Privacy policy

Last updated: October 31, 2026

Envisioned ("we," "our," or "us") is operated from Spain and is committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and applicable Spanish data protection law. This Privacy Policy explains how we collect, use, and safeguard your information when you use our mobile application.

Information we collect

When you use Envisioned, we may collect the following information:

• Account information: Your name and email address when you create an account or sign in with Google.
• Goal data: The visions, milestones, tasks, habits, check-ins, and related content you create within the app.
• Images: Cover images you upload for your visions and milestone memories, stored securely in the cloud.
• Friends (optional): If you use Friends, we store your friends profile (the display name and photo you choose), your invite codes, who you are friends with, who you have blocked, the hearts and comments you leave, the moments the app creates when you make progress on a vision you share, the cheers you send, and any reports you send. See "Friends" below for who can see what.
• Push notification tokens: A token from Apple or Google that lets us send notifications to your device, such as when a friend comments on one of your moments.
• Pinterest (optional): If you link your Pinterest account to choose cover pictures, we read your Pinterest username and the boards and Pins on your own account, only while you browse them in the app. We store the access tokens Pinterest issues on our servers (never on your device), and the links to the pictures you choose as covers. We never post, edit or delete anything on your Pinterest account.
• Subscription data: Information related to your subscription status, trial period, and payment history, processed through Apple's App Store or Google Play depending on your device.
• Usage data: Anonymous analytics about how you interact with the app, including screen views and feature usage, to help us improve the experience.
• Advertising identifier and app events: Your device's advertising identifier (Apple's IDFA on iOS, the Google Advertising ID on Android) together with app install, app open and subscription events. We use these only to measure which advertising campaigns bring people to Envisioned. See "Advertising measurement" below for what is shared, with whom, and how to opt out.
• Crash and diagnostic data: When the app crashes or hits an error, we collect a technical report — the error and stack trace, your device model, operating system version, and app version — along with your account identifier, so we can trace and fix the problem. These reports contain no goal data or message content.

Legal basis for processing

We process your personal data on the following legal bases under the GDPR:

• Contract performance: To provide you with the Envisioned service, sync your data, manage your subscription, and run Friends when you use it, including showing your friends what you choose to share and sending you notifications.
• Legitimate interest: To improve the app, fix bugs, and understand how features are used, and to keep Friends safe by reviewing reports and acting on abuse.
• Consent: For optional analytics, advertising measurement and marketing communications, which you can withdraw at any time.

How we use your information

We use your information to:

• Provide and maintain the Envisioned app and its features
• Sync your data across devices
• Show your friends the visions and moments you share, and their hearts and comments to you
• Send push notifications about hearts, comments, replies, cheers and accepted invites (you can turn these off in your device settings)
• Review reports and act on content or accounts that break our Terms
• Manage your subscription and free trial
• Improve and personalise your experience
• Measure which advertising campaigns bring new users to Envisioned
• Communicate with you about updates or changes to the service

Friends

Friends is optional. You connect with someone only by sharing an invite code, QR code or link; there is no public directory or search, and nobody can find you unless you give them a code.

Your friends can see:

• Your friends profile: the display name and photo you choose.
• The visions you choose to share with friends (sharing is off by default and is set per vision), including their cover image, milestones, actions and habits (with any notes on them) and check-ins.
• Moments from those shared visions, such as completing an action, keeping a habit or reaching a milestone, and the hearts and comments on them.
• The hearts and comments you leave on their moments, and the cheers you send them.

Your friends never see your email address, your account details, your scrapbook, or any vision you have not shared. If you stop sharing a vision or remove a friend, they lose access straight away.

If you block someone, the friendship ends, their hearts and comments on your moments are deleted, and they cannot add you again. If you report a person or a comment, we receive your account identifier, the account and content you reported, and any message you add. The person you report is not told who reported them.

Advertising measurement

We advertise Envisioned on Meta platforms (Facebook and Instagram). To see whether those ads work, the app includes the Meta SDK, which reports the following to Meta Platforms Ireland Limited: that the app was installed and opened, that a free trial or subscription was started, your device's advertising identifier, and basic device information such as operating system and app version. Meta matches these events against ads you may have seen so we can measure and improve our campaigns.

We do not share your name, email address, goals, milestones, tasks, notes, images or any other content you create in the app with Meta, and we never show advertisements inside Envisioned.

You can opt out at any time:

• In the app: Settings → Privacy & data → turn off Share usage data. This stops usage analytics and crash reporting, stops your advertising identifier from being collected, and marks any remaining app-open events sent to Meta as restricted from use for advertising.
• On iOS: Envisioned asks for permission before using your advertising identifier. If you tap "Ask App Not to Track", or turn tracking off later under Settings → Privacy & Security → Tracking, the identifier is not used.
• On Android: Under Settings → Google → Ads (or Settings → Privacy → Ads) you can delete or reset your advertising ID, which prevents or breaks the link to earlier events.

Meta processes this data under its own privacy policy, and you can review the ad-related data Meta holds about you and adjust it in Meta's ad preferences.

Data storage and security

Your data is stored securely using Google Firebase services, with servers located in the EU/EEA where available. We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, or destruction. These measures include encryption in transit and at rest, access controls, and regular security reviews.

Third-party services

We use the following third-party services:

• Google Firebase: For authentication (including Google Sign-In), data storage, cloud functions, and image storage. Firebase Privacy Policy
• Google Analytics: For anonymous usage analytics. Google Privacy Policy
• Firebase Cloud Messaging and Apple Push Notification service: For delivering push notifications to your device. They receive your device's push token and the notification text. Firebase Privacy Policy · Apple Privacy Policy
• Firebase Crashlytics: For crash and error reporting. Firebase Privacy Policy
• Apple App Store and Google Play: For subscription billing and payment processing. We do not receive or store your payment card details. Apple Privacy Policy · Google Privacy Policy
• Meta Platforms: For measuring advertising campaigns, as described under "Advertising measurement" above. Meta Privacy Policy
• Pinterest: Only if you link your account, to let you choose pictures from your own boards and Pins as covers. Access is read-only. You can unlink at any time in Settings, which deletes the stored tokens; deleting your Envisioned account deletes them too. Pictures you already chose stay on your visions as links to Pinterest's image servers. Pinterest Privacy Policy

International data transfers

Some of our third-party service providers may process data outside the EU/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to protect your data in accordance with the GDPR.

Data retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days. For Friends, this removes your friends profile, invite codes, friendships, your moments with their hearts and comments, the hearts and comments you left on others' moments, your blocks, and your push tokens. Reports are kept for as long as we need them to handle the report and to prevent repeated abuse, including after the reported or reporting account is deleted, and are then deleted. Anonymous, aggregated analytics data that cannot identify you may be retained indefinitely. Advertising measurement events are retained by Meta according to its own retention periods; resetting your advertising ID breaks the link between you and those events.

Your rights under the GDPR

As a data subject, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data ("right to be forgotten").
• Data portability: Request your data in a structured, machine-readable format.
• Restriction: Request that we limit the processing of your data.
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at info@envisioned.app. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).

Children's privacy

Envisioned is not intended for children under 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page, updating the "Last updated" date, and where appropriate, notifying you via the app. Your continued use of the service after changes are posted constitutes acceptance of the updated policy.

Contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at info@envisioned.app.