Last updated: 4 November 2026

This policy covers Archison’s Body Mind Soul web app (“BMS”), served at archison.com/bms .

BMS works fully without an account: your records then stay on your device and I receive nothing. If you choose to sign in with Google, your progress is also stored on a server I run, so it can sync between your devices and so you can use friends and groups. BMS has no analytics, no advertising and no tracking cookies.

Without an account#

Everything you log is saved in your browser’s own storage on your device: your activities, logs, notes, mood and energy check-ins, books and quotes, settings and badges, plus your language and timer preferences. Clearing the site’s data in your browser, or using “Erase data” in Settings, removes it.

The app also keeps the app files in a cache so it can open offline. If you pick a profile photo or icon in Settings, it is stored on your device only (it is shrunk to a small square in your browser). It is never uploaded: friends see your Google picture, or an initial, and only if you turn on “show my picture”.

Without an account no cookie is set and nothing is sent to my server.

With a Google account#

You sign in with Google. Google handles your password and checks who you are; I never see your password. My server receives a signed token from Google and keeps:

  • your Google account identifier, your email address, your name and the URL of your Google profile picture
  • the dates you first signed in and last signed in
  • the display name you chose, and your two sharing choices (show my picture, share my rings)

Once you are signed in, your progress is copied to my server so it can sync between devices. That is the same data described above: activity logs, mood and energy check-ins, notes, books, quotes, settings and badges. It is stored as it is on your device (not scrambled so that I cannot read it). I do not read it, sell it or use it for anything else.

Your email is used to identify your account. It is never shown to other people.

Rings, friends, groups and cheers#

BMS has three daily rings: body, mind and soul. For friends and groups, the app publishes a small daily summary: for each of the last few days, which of the three rings you kept, closed or doubled. Not what you did, not how long, not your notes, not your check-ins.

  • Share my rings is a setting in Settings. For new accounts it starts OFF. While it is off, other people cannot see your rings. If you turn it off, your older ring history is deleted from the server right away; only today and yesterday stay (private to you), because the evening reminder needs them.
  • Friends see your display name, your picture only if “show my picture” is on, and (if you share rings) your rings for the last 30 days. You become friends by sharing an invite link and the other person accepting it. Either of you can remove the friendship at any time.
  • Groups show a weekly and a monthly leaderboard to the members: display name, picture (only if it is on) and two counts: days kept and perfect days. Hours, reps and pages never appear. You are only on the leaderboard if you share rings. You can leave a group at any time. Only the group’s owner can create the group’s invite link, revoke it, and remove members.
  • Cheers are an emoji a friend or group member can send you after you have closed a ring that day, and only if you share rings. The server keeps the sender, recipient, day and emoji. A cheer also sends you a push notification showing the sender’s display name, unless you have switched cheer notifications off in Settings. The cheer itself is still recorded and visible in the app.
  • Your display name defaults to the first name on your Google account. You can change it in Settings.

Your mood and energy check-ins, notes, quotes, books and activity logs are never shown to friends or group members. Nothing in the friends, groups or cheers features reads them.

Reminders and notifications#

Notifications are optional. If you turn them on, your browser creates a push subscription and BMS sends it to my server. It holds a web address that belongs to your browser’s push service, two encryption keys and your app language. You can have up to five devices subscribed. I also store your reminder schedule: the time, your time zone, the days of the week and whether each reminder is on.

A small job runs on my server every 15 minutes and sends a notification when one is due. There are three kinds: a daily reminder, an evening nudge (only if one of your rings is still open) and a cheer from a friend. Messages are encrypted before they leave my server, and the text you see is built on your device. They travel through your browser’s push service: Google (Firebase Cloud Messaging) for Chrome and Android, Mozilla for Firefox, Apple for Safari and the Home Screen app on iPhone, or Microsoft for Edge. Those services see that a message was delivered to your browser, but cannot read it. Subscriptions that stop working are removed automatically.

You can turn notifications off in Settings, or block them in your browser, at any time.

Cookies#

BMS sets one cookie, and only after you sign in: a session cookie called bms_sid. It keeps you signed in, lasts 30 days, only works on the BMS pages, and is HTTP-only, secure and same-site. It is deleted when you sign out. There are no analytics, advertising or tracking cookies.

BMS also stores things in your browser’s local storage (your data, your preferences, your picture and a copy of your last friends list). These stay on your device and are not cookies.

Other services BMS talks to#

  • Google. Signing in loads Google’s sign-in script from Google when a screen offering sign-in is shown, and Google’s own privacy policy applies to that: policies.google.com/privacy . If you show your picture to friends, their browsers load it from Google’s servers.
  • Open Library (Internet Archive). When you search for a book to add, your browser sends what you typed straight to openlibrary.org, and book covers are requested from covers.openlibrary.org. They see your IP address and your search, as any website would. I do not receive these requests. This works with or without an account. BMS only stores the book’s title, author, page count, and the Open Library ID and cover ID. See the Internet Archive privacy policy .
  • Push services, as described above.
  • Hosting. BMS runs on shared hosting from Bluehost, whose servers are in the United States. If you are in the EU or UK, signing in therefore means your data is transferred to the US. Like most web servers, the host keeps standard server logs of requests (usually including IP addresses), which I do not control.
  • Abuse protection. To limit sign-in attempts, the server counts attempts per IP address. It does not store the address itself, only a shortened hash of it, made with a secret key that stays on the server, next to a counter for a 10-minute window. Those counters are deleted automatically within about two days. I still treat them as personal data. The same kind of counter is used by a public “is the server up” check, which stores nothing else. Apart from that, the BMS code does not record IP addresses.

The fonts are bundled with the app, so no font service is contacted. This policy page is part of archison.com, which counts page views with GoatCounter, a cookieless counter that stores no personal data. That counter is not in the BMS app.

How long I keep things#

  • Your account and progress: until you delete them (see below).
  • Ring history on the server: older than 45 days is deleted automatically.
  • Cheers: deleted after 60 days.
  • Expired invite links: deleted a week after they expire.
  • Rate-limit counters (they count requests per account or per hashed IP, to prevent abuse): deleted automatically after about two days.
  • Notification subscriptions: removed when the push service says they are gone, after repeated permanent failures, or when one that used to work has not delivered anything for 60 days.
  • Backups: the newest 14 daily copies (about two weeks).
  • Your session on the server: up to 30 days, or until you sign out.
  • Host server logs: whatever the host keeps.

Your data: export, erase, delete#

  • Download my data is a button in Settings that gives you a JSON file. Signed in, it contains your account details (name, email, display name, picture URL, your sharing and notification settings and when the account was created), all your synced progress, the display names of your friends, your groups and whether you own them, your reminder schedule, and how many devices have notifications on. Signed out, it contains what is stored on this device.
  • Erase data in Settings deletes all your progress (logs, check-ins, notes, books, quotes, settings and badges, and your ring history) on the server and on this device. Your account stays, along with your profile, friends, groups, reminders and notification subscriptions. If you use several devices, they are wiped the next time they sync.
  • Delete account in Settings deletes your account and everything the server holds about you: profile, progress, rings, friendships, cheers sent and received, reminders, notification subscriptions and your group memberships. If you leave a group you own, or delete your account while you own one, ownership passes to the member who has been in it longest, and the group is deleted when nobody else is left.
  • Sign out ends your session. You can also choose to wipe this device’s local data.

Backups. Every day a copy of the whole database is saved on the host, in a private folder on the server, and the newest 14 are kept. They contain everything the server holds, so when you delete your account or erase your data it disappears from the backups as they rotate out, within about 14 days. Records on your device can be cleared in Settings or by clearing the site’s data in your browser. Data that was sent to Google, Open Library or a push service is theirs to handle, under their own policies.

Your rights (EU and UK users, GDPR)#

The controller of your personal data is Archison (contact: lluisfelip87@gmail.com ).

I process your data on these grounds:

  • To provide the service you ask for (GDPR Art. 6(1)(b)): your account, sync, friends, groups, cheers and reminders.
  • Your consent (Art. 6(1)(a)): notifications, and the mood and energy check-ins. Mood and energy can be considered health-related, so I treat them as sensitive. They are only stored if you enter them, they stay in your own account, and they are never shown to friends or groups. You can withdraw consent by turning notifications off, by not logging check-ins, or by deleting them (or the whole account).

You have the right to access your data, correct it, have it erased, receive a portable copy, object to its processing, and withdraw consent at any time. Most of this you can do yourself in Settings (Download my data, Erase data, Delete account). For anything else, email me. You also have the right to complain to a supervisory authority; in Spain that is the AEPD (aepd.es ), or the authority of your own country.

Children#

BMS is not directed at children and I do not knowingly collect personal information from anyone under 14, which is the age threshold in Spain. To sign in you need a Google account, and Google has its own age rules for those. If you believe a child has an account, email me and I will delete it.

BMS and this page link to Google, Open Library and archison.com. Those sites are not operated by me and have their own privacy policies.

Changes#

If this policy changes, the date above changes with it.

Contact#

Questions about this policy: lluisfelip87@gmail.com