Privacy Policy

Last updated: 4 October 2026

This policy explains what personal data is collected when you use xaviesteve.com, its online tools, and my mobile apps (together, the “Services”), why, and what your rights are. I try to collect as little as possible.

Who is responsible for your data

The data controller is Xavi Esteve, an individual based in Spain. Contact: contact page or xavi@xaviesteve.com.

What I collect and why

Data	Purpose	Legal basis (GDPR)
Comments: name, email, website, IP address and the comment itself	Publish your comment, prevent spam, reply to you	Consent (you submit the form)
Contact messages and emails you send me	Reply to you	Legitimate interest / your request
Newsletter or notification sign-ups (email address)	Send what you subscribed to	Consent
Server logs: IP address, browser, pages requested, time	Security, abuse prevention, troubleshooting	Legitimate interest
Analytics (Google Analytics): pages viewed, approximate location, device and browser, cookie identifiers	Understand which content is useful	Consent where required, otherwise legitimate interest
Advertising data (Google AdSense / AdMob): see below	Show ads that fund the Services	Consent where required
Push notification identifiers (OneSignal), in apps that offer notifications	Deliver notifications you opted in to	Consent

I do not sell your personal data, and I do not use it for automated decision-making or profiling beyond the advertising described below.

Advertising (AdSense and AdMob)

The website uses Google AdSense and my Android apps use Google AdMob to show ads. Google and its partners may collect and use data such as your IP address, device identifiers (including the Android Advertising ID), app and device information, and ad interactions to serve, measure and personalise ads and to prevent fraud. They may use cookies, local storage or SDKs for this.

Where required (for example in the European Economic Area and the United Kingdom), personalised ads are only shown with your consent, collected through a consent message.
You can manage personalisation at Google My Ad Center, and on Android under Settings → Privacy → Ads, where you can reset or delete your advertising ID.
Learn how Google uses data from sites and apps that use its services: policies.google.com/technologies/partner-sites. Google’s own Privacy Policy applies to the data it handles as a controller.

Mobile apps

My apps generally keep your content on your device. If an app sends data to a server, its store listing or in-app screens will say so.
I do not require you to create an account to use the apps unless stated.
Apps that show ads include the Google Mobile Ads SDK (see above). Apps that offer notifications include OneSignal, which processes a device identifier to deliver them (OneSignal’s privacy policy).
Apps may use limited diagnostic information (such as crash reports) to fix bugs.
Permissions are only requested for features that need them, and you can revoke them in your device settings.
I answer the data safety questions in Google Play based on the above. If an app differs from this policy, the app’s own notice takes precedence.

Who else receives data

I use these providers, who process data on my behalf or as independent controllers:

Google (Analytics, AdSense, AdMob, YouTube embeds)
Cloudflare (content delivery and security)
OneSignal (push notifications in some apps)
My hosting and email providers

Some of these providers are located in the United States. Where data is transferred outside the EEA, it relies on safeguards such as the EU-US Data Privacy Framework or Standard Contractual Clauses.

How long I keep data

Comments and their details: until you ask me to remove them or I delete them.
Emails and contact messages: as long as needed to deal with your request, then deleted.
Server logs: kept for a limited period for security and then rotated out.
Analytics and advertising data: according to the retention settings of Google, which I keep to the shortest practical option.

Your rights

Under the GDPR (and Spanish data protection law) you can request access to your data, correction, deletion, restriction, objection to processing and portability, and withdraw consent at any time. Email me and I will respond within one month. If you are unhappy with my response you can complain to the Spanish data protection authority, the AEPD, or your local authority.

California residents: I do not sell or share personal information for cross-context behavioural advertising outside of the ad services described above, and you can exercise your access and deletion rights by emailing me.

Children

The Services are not directed at children under 13 (or under 16 where local law requires), and I do not knowingly collect their personal data. My apps are not designed for children. If you believe a child has provided personal data, contact me and I will delete it.

Security

Data is transmitted over HTTPS and stored on servers in the European Union where possible. No system is perfectly secure, but I take reasonable measures to protect it.

Changes to this policy

I may update this policy as the Services change. The date at the top shows the latest revision.

Contact

Questions or requests: xavi@xaviesteve.com or the contact page.