Privacy Policy

calendariociclismo.app — Last updated: 24 August 2026

1. Controller and scope

The data controller and service provider is Daniel Sánchez Badorrey, independent developer of Calendario Ciclismo for iOS and Android and of calendariociclismo.app. Contact: hola@danisanchez.info. This policy applies to the website, the apps and their related services.

2. Data we process

• Notifications: APNs or FCM technical token, platform, language, region and country group derived from the time zone, selected categories, and followed races, stages or filters. We do not request GPS or precise location.
• Reports and corrections: if you submit a race-day form, we process your name, email address, report type and text, the affected race day, IP address, user agent and submission date.
• App analytics: Firebase Analytics uses a pseudonymous app-instance identifier, device and operating-system data, approximate geography and interactions such as screens, searches, viewed content, and support or purchase actions. We do not use IDFA, GAID or cross-app tracking.
• Web analytics: Google Analytics 4 processes navigation data and measurement cookies only after you accept.
• Purchases: Apple or Google handles payment. The app receives the technical confirmation, product and status required to recognise Amigo, contributions or historical Premium; we do not receive card or billing-address details. If app analytics is enabled, the product and purchase action may be recorded, but not banking details.
• Local and technical data: preferences, favourites, caches, purchase state and privacy choices are stored on the device or browser. Hosting providers may generate technical logs, such as IP, date, requested resource and user agent, for security and operation.

We do not require a user account and we do not sell personal data.

3. Purposes and legal bases

• Provide and protect the service: operation, security, abuse prevention and diagnostics, based on performance of the requested service and legitimate interests (Articles 6(1)(b) and 6(1)(f) GDPR).
• Push notifications: send the notifications you select, with your consent (Article 6(1)(a)).
• Reports and corrections: receive, verify and respond to information you voluntarily submit, based on the legitimate interest in keeping the calendar accurate and handling the request (Article 6(1)(f)).
• App analytics: understand use and improve stability and design, based on legitimate interests (Article 6(1)(f)), with an immediate right to object under Settings → Privacy → Usage statistics.
• Web analytics: visit measurement with consent (Article 6(1)(a) and cookie rules).
• Voluntary purchases: process and recognise the requested purchase (Article 6(1)(b)).

4. Recipients, processors and transfers

We use Supabase (EU-hosted database), Google Firebase (Analytics and FCM), Google Analytics, Apple (APNs and App Store), Google Play and Resend (email delivery for reports). The website and its resources may be served through GitHub Pages, Cloudflare, Hetzner and Cloudflare R2. When you open maps, links or embedded streams, the relevant external provider may receive the request and its technical data.

Some providers are outside the European Economic Area or may process data from third countries. In those cases, GDPR mechanisms such as adequacy decisions or standard contractual clauses apply according to the provider's configuration and terms. See Supabase, Google, Apple and Resend.

5. Retention

• Reports and corrections: up to 12 months; Supabase runs an automatic daily cleanup.
• Notifications: while enabled. After disabling them, the inactive record may remain for up to 30 days before cleanup. Delete my data immediately deletes the server-side notification record.
• Analytics: collection stops when you disable it or withdraw consent. GA4 user- and event-level data is retained for up to 14 months under the configured setting; standard aggregated reports may be retained for longer.
• Local data: until you clear the app or browser data or uninstall. Information required for legal obligations or claims may be retained for the applicable periods.

6. Your privacy controls

App analytics is initially enabled and can be disabled at any time under Settings → Privacy → Usage statistics. The website does not load Google Analytics until you press Accept; rejecting or choosing later does not amount to consent. You can reopen Cookie settings from the footer. Notification permission can also be withdrawn in system settings.

7. Your rights

You may request access, rectification, erasure, restriction, objection and portability where applicable, and withdraw consent without affecting earlier processing. Write to hola@danisanchez.info. We may request reasonable verification details to locate a specific report.

Delete my data in the app deletes the server-side notification record; for submitted reports or other data, use the email above. You may also complain to the Spanish Data Protection Agency or your local supervisory authority.

8. Security and children

We apply access controls, encryption in transit, security rules and data minimisation. No system is infallible. The service is not specifically directed at children and does not knowingly request children's data; contact us if you identify such a submission.

9. Amigo, contributions and historical Premium

Calendario Ciclismo is free, complete and ad-free. Amigo grants a cosmetic icon while the subscription is active; one-off contributions only display a thank-you. Premium is no longer sold and is not automatically converted into Amigo. Indicative prices are €2.99/month, €17.99/year and contributions of €2.99, €5.99 and €11.99; the price and currency shown by the store before confirmation always prevail.

Renewal and cancellation. Amigo renews automatically under the terms shown by the App Store or Google Play until cancelled. On iOS, manage it in Apple Subscriptions; on Android, in Google Play → Payments & subscriptions → Subscriptions. Cancellation prevents future renewals and access continues until the end of the paid period.

Refunds and withdrawal. iOS purchase requests are submitted to Apple; Android requests through Google Play or developer channels where applicable. Store terms and mandatory consumer rights apply, including withdrawal rights where legally applicable.

Founder. A previous Premium purchase may be recognised as Founder. On iOS, Restore Purchases can detect historical transactions. On Android, an already-expired Premium subscription may not be recoverable after clearing data or reinstalling if Google Play does not return that historical purchase and no local copy exists; contact us so we can review the case.

10. Cookies and browser storage

We use essential storage for theme, language, preferences, favourites, form control and your cookie choice. Consent is not required where it is strictly necessary. Google Analytics may create measurement cookies only after acceptance. We do not use advertising cookies or advertising profiles. You can withdraw consent through Cookie settings and clear storage in your browser.

11. Advertising and marketing

The apps and website do not display ads, integrate advertising networks, or sell or rent data. An email address submitted with a report is used to handle that report, not for marketing.

12. Changes and contact

We will update this policy when the service, its providers or the law changes. The date above identifies the current version. For any question, write to hola@danisanchez.info.