Control is switched on in your browser, the counter sends nothing. Like any request, the counter request appears in the host’s server log; we do not analyse it. Purpose: to understand whether the website is found and the app is used. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). No third parties are involved. To object, switch on Do Not Track or Global Privacy Control.
Transfers to third countries
One recipient may process data outside the EU/EEA: Cloudflare, Inc. (USA), sub-processor for the error reports (CDN). This concerns technical connection data, above all your IP address, when an error report is sent. The basis is the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Cloudflare is certified. In addition, the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) apply under Cloudflare’s data processing agreement. Error reports are stored in Frankfurt am Main, Germany. The files of the website and the app are served by Hostinger International Ltd., based in Cyprus (EU).
Emails to us
If you write to us via “Suggest an idea / report a problem” at info@metamorfosa.app, we use your address and message only to reply (Art. 6(1)(b) and (f) GDPR). The email itself only adds the app version, language and platform. We delete the correspondence once it is resolved, unless we must keep it.
Loading the app
The app’s files are served by Hostinger International Ltd. (Cyprus). Like any web server, it receives the IP address, time and browser details and writes them to a log (Art. 6(1)(f) GDPR). No content from the app is transmitted. Fonts are part of the app and are not loaded from third parties So that the app also starts offline, the browser keeps its program files (code, fonts, images) in its cache; this cache holds no personal data.
Export and calendar
The export (JSON, CSV) and the calendar file (.ics) for a reminder are created in the browser and go wherever you save them. From then on the file is in your hands. Habits can say something about health — share exports only with people you trust.
Deletion
Settings → “Data” → “Delete all data”: after confirming, everything is removed from the browser. We hold no copy. Clearing the site data in your browser removes everything as well.
Your rights
You exercise access, rectification, erasure and portability directly in the app: view, edit, “Delete all data”, export. A request to us would have nothing to act on — your entries are not with us. About server logs: info@metamorfosa.app.
Right to complain
You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Ours: Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus.
Changes
We update this policy when the app changes. Version of 23 October 2026.