Estela Privacy Policy
Last updated: 4 September 2026 (section 13 expanded: the published manifest adds AdMob, Google Play Billing and background-task permissions that were not listed)
Every statement in this policy has been checked against the app’s code; the most recent review is the one dated above. If the code has changed since, what is described here may already fall short.
1. Overview and data controller
Estela (“the app”, “we”) is an Android app for organizing perfume collections. This policy explains how we handle data from app users.
Data controller: Vicente Hernández García, independent developer based in Spain. Contact: privacidad@kalu.health.
2. What stays on your phone
Nearly everything is kept in the app’s private storage:
- your collection: which bottles you own, your notes and your ratings. The original lives here and the app works offline. The app also includes a sync of your collection with our server that is switched off today: while it stays that way, your collection is not uploaded by that route (section 6);
- perfume entries you create yourself. Their content — name, brand, year, whatever you typed — does not leave the phone: not even the sync in section 6 would send that content if it were switched on; the only thing that would leave is the collection line that refers to them;
- the barcodes you link to a perfume, so the scanner recognises them instantly next time. If you link one by hand, that proposal does reach us (section 5);
- searches that returned nothing, plus a few usage counters for the “You might like” section, used to decide whether that section is worth keeping. These are local counts and are never sent anywhere;
- a backup copy the app takes right before importing a file (section 14). It holds the same content as the export — names, brands, ratings and your notes — and is written to the app’s private folder. The three most recent ones are kept; older ones are deleted automatically. No screen in the app restores them: they are a safety net in case an import goes wrong, not an archive for you to manage.
When you delete a perfume from your collection, the app marks it as deleted and stops showing it everywhere, but the entry — with its rating and its note — stays stored on the phone. That is what makes undoing the deletion possible. It leaves the phone with “Delete all my data” (section 15) or when you uninstall the app. If the sync in section 6 were ever switched on, that deletion mark would also travel to our server, where the entry would stay marked as deleted, not removed; that does not happen today, because it is switched off.
Today your collection is on your phone and, if you have it switched on, in Android’s backup (section 10). The app includes a sync of your collection with our server, but it is switched off: while it stays that way, your collection does not leave the phone by that route, and switching it on would require your prior consent. What it would upload, when, and under what conditions is in section 6.
3. What does leave your phone
Five things, and one of them carries your collection: Android’s backup, which takes it to your own Google account.
- the catalog contributions you send yourself (section 5);
- the barcode you scan, when the app does not know which bottle it belongs to (section 7);
- the request for the bottle photos, which are hosted on third-party websites (section 8);
- checking for and downloading catalog updates (section 9);
- Android’s automatic backup, which takes your collection with it — to your own Google account, not to ours (section 10).
There is a sixth route inside the code, and today it is switched off: syncing your collection with our server (section 6). While it stays switched off it sends nothing, and switching it on would require your prior consent. It is listed here, and not removed from this document, because its code ships inside the app you install.
On top of that, advertising in the free version (section 11).
4. There is no account, but there is an anonymous identifier
We never ask for your email, password, name or phone number, and there is nowhere for you to “sign in”.
Even so, the first time the app has something to send — today, only a catalog contribution — it creates an anonymous identity on our server: a random identifier that is stored in the app’s private storage and reused from then on. It contains no name and no email, but it ties together everything that leaves that installation. That is why we do not call it plainly “anonymous”: it is a pseudonym. It lasts as long as the installation does: it is stored alongside the rest of the app’s data, so it disappears when you uninstall the app or tap “Delete all my data” (section 15), and the next clean install creates a different identity that is not tied to the previous one.
That same identifier would also cover your collection if the sync in section 6 were ever switched on. Today it does not, because nothing is sent by that route. We do not write plainly “it is not tied to your collection”, because that would suggest the code makes it impossible, when what exists is a switched-off configuration that could be changed — with your prior consent, and not before this page says so.
Our server is a Supabase project hosted in Ireland (region eu-west-1).
You can have that identity forgotten whenever you want, from Settings → “Delete all my data” (section 15).
5. Catalog contributions
Estela’s catalog has errors and gaps, and the app lets you tell us about them. When you do, that leaves your phone and reaches our server. It happens in two cases, both of them started by you:
a) Reporting an incorrect field on an entry. We send the perfume’s identifier, which field you believe is wrong (notes, year, concentration, perfumer, photo or “other”) and, if you write one, a free-text comment of up to 500 characters.
b) Linking a barcode by hand. If you scan a code the app does not recognise and you tell it which perfume it belongs to, we send that perfume’s identifier and the code. This upload is not announced on screen: the app only tells you it will recognise the code instantly next time. We state it here because you should know.
Each contribution is tied to your anonymous identifier (section 4), and your IP address travels with it, as with any internet request.
What is NOT sent with a contribution: not your collection, not your notes, not your ratings, not the entries you created, and no photo of yours. The app currently does not allow sending photos at all. (Collection sync is a different route, the one in section 6, switched off today; your collection never travels inside a contribution.)
About the free-text comment: you write it, so it can contain anything. We do not filter it automatically, and a person reads it during review. Write only what is needed to understand the error, and do not include personal data about yourself or anyone else.
What we use it for: to review the proposal by hand and, where appropriate, correct the catalog. A contribution is a proposal, not a fact: nothing enters the catalog automatically.
How long we keep it: 12 months from the moment you send it, both for contributions that are accepted and for those that are rejected. Once that period is up, they are deleted.
Legal basis for this processing: your consent (art. 6.1.a GDPR). You fill in the form and tap “send”: that gesture is an unambiguous affirmative act, and without it nothing leaves your phone by this route. You can withdraw your consent whenever you want (section 17); withdrawing it does not undo something already sent, and for us to delete what has already arrived you have to write to us (section 15).
6. Collection sync: included in the app, switched off today
Today your collection is not uploaded to any server of ours. The sync mechanism ships inside the app, but its trigger is disconnected: nothing you do sets it off. While it stays that way, your collection does not leave the phone by this route. So this section does not describe something the app does today: it describes what that mechanism is, what state it is in, and what it would take for it to be switched on. We tell you because its code ships inside the APK you install, and you have a right to know what the app on your phone carries.
What “switched off” means exactly. It is not that the code has been removed: it is still compiled into the app. What does not exist is the path that calls it — no screen, no change to your collection and no app launch invokes it — and on top of that the app still cancels any upload that might have been left waiting for network (section 15). We put it this way, rather than “your collection never leaves the phone”, because the latter would be false: it would describe an APK that is not the one you install.
Do not confuse it with contributions. Catalog contributions (section 5) do leave your phone today, with your consent and when you tap “send”. They are a separate channel, and your collection never travels through it. The sync in this section is the other route, the one that is switched off.
What it would upload if it were ever switched on. For each perfume in your collection: its identifier, the status (own it, want it, tried it, used to own it), your rating, your free-text note, the date you added it and whether you have deleted it. Nothing else: not your searches, not your usage counters, no photo, and not the content of entries you created by hand. As with any internet request, your IP address would travel with it.
Where it would go, and under what name. To the same Supabase server (Ireland, eu-west-1) that receives contributions, and under the same anonymous identifier (section 4). We do not see your name or your email, because we do not have them; under that pseudonym we could see which perfumes are there and what you wrote about them. That is one of the reasons switching it on would require asking you first.
When it would happen. As the code stands today, the upload would fire at two moments:
- every time you changed something in your collection: adding, editing, rating, annotating or deleting;
- when you opened the app or came back to it, and at most once every fifteen minutes.
The upload waits for a connection, so it could complete a while after the change. That behaviour is part of what would have to be decided — and stated here — before switching it on.
When it would not happen, not even while live. These are behaviours of the code, not intentions:
- if you have never added anything to your collection, the server is not contacted and no anonymous identity is created;
- if the app is built without our server’s keys, nothing is sent and nothing is queued;
- when you tap “Delete all my data”, any pending upload is cancelled before anything is wiped. With one honest caveat: if an upload happened to be in flight at that moment, what was already travelling could still arrive;
- and today, with the trigger disconnected, neither of the two moments above produces any upload at all.
What it would be good for, plainly. Since there is no account and no way to sign in, the identifier belongs to each installation: another phone could not read that copy, unless Android restored this installation’s backup onto it (section 10), which carries the identifier along. It would give you nothing practical back; it is the groundwork for a future feature. To move your collection to another phone, what works is the export (section 14) or that same backup.
Deletions. If it were live, deleting a perfume would send the deletion mark, not the disappearance: on the server those entries would stay marked as deleted and keeping their rating and their note. The app has no permission to remove rows there, for the same reason explained in section 15, so taking them out would require a manual deletion on our side.
And in the meantime, where is your collection? On your phone (section 2) and, if you have Android’s backup switched on, in your own Google account (section 10). Apart from any file you export yourself (section 14), those are the only copies today, and neither of them is on a server of ours.
When this was checked. What is described here was checked against the app’s code on the “last updated” date in the header. If a future version reconnects the trigger, this section will say so before it happens, and that date will change with it.
What it would take to switch it on. This is not a promise that it will be: it is the condition for it to be possible. Your prior, explicit consent, a retention period fixed beforehand and not afterwards, this page updated beforehand and not afterwards, and a decision on whether there should be a setting so that you can turn it off yourself. While any of the four is missing, it stays as it is: switched off.
How long we keep it: by this route, nothing, because nothing is received by this route. There is no entry from your collection on our server and none can arrive while the trigger stays disconnected. If it were ever switched on, the period would be fixed and written here before switching it on, not afterwards.
Legal basis for this processing: there is no processing by this route today, so there is no legal basis to declare: sync is switched off and nothing is sent. If it were ever switched on, it would require your prior, explicit consent (art. 6.1.a GDPR) — an affirmative act by you, not a setting that comes pre-enabled — with its retention period fixed beforehand; those are two of the four conditions in the list above.
7. When you scan a barcode
The app first looks the code up on your own phone, against the installed catalog and against any links you saved yourself. If it finds it there, nothing goes out to the internet.
If it does not find it, the app queries the Open Beauty Facts API (world.openbeautyfacts.org), an open, non-profit project run by the same organisation as Open Food Facts. Earlier versions of this policy said “Open Food Facts”: that was the wrong name, and this is the correct third party.
That query sends the scanned code. As with any internet request, that server also sees your IP address and an app identifier in the User-Agent header (“Estela/1.0…”). Your anonymous identifier does not travel with it, and neither does anything from your collection: the scanner and contributions are separate channels.
You should know how often this happens: only around 22% of catalog entries have a barcode associated with them, so in most scans the external query does take place. Open Beauty Facts has its own privacy policy.
8. The bottle photos
The catalog does not store the photos: it stores their address. Of its 8,957 entries, 8,443 point at images hosted on retailer websites and content delivery networks (among others, Shopify’s CDN, Druni, Primor, Zara and Notino).
That means when the app shows you an entry with a photo, your phone requests that image directly from that website. That server sees your IP address and which image you requested — that is, which perfume you are looking at. It also happens on your collection screen: the list of what you own is not sent to them, but the photos of those bottles are requested from outside, one by one.
Images are cached on your phone, so the request happens the first time they are shown, not every time.
We do not control what those websites log, or for how long; each has its own terms. If you would rather avoid it, airplane mode or turning data off makes the app show the coloured background instead of the photo and keep working.
9. Catalog updates
When you open the app, it checks in the background whether a newer catalog exists. The check file and the catalog itself are downloaded from a public Cloudflare R2 bucket.
It is an ordinary download: none of your data, no identifier and nothing from your collection is sent. All the host sees is what is inherent to any request: your IP address and the default User-Agent. Cloudflare sets its own log retention.
10. Android’s backup
Android backs up app data on its own and stores it in the device’s Google account. Estela has this enabled, so if you have device backup switched on, the app’s data file — your collection, your ratings and your notes — is copied to your Google account.
Today it is the only route by which your collection leaves the device, and it goes to your own Google account (the other one, syncing with our server, is switched off: section 6). It is worth being precise about what that does and does not mean:
- It goes to your Google account, not to a server of ours. We do not see it, do not receive it and cannot delete it: you manage it from your device and account settings.
- It does what it looks like it does: if you switch phones or reinstall the app, your collection comes back.
- Two things are deliberately left out: the perfume catalog, which is large and downloads itself again anyway, and the pre-import backup copies described in section 2, because they are personal data that add nothing to a restore and would extend the life of entries you may already have deleted.
- “Delete all my data” (section 15) deletes what is on the phone, not what is already in your Google backup. That is deleted from your account settings.
- If you would rather it did not happen, you can turn off device backup in Android’s settings.
11. Advertising and the “remove ads” purchase
The free version may show ads managed by Google AdMob. AdMob may process device identifiers (such as the Android advertising ID) to serve and measure ads; under the GDPR this is processing of personal data.
- Consent: if you are in the European Economic Area, you will see Google’s consent panel (UMP) before any ads are shown. The legal basis for personalized advertising is your consent (art. 6.1.a GDPR).
- If you decline, the app configures AdMob in non-personalized ads mode, which does not use your advertising ID for profiling. You can change your decision at any time from Settings.
- Google acts under its own terms; see how Google uses advertising data and manage your preferences in your device’s Google Settings.
If you purchase the “remove ads” option (handled by Google Play Billing), no advertising is shown and AdMob is never initialized. Payments are processed entirely by Google Play; we neither receive nor store payment data.
12. Google Play
If you downloaded the app from Google Play, Google may collect usage and diagnostic data under its own terms. Estela does not control or have access to that information.
13. App permissions
The manifest published on Google Play does not only request the permissions we chose ourselves: once the app is built, the advertising library, the in-app purchase library and the background-task library each add their own. We split them so it is clear which ones we requested on purpose and which ones ship with those libraries.
Permissions the app requests itself:
| Permission | Purpose |
|---|---|
CAMERA |
Scanning perfume barcodes |
INTERNET |
Downloading the catalog, showing bottle photos, looking up barcodes and sending your contributions. Collection sync would also use it if it were ever switched on (section 6) |
ACCESS_NETWORK_STATE |
Knowing whether there is a connection, so we can wait for one instead of failing |
Permissions added by third-party libraries:
| Permission | Who adds it | Purpose |
|---|---|---|
com.google.android.gms.permission.AD_ID |
Google AdMob (section 11) | Android’s advertising identifier: used to show and measure ads in the free version |
ACCESS_ADSERVICES_AD_ID |
Google AdMob | Access to Android’s Privacy Sandbox advertising-ID API, the replacement Google is rolling out for the classic AD_ID |
ACCESS_ADSERVICES_ATTRIBUTION |
Google AdMob | Privacy Sandbox ad-attribution API: measures which ad led to which action without relying on a traditional identifier |
ACCESS_ADSERVICES_TOPICS |
Google AdMob | Privacy Sandbox “Topics” API: interest topics computed on your own phone, for ads without an individual profile of you |
com.android.vending.BILLING |
Google Play Billing (sections 11 and 12) | Processing the “remove ads” purchase through Google Play |
WAKE_LOCK |
AndroidX WorkManager, the background-task library used by, among others, the catalog updater (section 9) | Keeps the phone awake just long enough to finish a background task, such as downloading a catalog update |
FOREGROUND_SERVICE |
AndroidX WorkManager, the same library | Lets that background task run as a foreground service if needed, instead of being cut off partway |
None of these seven permissions gives us access to more of your data than this policy already covers: the first four belong to AdMob (section 11), the next one to the Google Play purchase (sections 11 and 12), and the last two are infrastructure so background tasks, such as the catalog update (section 9), do not get cut off partway.
Earlier versions of this table only listed the first three permissions, the ones the app requests itself; the manifest published on Google Play also includes the seven below, added by those libraries. Completed here (revised 4 September 2026).
We do not request access to contacts, location, microphone, or external storage.
14. Data export
You can export your full collection as a JSON file from the Settings screen at any time. The file contains your entries and notes, plus a few aggregate usage counts (no dates, no identifiers). That export is saved to a location of your choice on your device and does not pass through our servers.
When you import a file, the app first saves a copy of your collection with that same content inside its private folder, in case the import goes wrong. The three most recent ones are kept (section 2) and they go with “Delete all my data”.
Sync is not a replacement for the export. It is switched off (section 6) and, even if it were switched on, it would not give you a file you can take with you, nor could it be read from another phone. To move house, this file.
15. Data deletion
From Settings → “Delete all my data”.
What it deletes: your entire collection — including entries you had deleted and that were still stored as deleted (section 2) —, any entries you created, your barcode links, the local usage counters, the pre-import backup copies, and any contributions still waiting to be sent. It still cancels any pending sync before wiping anything, even though sync is switched off today and there should be none left (section 6). And it forgets your anonymous identity: the session is closed and its credential is erased from the phone, so from then on the app cannot prove you are the one who sent anything. This is irreversible.
What it does not delete, and you should know it:
- Contributions that have already been sent to the server. The app has no permission to delete rows there, and that is deliberate: if it did, anyone could empty the review queue. Those rows still exist, but after the deletion they are no longer linked to your identifier.
- Collection entries that sync would upload, if it is ever switched on (section 6). It could not delete those either, for the same reason: the app cannot remove rows on the server. That leaves no residue today, because sync is switched off and there is no entry there. It is written down because the app’s limitation would be the same if sync were ever switched on.
- The image cache. Bottle photos that have already been displayed remain in the phone’s cache, and that is a trace of which entries you have looked at. It goes away when you uninstall the app or clear its cache from Android’s settings.
- Leftovers inside the database file. The deletion empties the tables but does not compact the file, so fragments of already-deleted text — notes, for instance — can remain inside it until that space is reused. They are not visible from the app or from another app: it would take the file itself and access to the device’s private storage.
- Android’s backup (section 10), which is in your Google account and only you can delete it, from your account settings.
If you want your contributions genuinely deleted from the server, write to privacidad@kalu.health telling us what you sent (which entry, roughly when) and we will delete it by hand. That is the route that remains for contributions, which are indeed on the server; for your collection there is nothing to ask for, because it is not uploaded (section 6). Do this before tapping “Delete all my data”: afterwards, the identifier that tied those rows to your phone no longer exists and there will be no way to tell which ones were yours.
16. Who data is shared with
| Who | What they receive | When |
|---|---|---|
Supabase (Ireland, eu-west-1) |
Your contribution, your anonymous identifier and your IP | Only when you send a contribution (section 5) |
Supabase (Ireland, eu-west-1) |
Your collection: each perfume’s status, rating, notes and deletions, with your anonymous identifier and your IP | Does not happen today. The sync that would do it is switched off; if it were ever switched on it would be on every change and every app launch, and it would require your prior consent (section 6) |
| Open Beauty Facts | The scanned code and your IP | Only when the code cannot be resolved on your phone (section 7) |
| Retailer sites and CDNs hosting the photos | Your IP and which image you request | Whenever entries with photos are shown (section 8) |
| Cloudflare (R2) | Your IP and User-Agent |
When checking for or downloading the catalog (section 9) |
| Google (Android backup) | The app’s data file: your collection, your ratings and your notes. It goes to your account, and we do not access it | If you have device backup switched on (section 10) |
| Google AdMob | Advertising identifier and device signals | Free version only, subject to your consent (section 11) |
| Google Play | The “remove ads” payment; download and diagnostic data | When purchasing and installing (sections 11 and 12) |
17. Your rights (GDPR)
You have the right of access, rectification, erasure, objection, restriction of processing, and portability (arts. 15-21 GDPR), and you may withdraw your consent at any time without affecting the lawfulness of prior processing. You can exercise these rights by writing to privacidad@kalu.health.
In practice:
- Your collection, your notes and your ratings are still in your hands from the app itself: you can see them, export them and delete them from the phone whenever you want (sections 14 and 15). Bear in mind that they may not be the only copy: if you have device backup switched on there is another in your Google account (section 10), and only you can delete that one. There is none on our server, because sync is switched off (section 6).
- For contributions that did get sent, write to us: it is the only route, for the reason explained in section 15. For your collection there is nothing to ask for by that route, because it is not uploaded to our server (section 6).
- For advertising, you can withdraw or change your consent from Settings, or remove ads with the purchase.
If you believe your rights have not been properly handled, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).
18. Children
Estela is not directed to children under 13 and does not knowingly collect information from children.
19. Changes to this policy
If we make material changes to this policy, we will notify you via an in-app update or on this page. The “last updated” date at the top of this document reflects the current version.
A change in the app can get ahead of this text. When that happens, this policy will say so in the affected section, with its date, instead of being rewritten as though it had always read that way. That is why section 6 is still here, describing a mechanism the app does not run today but does carry inside: whoever installs the app has a right to know what code ships with it and what it would take — your prior, explicit consent — for it to start running. Something being switched off is not the same as it not existing, and this page does not tell it as though it did not exist.
20. Contact
For any privacy questions, you can reach us at: privacidad@kalu.health