1. Controller and contact
This policy describes the data processing of TornCat Mossos, a private tool for organizing shifts, leave, reminders, personal work calendars, user-entered professional records and voluntary schedule sharing.
The data controller is Blai Gironella Llach, the individual responsible for TornCat Mossos and holder of the public developer account distributing the app on Google Play, App Store or other official channels. The visible controller identity should match the public store listing.
2. Data the app may process
The app should collect only the data needed to provide its functions. Depending on actual use, the following categories may be processed:
- Account data: email address, user identifier, display name or alias, session state, basic settings and a versioned record of accepting the terms and privacy policy. If the user chooses Sign in with Apple or Google, TornCat uses the email address and, when provided, the authorised basic profile information to create or access the same TornCat account. Apple may provide a private relay address when the user hides their email.
- Sign in with Apple security: when this sign-in method is enabled, the backend retains a pseudonymised Apple identifier and a technical revocation credential in an encrypted, server-restricted secrets store. It is used to validate the authorisation periodically, respond to official Apple notices and revoke it if the account is deleted. The credential is never returned to the app; the authorisation code and nonce are not retained in plaintext.
- Service configuration: selected work configuration, area or service settings, shift pattern, team, regime or parameters needed to generate the calendar.
- Calendar and shifts: shifts, vacation, personal leave, blue days, user-marked sick leave, overtime extensions, holidays, notes, reminders and manual adjustments.
- Jornada and Radar: hour calculations, night work, deviations, leave records, alerts and other indicators derived from the calendar.
- User-entered professional records: court appearances, summons, meetings, shooting practice, training, overtime extensions, extra hours or other records voluntarily added by the user.
- Private notes: text entered by the user in the calendar or personal record areas.
- Private sharing: authorized connections, invitations, visibility permissions, exchange/coverage requests and content the user chooses to share.
- Moderation and safety: reports, blocks, incidents, review reasons and signals needed to prevent abuse if social or exchange features are used.
- Exports: PDFs, Excel files, text files, calendars, files or previews generated when the user requests to send or export information.
- Support: messages sent to support, incidents, screenshots provided by the user and metadata needed to resolve the request.
- Minimum technical data: app version, operating system, language, date/time of technical events, security logs and data needed to prevent abuse or diagnose errors.
3. Sensitive data and use limits
Do not enter sensitive institutional data. The app must not be used to store official credentials, badge numbers, institutional passwords, classified information, police operational data, victim data, suspect data, reports, proceedings, sensitive locations or third-party data without authorization.
Some functions may allow users to record sick leave, court appearances, summons, notes or professional events. These records are for personal organization and do not make the app a medical, judicial, police, administrative or institutional system.
Users should avoid entering medical diagnoses, health reports, third-party data, procedural details, operational information or any data that is not strictly necessary for personal organization. If a note or export contains sensitive information, the user is responsible for deciding whether to store, share or delete it.
4. Purposes and legal bases
| Purpose | Main data | Main legal basis |
|---|---|---|
| Create an account, sign in and maintain the service. | Email, user identifier, session and basic profile. | Performance of the service requested by the user. |
| Generate calendar, shifts, jornada, reminders and summaries. | Configuration, shifts, leave, notes and records entered by the user. | Performance of the service and voluntary user actions. |
| Send notifications, use camera, device calendar or exports. | Device permissions, events, files and preferences. | Consent or voluntary activation through the operating system or app. |
| Share schedules or information with authorized connections. | Visibility permissions, invitations and data selected by the user. | Consent or explicit user request. |
| Handle support, privacy, account deletion and security. | Email, support messages, minimum technical data and request records. | Service performance, legal obligation and legitimate interest in security. |
| Prevent abuse, unauthorized access, fraud, spam or misuse. | Minimum technical logs, reports, blocks and security signals. | Legitimate interest in protecting users, the service and data. |
| Comply with legal obligations or defend claims. | Strictly necessary data depending on the case. | Legal obligation and defense of claims. |
5. Device permissions, SDKs and tracking
The app may request device permissions only when a specific function requires them. The user may deny them through the operating system; in that case, the app keeps available the features that do not depend on that permission.
| Permission or function | Use in TornCat Mossos | Required |
|---|---|---|
| Camera | Scan invitation or connection QR codes when the user opens that feature. | No. QR only. |
| Device calendar | Create or export local calendars if the user enables an integration or export. | No. The app works without granting it. |
| Notifications | Local reminders and alerts configured by the user on their device. | No. Optional; no remote-notification token is used. |
| Files and system share sheet | Generate or share PDF, Excel, text or calendar files when the user taps export or share. | No. Only for voluntary export. |
The current version does not integrate advertising SDKs, sell personal data or use advertising tracking across third-party apps or websites. Current notices are local to the device: TornCat does not register or send Expo Push tokens. Sentry is initialized only in a production build that contains a valid DSN. When enabled, it may process a technical event identifier and timestamp, version, release, platform/runtime, error category and sanitized technical stack, static action or route, duration and coarse screen/font buckets. The sanitizer applies to both errors and performance transactions and removes user, request, contexts, extras and free-form messages. TornCat does not attach names, emails, account UUIDs, calendar dates or content, shifts, leave, notes, court records, network URLs or payloads, screenshots, recordings or replay. Sentry may process ordinary transport metadata, such as the IP address depending on project settings; those settings and a real sample must be verified before every release.
6. Providers, processors and transfers
TornCat Mossos does not sell personal data. It may disclose strictly necessary data to technical providers that run the app and legal website, acting as providers or processors where applicable.
| Provider or channel | Intended use | Possible data |
|---|---|---|
| Supabase | Authentication, database, access rules and backend functions. | Account, profile, calendar, notes, records and data needed for functionality. |
| Apple and Google Identity, through Supabase Authentication | Optional Sign in with Apple or Google. | Email and basic profile authorised by the user to create or access an account. Apple may provide a private relay address when the user hides their email. For Apple, the backend may retain the encrypted technical revocation credential and pseudonymised identifiers described in this policy. When Google Sign-In is used, its SDK may process the user identifier and IP address to record the OAuth grant and estimate general location for fraud prevention; TornCat does not request location permission or receive GPS coordinates through this login. Login does not grant access to iCloud, Apple Calendar, Google Calendar, Drive, Gmail or Contacts. Separately, optional device-calendar export uses a local operating-system permission and does not upload that calendar to the backend. |
| Sentry | Private technical diagnostics for errors and limited performance monitoring, only when a production build contains a valid DSN. | Technical event ID and timestamp, version/release, platform/runtime, sanitized category and stack, static action/route, duration and coarse screen/font buckets. Account identifiers and operational content are not attached; IP and other transport metadata depend on provider settings. |
| Cloudflare Pages | Hosting this public legal website and securely delivering static pages. | Ordinary technical web access data processed by the infrastructure provider. |
| Google Play / Apple App Store | Distribution, review, updates, operating system and store services. | Technical or account data processed by the store under its own terms. |
| Email provider | Respond to support, privacy, security and deletion requests. | Email, message content and data the user chooses to send. |
| External apps chosen by the user | WhatsApp, email, files, calendars or other apps used to share exports. | Only what the user chooses to share outside TornCat Mossos. |
Some providers may process data outside the European Economic Area. Where applicable, appropriate safeguards such as processing agreements, standard contractual clauses or other mechanisms recognized by data protection law will be used. Exports sent by the user to external apps are governed by the privacy controls and terms of those apps.
7. Legal website, cookies and local storage
This public legal website is hosted on Cloudflare Pages, does not require login and does not include first-party forms. The current configuration does not use advertising cookies, marketing analytics or commercial tracking.
The legal website is served in light mode and does not store a persistent visual theme preference in the browser.
8. Security, retention and deletion
Reasonable measures are applied to protect information, including encrypted communications where applicable, per-user access control, security rules, permission limitation, data separation and data minimization. On iOS, the authentication session is stored in Keychain; on Android SDK 54 it is stored inside the app-private sandbox for compatibility. This does not make the device appropriate for operational information or sensitive data.
| Category | Expected retention |
|---|---|
| Account and profile | While the account is active or until the user requests deletion, except minimal retention for legal obligations, security or claims. |
| Apple credential and technical evidence | The encrypted credential is retained while Sign in with Apple remains linked to the active account. It is revoked and deleted when the link or account is removed; if Apple does not respond, it is kept only for limited technical retries and then deleted under the TN3194 fallback. Challenges expire after five minutes; terminal records are deleted after seven days, while anti-replay fingerprints or minimal manual evidence are kept for no more than thirty days plus seven days of terminal purge. |
| Calendar, shifts, notes and records | While the user keeps them in the app, until they delete them, clear the calendar, export their information or delete the account. |
| Connection invitations | Invitations are designed to expire after 24 hours unless revoked or accepted earlier. |
| Data shared with connections | While the connection and visibility permission exist, or until the user revokes, blocks, deletes or changes sharing. |
| Reports, security and abuse | For the time needed to review incidents, prevent abuse, protect the service or meet legal obligations. |
| Support | For a reasonable time to answer the request and keep minimal traceability for incidents or claims. |
| External exports | Files shared outside the app remain under the control of the user and the chosen external service. |
Account and data deletion can be started from the app or from the public deletion page. Failure to revoke with Apple does not block TornCat deletion: the minimum result is recorded, the credential is removed after limited retries, and the Apple steps required by TN3194 are provided. A scheduled backend task enforces the expiries and purges above.
9. User rights
The user may request access, correction, deletion, restriction, objection, portability or withdrawal of consent by writing to [email protected]. To protect the account, reasonable identity verification may be requested, for example writing from the email associated with the account.
If the user considers that processing does not comply with data protection law, they may lodge a complaint with the competent supervisory authority. In Spain, the reference authority is the Spanish Data Protection Agency (AEPD).
10. Minors, professional use and official channels
The app is not directed at minors. It is a personal work-organization tool and should be used with the user's own lawful, minimized data.
TornCat Mossos is not an institutional, administrative, police, union, medical, judicial or official system. It is not for emergencies, complaints, service instructions, official communications or legal advice. Any calculation, alert or reminder should be checked against the applicable official sources.
11. Google Play Data Safety and App Privacy summary
This summary helps keep the Google Play and App Store listings consistent with this policy. The final console declarations must always match the real app implementation and the SDKs used.
| Category | Intended use | Required or optional | Sharing |
|---|---|---|---|
| Email and account identifier | Authentication, support and security; Apple and Google are optional sign-in methods. | Required for account. | Technical authentication/backend provider and Apple or Google when selected by the user. |
| Profile and configuration | Configure the calendar, jornada and app experience. | Required for core features. | Not shared except voluntary action or necessary technical provider. |
| Calendar, shifts, leave and notes | Planning, calculations, reminders, summaries and exports. | Required or optional depending on feature. | Only by permission, authorized connection, voluntary export or necessary technical provider. |
| Professional and judicial records | Personal reminder and tracking of events entered by the user. | Optional. | Not shared except by permission or user-initiated export. |
| Connections and sharing | Allow schedules or requests to be shared with authorized contacts. | Optional. | Only with users or contacts chosen by the user. |
| Reports and blocks | Moderation, security, abuse prevention and rule enforcement. | Optional, when reporting or blocking. | Technical provider needed to operate the app and review incidents. |
| Device permissions | Camera for QR, calendar for export/sync and notifications for reminders. | Optional. | Processed by the operating system and requested function. |
| Technical data | Security, minimum diagnostics and abuse prevention. | Necessary to operate safely. | Supabase and, only when enabled in production, Sentry for minimized technical diagnostics. |
| Support data | Answer incidents, legal requests and privacy requests. | Optional, if the user contacts support. | Email/support provider if applicable. |
Personal data is not sold. There is no advertising SDK or advertising tracking. Google Play Data Safety and App Store Privacy information must remain aligned with this policy, the real implementation and active SDKs.
12. Changes to this policy
This policy may be updated when the app, providers, purposes, store declarations or applicable law change. The last updated date is shown at the top of the page.
13. Store review note
This policy is available at a public, active, HTTPS URL that is not geoblocked, not user-editable and not presented as a PDF. It should also be linked from the app and from the Google Play or App Store listing.