1. Controller and contact
The controller for personal data processed through Reals is Aleix García, developer of Reals, initially operating from Spain.
For privacy questions or data rights requests: reals.contacto@gmail.com.
2. Scope and minimum age
This policy applies to the Reals Android app and reals.info pages linking to it. Reals lets users create and complete experiences (‘Reals’), save memories and use social features including friends, groups, chats and competitions.
Reals is only for people aged 16 or over. Registration asks users to declare that they meet the minimum age; Reals does not store a date of birth or perform automatic document-based age verification.
3. Data we process
- Account/profile: email, UUID, display name, username, avatar, friend code and visibility/settings preferences.
- Activity: Reals, descriptions, categories, difficulty, progress, dates, completions, groups, memberships, roles, invitations, friendships and blocks.
- Content: covers, memories/photos, group avatars and competition evidence.
- Communications: direct/group messages, replies, reactions and read receipts; typing presence may be stored temporarily in the database.
- Notifications: in-app notifications and an Expo Push Token associated with the user and platform.
- Virtual shop: coins, items, inventory and equipped items; these are not currently bought with real money.
- Minimal internal analytics: user UUID, event type, timestamps, platform, app version and permitted technical properties.
4. Purposes and legal bases
Depending on the processing, the legal basis may be performance of the requested service, consent for optional permissions/features, legitimate interests in proportionate security/product improvement, or compliance with law.
- Create, authenticate and maintain your account and provide features you choose to use.
- Provide Reals, memories, groups, friendships, chats, competitions, virtual shop and notifications.
- Protect security, prevent abuse and respond to reports.
- Provide support and handle privacy/deletion requests.
- Run minimal internal analytics to improve the product.
- Meet legal obligations and valid authority requests.
5. Visibility, images and chats
Visibility depends on the feature. Some information is shared with friends, group members, competition participants or chat recipients. Some avatar, cover and group images use public Supabase Storage URLs and should be treated as potentially accessible to anyone who knows the URL while the object exists.
Reals chats are not end-to-end encrypted. They are stored in Supabase and authorised infrastructure administrators may technically access stored content when needed for support, security or maintenance.
6. Providers
Reals 1.0.0 does not use React Native Firebase, Crashlytics, Firebase Analytics, Google Analytics, Meta Pixel or a payment provider.
Providers may process operational logs and technical data under their own terms, security measures, locations and retention practices. Appropriate safeguards apply where international transfers occur.
- Supabase: authentication, PostgreSQL, Storage, Realtime and Edge Functions.
- Expo: app runtime/services and Expo Push Service.
- Google: optional Google OAuth and Firebase Cloud Messaging for Android push delivery through Expo.
7. Analytics and data we do not use
Product analytics are stored in Supabase and do not intentionally include emails, chat text, photos or free-form Real content as analytics properties.
- No GPS location, phone contacts, calendar or health data.
- No Advertising ID or behavioural advertising.
- No Google Analytics, Firebase Analytics or Meta Pixel.
- No AI provider in the current runtime.
- No real-money payments or commercial subscriptions. Reals+ is currently an internal entitlement only; there is no Play Billing, StoreKit, RevenueCat or active charging.
8. Retention and account deletion
Data is kept while the account is active and needed for the features used. Account deletion permanently removes the Auth user after the deletion process succeeds and explicitly removes many attributable records/files, including personal Reals, memories, avatar, direct messages, the user’s group messages, competitions/evidence, notifications and analytics.
If a group continues with other accepted members, ownership and some group Reals may be transferred. Other users’ shared content is not deleted by your account deletion. A legacy group image without technical uploader attribution may remain when the group continues.
Some related records rely on database foreign-key cascades in the deployed environment. Providers may also retain limited logs/backups for operational, security or legal reasons; deletion is not necessarily instantaneous from every technical backup.
9. Security
Reals uses authentication, Row Level Security, server-side checks, protected RPCs and access controls. The reviewed client does not contain the Supabase service_role key.
No system can guarantee absolute security and deployed infrastructure rules may evolve as part of service maintenance.
10. Your rights
Where applicable, you may request access, correction, deletion, objection, restriction, portability or withdrawal of consent by emailing reals.contacto@gmail.com. Reasonable identity verification may be requested without asking for unnecessary data.
You may also complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.
11. Website, cookies and updates
reals.info currently uses no Google Analytics, advertising pixels or non-essential cookies. The language selector only stores a local browser preference to remember your chosen language.
This policy may be updated to reflect legal, technical or functional changes. The current version and date will remain published here.
12. Social Feed and interactions
Reals includes a Social Feed. Depending on the selected audience, posts may be visible to authenticated users and include a Real snapshot, photos, comments, replies, likes, reactions and inspiration counts. Follows, friendships, blocks and reports are also processed to provide and protect these features.
13. “For you” personalisation and impressions
“For you” uses signals such as language, recency, categories related to your Reals, inspiration count, previous impressions and variation. Impressions record which post an account viewed, first/last view times and a count to reduce repetition and improve relevance. Special-category data is not used for this ranking and it does not make decisions with legal effects. “Following” provides an alternative focused on chosen relationships.
14. Habits and reminders
If used, Reals processes habit settings, frequency, target days, progress, streaks, deadlines, local day/time information needed for calculations, recent alerts, reminded-Reals history and notification permissions/tokens.
15. Reports and moderation
Reports may contain the reported content, identifiers, a written reason, date and review status. They are used for safety, abuse prevention and compliance. Review may be manual and necessary records may be retained for a reasonable period for safety, appeals or legal duties.
16. Chat previews and push services
When notifications are enabled, Reals may generate message previews and send them through Expo Push Service and Firebase Cloud Messaging. Depending on device settings, text may appear on the lock screen. Chats are not end-to-end encrypted.
17. Post translation
Reals may offer optional post translation. Where an external translation provider is enabled, the text required for translation may be processed by the configured provider. Translations can contain errors and are not used to make decisions about users.