Privacy

What we keep, and what we never touch.

Suaviq asks you to write down the things that went badly. That only works if you trust where it goes, so this page is specific rather than reassuring.

Last updated 26 July 2026

One analytics tool, and it is a counter. Vercel Web Analytics records that a page was opened, roughly where from, and what kind of device — no cookie, no identifier that follows you between sites, and nothing you typed. Its script is served from this domain, not a third party’s. Beyond it there is no Google Analytics, no pixels, no ad network, no session recording and no other third-party script. Fonts are compiled into the site at build time rather than fetched from Google, and every image is served from our own domain.

If you never sign in

Suaviq works fully signed out. In that case everything — your streak, which exercises you have marked done, your notes and your Rejection Room entries — is written to localStorage in your own browser under the key suaviq:v2. It is never transmitted to us. Clearing your browser data deletes it permanently, and we cannot recover it, because we never had it.

If you sign in

Signing in is optional and exists so your progress survives a new device. It creates two records.

Your email address, held by our authentication provider so we can send you a six-digit sign-in code. There is no password to store, and we do not store one.
Your progress, held as a single row against your user ID. It contains your streak, your membership tier, which exercises you have completed, your saved lines, your archetype result, your re-rating scores, and your Rejection Room log.

Be aware of what the last item means. Your Rejection Room log contains free text you wrote about difficult moments — the thought, the distortion you named, and when. That is personal and sometimes raw. It is stored so the 48-hour re-rating can ask you about it again. It is never read for marketing, never sold, never shared, and never used to train any model.

Who else processes it

Supabase — authentication and the database holding the progress row.
Vercel — hosting. Standard server logs include IP address and user agent, kept briefly for security and debugging.
Stripe — payment, and only if you buy something. Your card details go to Stripe and never to us; we hold no card number, and what comes back to this site is a customer reference, whether the payment succeeded, and your email so the receipt reaches you. Stripe is a controller in its own right for the payment itself, which is why it has its own privacy policy.

They are processors acting on our instructions, except where noted above. We do not sell or rent personal data to anyone, and there is no advertising on Suaviq to sell it for.

Cookies

Only what sign-in needs. Your session cookies come from Supabase, plus one small cookie of ours, suaviq_logged_in, which lets a page know you are probably signed in without waiting for a round trip. There are no advertising or analytics cookies, which is why this site has no cookie banner — there is nothing to ask you to consent to beyond the strictly necessary.

Your rights

Suaviq is operated from Spain, so the GDPR applies — and the UK GDPR too if you are in the UK. Either way you have the right to access your data, correct it, export it, restrict how it is used, object to that use, and have it erased. Suaviq is small enough that all of these are handled the same way: email contact@suaviq.com from the address you signed up with. We will respond within one month.

If you think we have handled your data badly, you can complain to us first, and to a supervisory authority regardless. Ours is the Agencia Española de Protección de Datos (AEPD); if you live elsewhere in the EU or in the UK, you may complain to your own national authority instead.

Deleting your account removes the progress row and the authentication record. Signed-out data lives only in your browser, so you delete that yourself by clearing site data.

How long we keep it

Your progress row lives for as long as your account does. Ask us to delete it and it goes, without a grace period or a soft-delete flag. Server logs age out on our host’s standard retention.

Legal basis

We process your email on the basis of performing the service you asked for — there is no account without it. We process your progress on the same basis: syncing it is the entire point of signing in. We do not rely on legitimate interests to do anything you would not expect, and we do not process this data for marketing.

Age

Suaviq is for adults. The exercises involve approaching real people in public, and the material assumes adult judgement about consent and risk. Do not use it if you are under 18.

Where we are, and changes

Suaviq is operated by Pawan Priyadarshi, Barcelona, Spain, who is the data controller for the purposes of the GDPR. Our processors are in the EU and the United States; where data reaches the latter it is covered by the standard contractual clauses those providers publish.

If this policy changes in substance we will update the date at the top of this page; if the change materially affects how your data is used, we will tell signed-in users by email rather than quietly editing the page.

Questions about this page? Write to contact@suaviq.com.