Mythonauta was built for walking, not for collecting data. This page explains, without evasions, what is collected, why, who touches it and how to have it deleted. Exactly one piece of data leaves your iPhone, and section 02 explains which.
This policy applies to the website mythonauta.com, to the “Notas al pie” newsletter and to the iOS application Mythonauta. The details of the data controller are at the end, in section 12.
01The essentials, at a glance
- Your steps stay on your iPhone. The step count the app reads from Health never reaches any server.
- Your location does leave, and for one thing only: to find out what the weather is where you are. It is sent to Apple, used for the forecast, and not stored.
- There are no servers of our own. There is nothing at the other end in which to keep your data.
- There are no third-party SDKs. No analytics, no advertising, no tracking, no crash reporting.
- Your route is not tracked. Your progress along the story is calculated from steps, not from where you happen to be.
- Personal data is never sold to third parties. Not ever.
- Personal data is not used for advertising, our own or anyone else’s.
- No profiling is carried out and no automated decisions with legal effects are taken.
- The bare minimum is collected, and little more.
02What data is collected, and why
2.1. Email subscriptions
Data
- Your email address.
- An origin field, recording which page you subscribed from. The form on the
Mythonauta landing page stores it with the value
mythonauta. - Technical sign-up data recorded by Kit when processing the subscription: the IP address the form was sent from, the date and time, and the status of the subscription (confirmed, active or unsubscribed).
Purpose
It depends on where you subscribed from, and that is exactly what the origin field is for.
- If you subscribed from the Mythonauta landing page
(
origen = mythonauta): the only purpose is to let you know on the day Mythonauta reaches the App Store. That is precisely what the form promises, and nothing more. You will not be sent the “Notas al pie” newsletter or any other regular communication. - If you subscribed from another IlustresAnónimos page to the “Notas al pie” newsletter: you will receive the notes and mailings belonging to that newsletter, as set out in that form.
The origin field also makes it possible to know, in aggregate, which pages generate the most subscriptions.
All subscriptions are handled in a single list inside Kit, but mailings are segmented by the origin field: when each email is prepared, only the group of people who subscribed to receive it is selected. In this way each person receives only what they consented to, and whoever signed up from the Mythonauta landing page will receive the launch announcement and nothing else.
Legal basis
Your consent (Art. 6(1)(a) GDPR), given by ticking the box on the form, which is not pre-ticked. Consent is limited to the specific purpose stated on that form: if you subscribed to receive the Mythonauta launch announcement, your consent covers that mailing and no other. Art. 21 of Spanish Law 34/2002 (LSSI) also applies, which requires prior and express consent for commercial communications by electronic means.
If at any point IlustresAnónimos wished to send you communications other than those you subscribed to, it would ask for your consent separately beforehand.
You may withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand, using the unsubscribe link in any email or by writing to victor@mythonauta.com.
2.2. Browsing this website
The site is served through Cloudflare, acting as a content delivery network and security layer. On behalf of the controller, Cloudflare processes your IP address, the date and time of the request, the URL requested, the response code, the user agent and the automated traffic detection signals of Bot Fight Mode.
Purpose: to serve the site quickly and to protect it against attacks and malicious automated traffic.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in ensuring network and information security, an interest expressly recognised in Recital 49 GDPR. The processing is limited to technical data and is not used for profiling or advertising.
What is not done. This site uses no web analytics tools — neither Google Analytics, nor Cloudflare Web Analytics, nor any other — builds no browsing profiles, and does not share traffic data with any third party other than Cloudflare.
Retention. Cloudflare does not retain detailed HTTP request logs by default. Traffic and security information is shown in the dashboard in aggregate form for a limited period of up to 30 days, after which it is no longer available. IlustresAnónimos does not download, export or store it.
2.3. The Mythonauta application
The app uses Apple frameworks exclusively: SwiftUI, SwiftData, HealthKit, WeatherKit and StoreKit. There is no backend of our own and no third-party dependencies.
Step count (Apple Health)
Mythonauta asks permission to read your step count from Apple’s Health app (HealthKit), for the sole purpose of measuring your progress along the narrative route and unlocking the corresponding chapter.
It is the only data the application reads from Health. The permission is read-only: Mythonauta writes no data to Health.
In accordance with Apple’s conditions for the use of HealthKit, your Health data is not used for advertising or marketing purposes, is neither sold nor disclosed to third parties, data brokers or information resellers, and is not used to build profiles.
This data is processed entirely on your device. It is not transmitted to IlustresAnónimos servers or those of any third party, and it is not stored outside your iPhone.
Since the step count never leaves your device, IlustresAnónimos has no access to it at any time. It does not receive it, does not store it and cannot consult it. No connection is needed for the application to know where you are along the route.
You can revoke the permission at any time from Settings › Health › Data
Access & Devices › Mythonauta on your iPhone. If you do, the application will stop
recording new progress; whatever you have already unlocked stays unlocked. If you delete the
application, the record of your progress goes with it.
A step count is, in the abstract, data concerning health. But because it remains entirely on your device and is never accessible to the controller, IlustresAnónimos carries out no processing of health data within the meaning of Art. 4(2) GDPR, and does not act as controller of that data under Art. 4(7). None of the situations in Art. 9 GDPR therefore arises.
The only processing that exists is the one carried out by your own device’s operating system, under your exclusive control and subject to Apple’s conditions.
Location
Mythonauta accesses your device’s location and sends it to Apple. It is the only data in the application that leaves your iPhone, and it deserves a precise explanation.
What for. Mythonauta looks up the weather where you are and uses it to colour the sky of the story you are reading: if it is raining where you walk, it rains in the tale.
What the application actually does. When it needs that information, it asks the system for a single, one-off reading of your position. The permission is of the “while using the app” type (When In Use): Mythonauta does not access your location in the background or when the app is closed. There is no continuous tracking, no trace of your route and no history of positions.
Precision. Depending on the permission you grant, the system may return your precise location. The application treats it as such.
Where it goes. Those coordinates are sent to Apple’s WeatherKit service, which returns the corresponding forecast. They are used for that and nothing else.
What does not happen. IlustresAnónimos does not receive your location, does not store it and cannot consult it: there is no server of its own for it to reach. Nor is the location kept on your device beyond the moment needed for the query, nor used to calculate your progress along the route, nor for advertising, nor for profiling, nor is it sold or disclosed to anyone.
Your control. You can deny the permission, grant it just once, or limit it to
approximate location from Settings › Privacy & Security › Location
Services › Mythonauta. You can also revoke it at any time. If you do, the application stops
showing the weather and everything else carries on exactly as before: the weather
feature is an ornament of the story, not a requirement for walking it.
Legal basis: your consent (Art. 6(1)(a) GDPR), given freely, specifically and on an informed basis when you grant the location permission requested by the operating system. It is revocable at any time from the device settings, without affecting the lawfulness of prior processing and with no consequence whatsoever for the rest of the application.
This processing is independent of the step count described above. Steps stay on your device; location is communicated to Apple. They are two different things and are best not confused.
User accounts
Mythonauta requires no registration. No account is created, no email address or password is requested, and no identifier is generated that would link use of the application to an identified or identifiable person. IlustresAnónimos operates no servers of its own: there is nothing at the other end in which to store a profile of you.
Analytics and third-party SDKs
Mythonauta includes no third-party SDK: none for analytics, advertising, attribution, tracking or crash reporting. No usage statistics, crash data or advertising identifiers (IDFA) are collected.
The application does not request tracking permission (App Tracking Transparency) because it carries out no tracking whatsoever, neither across apps nor within itself. The only technologies it uses are frameworks belonging to Apple’s own operating system.
Apple collects on its own account, as an independent controller, aggregate statistics on downloads, crashes and usage through App Store Connect, provided you have agreed to share them with developers in your device settings. IlustresAnónimos sees that information only in aggregate and anonymous form, with no way of identifying anyone.
In-app purchases
In-app purchases are processed entirely through Apple’s App Store, by means of StoreKit 2. No purchase or subscription intermediary is involved.
IlustresAnónimos does not receive, does not see and does not store your payment details: card number, billing address or anything else. Apple acts as an independent controller for the processing of that data, in accordance with its privacy policy.
To know what you have purchased, the application asks the operating system directly for the current purchase entitlements associated with your Apple ID. That check is resolved by Apple and its result stays on your device. IlustresAnónimos receives from Apple only aggregate sales information, which does not identify individual purchasers.
Notifications
Mythonauta may show you notifications, but all of them are scheduled and generated inside your own device. The application does not use remote push notifications: it is not registered with Apple’s notification service (APNs), generates no device token and neither sends nor receives anything from any server in order to show them.
In practice this means that no notification involves data leaving your iPhone,
and that nobody — neither IlustresAnónimos nor Apple — knows which notifications you receive or
when. You can turn them off whenever you like in Settings › Notifications ›
Mythonauta.
Weather information (WeatherKit)
To obtain the weather where you are, Mythonauta uses WeatherKit, Apple’s weather service. The application sends your coordinates to Apple’s servers and receives the corresponding forecast, which is used to set the mood of the story.
Apple acts here as an independent controller, not as a processor for IlustresAnónimos. Apple’s processing of that query is governed by its own privacy policy. Apple states that it does not associate WeatherKit requests with the identity of the user or use them for advertising purposes.
The weather data you see in Mythonauta comes from Apple Weather. You can find the full attribution and data sources in the corresponding section of the application’s settings.
This is the only feature of Mythonauta that requires an internet connection. Without a connection, or without location permission, the rest of the application works normally: the sky in the story simply does not change.
Mythonauta is not a fully offline application. Everything essential — reading, walking, unlocking chapters — works without a network, but the weather feature does not.
Other permissions
Apart from read-only access to the Apple Health step count, the location permission described above and the local notifications permission, Mythonauta requests no other system permission: no camera, no photos, no microphone, no contacts, no Bluetooth and no motion and fitness data.
03Who else touches your data
Data is not disclosed to third parties other than the providers needed to deliver the service, with whom a data processing agreement is in place under Art. 28 GDPR.
| Provider | Role | What it processes | Where |
|---|---|---|---|
| Kit formerly ConvertKit |
Processor | Email subscriptions: email address, origin field and sign-up metadata | USA |
| Cloudflare | Processor | CDN, security, access logs, IP address, Bot Fight Mode | USA and global network |
| Apple | Independent controller | App distribution, purchases (StoreKit 2), aggregate App Store statistics | USA / Ireland |
| Apple WeatherKit |
Independent controller | Weather query: the coordinates of your location and the IP address of the request | USA / Ireland |
| Email provider | Processor | Receipt and custody of messages sent to victor@mythonauta.com, including requests to exercise data protection rights | Depending on the provider engaged |
There is no purchase intermediary (RevenueCat, Adapty or similar) and no backend of our own. The list above is complete.
About Apple: Apple is not a processor acting for IlustresAnónimos. When you download the application, buy something, or the application looks up the weather through WeatherKit, Apple processes your data as a controller in its own right, under its own terms, over which IlustresAnónimos has no control and of which it receives no copy.
Data may additionally be disclosed to courts, tribunals, law enforcement bodies and competent public authorities where there is a legal obligation to do so.
04International transfers
Kit and Cloudflare are United States companies, so there is an international transfer of data outside the European Economic Area. Both are covered by appropriate safeguards under Chapter V GDPR:
Cloudflare, Inc. is certified under the EU–U.S. Data Privacy Framework, as well as its UK Extension and the Swiss–U.S. DPF. The transfer is therefore based on the European Commission adequacy decision of 10 July 2023. In addition, its data processing addendum incorporates the Standard Contractual Clauses of Implementing Decision (EU) 2021/914.
Kit is likewise certified under the EU–U.S. Data Privacy Framework, its UK Extension and the Swiss–U.S. DPF. Its data processing addendum also incorporates the Standard Contractual Clauses and the UK International Data Transfer Agreement, so the transfer is covered twice over.
You can check the status of both certifications on the programme’s official list: dataprivacyframework.gov/list.
A different case: Apple. When the application looks up the weather through WeatherKit, it is your own device that communicates directly with Apple’s servers. IlustresAnónimos plays no part in that communication and receives none of the data, so it does not carry out an international transfer within the meaning of Chapter V GDPR: the party processing that data is Apple, as an independent controller and under its own safeguards. The same applies to downloading the application and to purchases.
You may request a copy of the safeguards applied by writing to victor@mythonauta.com.
05How long data is kept
| Processing | Period |
|---|---|
| Email subscriptions | For as long as you remain subscribed. When you unsubscribe, your address stops being used for any mailing immediately. Only the record of consent and of the unsubscription is kept, for three years — the limitation period for very serious infringements under Art. 78 LOPDGDD (Spanish Organic Law 3/2018) — for the sole purpose of being able to demonstrate that the processing was lawful. After that period, the record is deleted. |
| Site access logs | Cloudflare does not retain detailed request logs by default. Aggregate traffic and security information is available in the dashboard for a maximum of 30 days. IlustresAnónimos neither exports nor stores it. |
| Apple Health step count | Entirely under your control: the data stays on your device and disappears when you delete the application or manage it from the Health app. IlustresAnónimos keeps no copy, because it never receives it in the first place. |
| Location for the weather query | Not retained. The coordinates exist only for the duration of the WeatherKit query and are recorded neither on the device nor on any IlustresAnónimos server. Retention by Apple is governed by its own terms. |
| Email correspondence | Three years from the last communication, unless there is a legal obligation to keep it longer. In the case of requests to exercise data protection rights, that period makes it possible to demonstrate that they were dealt with. |
06Your rights
You may exercise the following rights at any time:
- Access — to know what data of yours is processed and obtain a copy.
- Rectification — to correct inaccurate or incomplete data.
- Erasure — to have data deleted when it is no longer necessary or you withdraw your consent.
- Objection — to object to processing based on legitimate interest, on grounds relating to your particular situation.
- Restriction — to have data kept but not used, in the cases set out in Art. 18 GDPR.
- Portability — to receive your data in a structured, machine-readable format, or have it transmitted to another controller.
- Withdrawal of consent — at any time, without retroactive effect.
- Not to be subject to automated decisions — none are taken.
How to exercise them
Write to victor@mythonauta.com stating which right you wish to exercise.
You will not be asked for a copy of your ID document as a matter of course. Since the only data processed is your email address, it is enough for the request to be sent from that same address: that sufficiently establishes your identity and avoids asking you for additional data that would not be necessary, in line with the data minimisation principle of Art. 5(1)(c) GDPR. Only if there were reasonable doubts as to who is making the request could further information be requested, and then only what is strictly necessary, under Art. 12(6) GDPR.
A reply will be given within one month at the latest, extendable by two further months in particularly complex cases, in which event you will be notified of the extension. Exercising these rights is free of charge.
Unsubscribing requires no formalities at all: the “Unsubscribe” link at the foot of any email is enough.
Complaining to the AEPD
If you believe the processing of your data does not comply with the applicable rules, or if you do not receive a satisfactory reply, you may lodge a complaint with the Agencia Española de Protección de Datos (the Spanish Data Protection Agency):
- Electronic office: sedeagpd.gob.es
- Website: aepd.es
- C/ Jorge Juan, 6 — 28001 Madrid, Spain
- 901 100 099 / 912 663 517
Before doing so, you are welcome to write to victor@mythonauta.com and try to resolve the matter directly.
07Cookies
This site uses no first-party cookies. There are no analytics, advertising, personalisation or tracking cookies, nor equivalent technologies such as tracking pixels or browser fingerprinting. mythonauta.com is a static page: there is no session to maintain and no profile to remember.
The only cookie that may reach your browser is technical and is set by Cloudflare, the provider that serves and protects the site:
| Cookie | What for | Duration |
|---|---|---|
__cf_bm |
To distinguish human from automated traffic and protect the site against malicious bots. It is set because Bot Fight Mode protection is enabled. | Expires after 30 minutes of continuous inactivity |
cf_clearance |
To remember that a security check has been passed, so that it is not shown again. It only appears if the system actually shows you one. | Depending on the Cloudflare configuration |
These cookies do not identify you. The information in __cf_bm is
encrypted, only Cloudflare can decrypt it, it is generated independently for each site, it does
not correspond to any user identifier and it does not allow you to be followed from one site to
another.
Because they are cookies strictly necessary for the security of a service you have expressly requested, they are exempt from the requirement of prior consent under Art. 22(2) of Spanish Law 34/2002 (LSSI) and the AEPD guidelines on the use of cookies. That is why this site shows you no cookie banner: there is nothing to consent to.
The subscription form is provided by Kit, which may set strictly technical cookies needed to process the submission. They are in no case analytics or advertising cookies.
You can block or delete cookies from your browser settings, although doing so may affect how the site works.
The iOS application uses no cookies or equivalent technologies. Since it includes no third-party SDK and no tracking web views, it contains nothing analogous to a cookie.
08Security
Technical and organisational measures appropriate to the risk are applied (Art. 32 GDPR). It is worth being exact about what they are, because the project is a small one and its main safeguard is precisely that smallness:
- Encryption in transit. All site traffic travels over HTTPS/TLS, with forced redirection: it is not possible to connect over an unencrypted connection.
- No database of our own. mythonauta.com is a static site served from Cloudflare’s network. There is no application server or database that could be compromised, because none exists.
- Minimal surface. The only personal data under the controller’s control are the email addresses of subscribers, held by Kit, and the messages received by email.
- Perimeter protection. Cloudflare filters malicious automated traffic through Bot Fight Mode.
- Access control. The accounts used to administer Kit, Cloudflare, the domain and App Store Connect are protected with two-step verification.
- Minimisation. No data is collected that is not necessary for the stated purpose.
This project has no security certifications, no external audits and no incident response team. It is an individual project, and the protection it offers rests on collecting very little and on relying on providers that do have those safeguards.
No system is infallible. Should a security breach occur posing a high risk to the rights of the people affected, the AEPD will be notified within 72 hours and those affected without undue delay, in accordance with Arts. 33 and 34 GDPR.
09Minors
The email subscription forms are aimed at people aged 14 or over. In Spain, Art. 7 LOPDGDD sets 14 as the age from which a minor may consent on their own behalf to the processing of their personal data.
If you are under 14, you need the consent of whoever holds parental responsibility or guardianship over you in order to subscribe.
If you know that a child under 14 has provided their data without that consent, write to victor@mythonauta.com and it will be deleted without delay.
The Mythonauta application collects no personal data that would identify whoever uses it, so this provision concerns email subscriptions only.
10Applicable law
- Regulation (EU) 2016/679 (GDPR).
- Spanish Organic Law 3/2018 of 5 December (LOPDGDD).
- Spanish Law 34/2002 of 11 July, on information society services (LSSI-CE).
Jurisdiction: Spain.
11Changes to this policy
This policy may be updated to reflect changes in the applicable rules or new features. The version in force will always be the one published at mythonauta.com/privacidad, with its date of last update. If the changes substantially affect the processing you have consented to, subscribers will be notified by email before they take effect.
12Data controller
| Controller | Víctor García Castañeda, trading as IlustresAnónimos |
| Contact | victor@mythonauta.com |
| Website | mythonauta.com |
No data protection officer has been appointed: none of the circumstances set out in Art. 37 GDPR or Art. 34 LOPDGDD applies.
13Versions and language
This policy is written in Spanish. The present English text, published at mythonauta.com/en/privacy, is a translation offered solely to aid understanding.
In the event of any discrepancy, contradiction or doubt as to interpretation between the two versions, the Spanish version shall prevail, being the only authentic text for all purposes. It is available at mythonauta.com/privacidad. The applicable law and jurisdiction are those stated in section 10.