Privacy Policy
This Privacy Policy describes how Unity Cosmos (“we”, “the hub”) handles personal data when you use unitycosmos.com and the unified access to the worlds of the universe (Equity Cosmos, Night Sky Diary, Roomie Homie, Grey Senior, Not Hooked, Cosmos Brain Power, ritmorbit and future worlds). It complements, not replaces, the specific policies of each world when they process data of their own service.
1. Data controller
The data controller for the Unity Cosmos hub is Jose Segura Combariza, operating Unity Cosmos / Equity Cosmos (software product family). Privacy contact: [email protected]. General support: [email protected]. Full tax ID and address are in the Legal Notice (/aviso-legal) or provided upon request to [email protected].
Each world (e.g. Roomie Homie or Equity Cosmos) may act as an independent controller for data it collects within its own app. In that case its policy and contact channels apply.
2. Scope of this policy
- Hub website: unitycosmos.com (landing, login, dashboard, embedded iframes).
- Single universe session (SSO) and shared cookie/privacy consent across worlds opened from the hub.
- Does not describe in detail the processing of portfolios (Equity), journals (Night Sky), shared homes (Roomie), health data (Grey Senior) or recovery data (Not Hooked): see each world’s policy.
3. Data we process in the hub
3.1 Account and identity data
When you sign in to Unity Cosmos (e.g. Google or Apple), we may process:
- Name or display name
- Email address (Apple may use a “Hide My Email” alias)
- Provider identifier (Google/Apple subject)
- Sign-in provider and sign-in timestamp
- Plan or universe app scope associated with your session
We do not receive or store your Google or Apple password. Authentication is performed by the provider under its own policies.
3.2 Technical data
- IP address, browser/device type, language and approximate timezone
- Server logs (URL, response code, timestamp) for security and stability
- Session identifiers in cookies and/or local storage (see Cookie Policy)
3.3 Data we don’t process in the hub
The hub is not designed to store the internal content of each world (e.g. journal entries, finances or medication). That content is managed by each world in its own infrastructure.
3.4 Apple Health and watch data (optional, iOS app)
If in a Unity Cosmos iOS app you connect Apple Health (e.g. Profile → Watch & health), we read — read-only, we never write — data that your watch or its app (Apple Watch, Garmin, Fitbit, etc.) saved to Apple Health (steps, distance, heart rate, sleep or other types you authorize). We use it only to show you context in worlds like Night Sky Diary, Grey Senior or Not Hooked. We do not use it for advertising. You can revoke access in iOS Settings → Health; deleting your account removes associated data on our servers.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and maintain your Unity Cosmos session and SSO across worlds | Contract performance / pre-contractual measures (Art. 6(1)(b)) and, where applicable, legitimate interest in security (Art. 6(1)(f)) |
| Remember your hub cookie/privacy consent | Legal obligation / consent (Arts. 6(1)(c) and 6(1)(a)) |
| Show the dashboard and open embedded or linked worlds | Contract performance (Art. 6(1)(b)) |
| Security, abuse prevention and technical debugging | Legitimate interest (Art. 6(1)(f)) |
| Respond to support or rights requests | Legal obligation / contract performance (Arts. 6(1)(c) and 6(1)(b)) |
6. Recipients and processors
- Infrastructure providers (VPS hosting, CDN, TLS certificates) to operate unitycosmos.com.
- Stripe, Inc. — Unity Cosmos subscription payment processing (billing data and subscription status; we do not store full card numbers on our servers).
- Google LLC — Google Analytics 4 (only after accepting cookies in the banner; see Cookie Policy).
- Identity providers (Google, Apple) when you choose to sign in with them.
- Universe worlds: when you open a world from the hub we may transmit a universe token/session (e.g. via postMessage or single-use URL parameter) so you don’t have to log in again. Each world applies its own policy to data it generates.
We do not sell personal data. We do not share data with third-party advertisers in the hub.
7. International transfers
Our hub servers are hosted preferably in the EU (e.g. infrastructure in Germany). If you use Google or Apple, or if a world operates outside the EEA (e.g. Firebase services), those providers may process data in other countries. In that case their mechanisms apply (standard contractual clauses, Privacy Framework or others).
8. Retention
- Universe session (cookie/localStorage): up to 7 days or until you sign out / clear site data.
- Consent record: while the policy version is in force or until you withdraw it by clearing local storage or contacting us.
- Technical logs: the minimum time necessary for security (usually weeks), except incident investigations.
9. Your rights
If the GDPR or other applicable rules grant you rights, you may request:
- Access to your personal data
- Rectification of inaccurate data
- Erasure (“right to be forgotten”), where applicable
- Restriction of or objection to processing
- Portability, where applicable
- Withdraw consent without affecting the lawfulness of prior processing
- Lodge a complaint with your supervisory authority (in Spain: AEPD, aepd.es)
To exercise rights: [email protected]. We may ask for reasonable identity verification. Rights over data of a single world only (e.g. Roomie) should be directed to that world’s contact.
10. Minors
Unity Cosmos is not directed at children under 16 (or your country’s minimum digital age). If you are a parent or guardian and believe a minor has provided us data, contact us to delete it.
11. Security
We apply reasonable technical and organizational measures: HTTPS, server access control, SameSite cookies where applicable, and data minimization in the hub. No system is 100% secure; please do not share links with open session parameters.
12. California residents (CCPA/CPRA) and other regions
We do not sell or share personal data for cross-context behavioral advertising within the meaning of CCPA/CPRA. You may request to know or delete the personal information we process in the hub by contacting [email protected].
13. Changes
We may update this policy. The “Last updated” date indicates the current version. If the change is material, we will reflect it in the hub and, where appropriate, ask for new consent.
14. Account, subscription and deletion
You can sign out at any time from the hub. To delete your account and associated data in Equity Cosmos (including the linked Stripe subscription), sign in to equitycosmos.com → account menu → Delete account (POST /api/user/delete with confirmation). For other worlds, use that world’s privacy contact or write to [email protected] and we’ll point you to the right channel.
To cancel renewal of the Unity Cosmos subscription, use the Stripe customer portal (link in the receipt email) or contact [email protected].
15. Contact
Privacy: [email protected]. Support: [email protected]. Site: https://unitycosmos.com