shima
Privacy Policy
WHO IS RESPONSIBLE
The controller of your data is Reinel García Morales, Spanish tax ID 42350693B, who develops and runs Shima as a self-employed professional.
Address: Calle El Colorao 33, Tarajalejo, 35629 Tuineje, Las Palmas, Spain.
Contact: hola@shimaapp.com
Write to us there with any question about this policy or to exercise your rights. A person answers, not a form.
WHAT DATA WE HANDLE
What you give us when you create an account. Your email and your name. If you sign in with Google or Apple, we receive your email, your name and your profile picture if you have one. If you register with email, your password is stored encrypted and nobody — us included — can read it. If you want, your phone number too. It used to be there so that people who had you in their contacts could find you when inviting, and that no longer happens: since 25 September 2026 the numbers in an address book never leave the phone. Today it is used for nothing beyond helping you if you write to support, and you can remove it whenever you like.
What you keep in Shima. Your photos and videos, day notes, albums, the names you give your spaces, time capsule messages and your reactions.
Who looks at what. Inside a space, the other members can see who has viewed each photo and who is looking at the space right now. Outside the space, nobody.
Voice notes. You can leave a voice note on a day or react to a photo with your voice. They are your recordings: they are stored as they are, played back for the members of that space, and not analysed in any way. We do not identify anyone by their voice, we do not transcribe them, and we use no voice recognition or biometric identification system. If that ever changed, we would tell you first.
We do not store where a photo was taken. Before uploading a photo, Shima removes from the file any coordinates the camera may have recorded, and it neither reads nor keeps them anywhere else. We do not ask for location permission and we do not have it. Videos are the exception: we cannot remove their location without re-encoding them, so if your camera recorded it inside the video, it is still there. Keep that in mind before sharing a video outside Shima.
If you invite from your contacts. Your address book never leaves your phone. The app reads it on the device, only if you give permission, and it is for one thing: choosing who to send the invitation link to over WhatsApp or SMS. Neither the numbers nor the names are sent to our server, so we cannot know who in your address book uses Shima. Until 25 September 2026 the numbers were sent — without names — to check that, and compared without being stored; that has been removed.
If you order a printed book. The recipient's name, postal address, email and phone. Only so the printer can send it. Card payment for the printed book is processed by Stripe: we never see or store your card details.
Minimal technical data. With your account we keep whether the last phone you opened it on is an Android phone or an iPhone, so we know how many accounts there are on each system. That detail is deleted with your account. Also the identifier needed to send you notifications if you enable them, and the error logs that help us fix what breaks. They delete themselves after 90 days.
How many phones open Shima. When it is installed, the app creates a random number that has nothing to do with your phone or with you. When you open it, at most every six hours, it sends us that number with the app version and whether the phone is an Android phone or an iPhone. We keep a code derived from that number (it cannot be turned back into the number), the version, whether it is Android or iPhone, and the first and last time it was opened. Nothing else: not your account, not your phone model, not where you are. It only tells us how many installations are in use, on which system and with which version, so we know when we can stop supporting an old one. It is deleted once an installation goes 13 months without being opened, and uninstalling the app removes the number from your phone.
Where the install came from. If you reached Shima through one of our links (a social network, an ad, an invitation), Google Play hands us that link's tag when you install and we store it once, tied to your account, to learn what brings people to Shima. It is not shared with anyone, carries no identifier of your phone, and is deleted with your account. And when someone taps one of those links on the web, we count one person per link and day. So as not to count the same person twice, we keep until the next day a code made from their address and browser mixed with a key that changes every day: it cannot be turned back into the address or used to recognise anyone on another day, and it deletes itself. We do not store who tapped it, their address, or anything else about their device.
What we do not do, and will not change: there is no advertising in Shima. We do not sell or hand over your data. We do not use facial recognition. We do not analyse your photos to classify them, tag them or train any model. We use no advertising tracking tools.
WHAT WE USE YOUR DATA FOR
- To provide the service: keeping your memories and showing them to the people you invite.
- To manage your plan, if you pay for one.
- To let you know what happens in your spaces, only if you turn notifications on and only for what you choose.
- To meet our legal obligations, such as keeping invoices.
The legal basis is the contract you accept by using Shima (Article 6.1.b GDPR), your consent for anything optional such as notifications (6.1.a), our legal obligations for invoicing (6.1.c), and our legitimate interest in knowing what brings people to Shima, what is read and which app versions are in use, for the install origin, the website visit statistics and the installation count (6.1.f).
WHO ELSE TOUCHES YOUR DATA
Shima needs a few providers to work. Each one handles only what it needs and none may use your data for their own purposes.
| Supabase | Database and accounts | European Union (Ireland) |
| Cloudflare R2 | Photos, videos and audio | Western Europe |
| Cloudflare | Website visit statistics, without cookies | USA |
| Google Play or the App Store (Apple), the store you bought from | Billing of subscriptions and the book PDF. The store tells us what you bought and the status of the purchase; your card never reaches us | Ireland and USA |
| Stripe | Card payment for the printed book | Ireland and USA |
| Expo | Sending notifications | USA |
| Peecho | Printing and shipping books | Netherlands |
| Anthropic | Book dedication and captions | USA |
About the book: if you tap the button to suggest a dedication, the name of that space and up to eight of your day notes are sent so the model can write a proposal. And when the preview or the PDF of a book is prepared, the day notes of the dates in it — text only — are sent to write short captions. No photo is ever sent. If you do not make a book, nothing is sent.
About the website: shimaapp.com counts its visits with Cloudflare's statistics (Cloudflare Web Analytics), to know which pages are read. It uses no cookies and stores nothing in your browser, it does not recognise you from one visit to the next and it does not follow you to other websites. When the page loads, Cloudflare receives, like any server, your IP address and the type of browser, and gives us only totals: how many visits, to which pages and from which countries. The website's fonts are served from shimaapp.com itself, without going through anyone else.
About purchases on the App Store: when you buy, Apple receives an identifier of your Shima account, without your name or email (appAccountToken), to link the purchase to your account.
Transfers to providers outside the European Union rely on the Standard Contractual Clauses approved by the European Commission.
WHERE YOUR MEMORIES LIVE
Photos, videos and audio live on servers in Western Europe (Cloudflare R2). The database and accounts live in the European Union (Supabase, Ireland). Everything is encrypted while travelling from your phone and while stored on disk.
THE VAULT
Hidden spaces add protections inside the app: they do not appear in your list, they open with your fingerprint or PIN, they cannot be shared outside, exported or printed, and the system blocks screenshots while you are inside.
We want to be precise: a vault does not have end-to-end encryption. Your files are stored encrypted like all the others, but technically we could access them. We do not, and we have no reason to — but we would rather tell you than let it sound like something it is not.
WHO YOUR CONTENT IS SHARED WITH
Only with the people you invite to each space. Nobody else.
If you share a photo with a link, anyone holding that link can see it even without using Shima. You can revoke it whenever you want. What is in a vault can never be shared that way.
HOW LONG WE KEEP IT
As long as you have an account.
When you delete something it goes to the bin for 10 days and is then removed for real, storage included.
The preview pages of a book are kept for a week, so they do not have to be drawn again if you look at them again, and are then deleted automatically.
When you ask to delete your account, you have ten days to change your mind: just sign in again. After those ten days, your profile, your voice notes, your files and the spaces of yours that nobody else used are deleted. The spaces of yours that you shared with someone are not deleted: they pass, with everything inside — your photos and day notes included — to the person who has been in them longest, because they are their memories too; the new owner can remove whatever they want. What you uploaded to other people's spaces stays, for the same reason. PDF books are deleted with your account. The exception is the PDF of a printed book that is still on its way or arrived less than 30 days ago: it is kept until those 30 days have passed, in case it arrives damaged, and is then deleted automatically. Of each book order we keep only what accounting requires: what was bought, when, how much was paid and to which country, province and postcode it was sent; no photos, no PDF, and no name, address, phone or email.
Invoices are kept for as long as Spanish tax law requires.
YOUR RIGHTS
You can access your data, correct it, take it with you, delete it, restrict how we use it and object to our using it.
Inside the app, under Your account, there are "Export my photos" and "Delete my account", which do exactly that without asking us. You can also request deletion from our website without opening the app, or write to hola@shimaapp.com. We answer within a month at most, usually sooner.
If you think we have not done our job properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
CONTENT THAT SHOULD NOT BE THERE
If you believe someone has uploaded content to Shima that infringes your rights, write to hola@shimaapp.com with the link or details needed to find it. We review it and act as soon as we can.
MINORS
Shima is not intended for children under 14, the age at which data processing can be consented to in Spain. If you are between 14 and 18 you may use it, but we suggest talking it over with your parents or guardians.
We do not ask for your age when you register. If we learn that an account belongs to someone under 14, we delete it.
CHANGES TO THIS POLICY
If we change anything important, we tell you inside the app before it takes effect. The date at the top says when it was last updated.
The Spanish version is the only one with legal value. Translations are offered to aid understanding.