What Chi-Spa stores, where it goes, why, and how to get rid of it.
Last updated: 26 August 2026
Chi-Spa is made by Corvus Reach, a Spanish autónomo. Contact: contact@corvusreach.com · data protection & legal requests: legal@corvusreach.com.
On your device, always (through the app): your notes, their titles, categories and any photos or sketches attached to them; your settings; the vocabulary Chi-Spa learns from how you file things. This works with no account and no internet.
On our server, only if you create an account:
If you allow notifications on iOS, Apple gives Chi-Spa a device token that identifies this install. We store the token plus (when you are signed in) a link to your account, so we can send the nudges you turn on. We never share the token, and you can turn notifications off at any time in iOS Settings → Chi-Spa → Notifications — that also stops us using the token. Deleting the app removes the token from your device; the row on our server is cleaned up the next time Apple tells us it’s gone.
If the app hits an error or crashes, technical details are sent automatically to our error-monitoring tool (Sentry): the error code, app version, screen/route, and device or OS type. We never send your notes, your email, or anything you typed — only what's needed to find and fix the bug. When you use the in-app “Report a problem” button, the same error code is attached so a support reply can find the exact spot.
Your account and its sync exist because you asked for them — that’s processing necessary to provide the service you signed up for (GDPR Art. 6.1.b). Anything optional (weather-aware care tips, push notifications) only runs once you switch it on, which is your consent (GDPR Art. 6.1.a), and you can switch it off the same way.
Speech is turned into text by your device’s own speech recognition (Apple’s, on iOS). Apple’s terms cover that step. The resulting text becomes a normal note. Photos you attach are stored inside the note, exactly like the text. If you turn on weather-aware care tips, your device shares your location with the open-meteo weather service for that one lookup — it is not stored on our server, and turning the setting off stops it.
Our servers are hosted on Railway (EU West region), inside the EU. Sync happens over HTTPS.
You can ask for a copy of your data, correction of it, or its deletion, and you can object to processing. Two of these you can do yourself, right now, without asking anyone: Export .json hands you everything in a readable file, and Delete account erases it. For anything else, email legal@corvusreach.com. You may also complain to the Spanish data protection authority (AEPD, aepd.es).
This page is part of corvusreach.com, which uses cookies as described in the Corvus Reach Privacy Policy (necessary cookies always on; analytics/marketing only if you accept them in the cookie banner). See our Chi-Spa cookie notes for the short version. The Chi-Spa app itself uses no cookies — it stores data on your device and, if you have an account, on our server as described above.
Chi-Spa is not directed at children under 13 and we do not knowingly collect their data.
If this policy changes materially, the app will say so and this page will show a new date at the top.
Problems and bugs: it-admin@corvusreach.com
Privacy and legal: legal@corvusreach.com
Data controller: Corvus Reach, Costa Blanca, Alicante, Spain. Full legal identification available on request at the email above.