Cittadella Privacy Policy

Last updated: October 16, 2026 Contact: support@cittadella.app

Who we are

Data Controller

Geometry Lab L.L.C-FZ, Licence No. 2651608.01 · Formation No. 2651608, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates.

EU Representative (Art 27 GDPR)

Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria.

UK Representative (Art 27 UK GDPR)

Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom.

You can exercise your rights through the Prighter portal, by writing to support@cittadella.app or to privacy@geometryapps.com. The list of Geometry's apps is at geometryapps.com.

In short

• Cittadella is an app for practicing Stoic philosophy in English and Italian: the passage of the day, the morning preparation, the evening review, guided paths, the library and a journal.
• Your journal stays on your device. It reaches our server only if you sign in with an account and choose to sync it, and there it is stored encrypted.
• What you write in your journal can be about your state of mind or your health. That is why we send it to an artificial intelligence provider only when you ask for it, with Ask the Stoics or Your week, and only after your explicit consent.
• The answers in Ask the Stoics and Your week are written by an OpenAI model through our server. OpenAI does not receive your name, your email or your account and, under its terms, does not use this data to train its models. Our server does not keep your text. It keeps the answer, encrypted, for at most 10 minutes, so that a request the app repeats receives the same answer, and then deletes it.
• You can use Cittadella without an account. Cittadella has no advertising, we do not sell your data and we do not track you across other companies' apps or websites.
• Cittadella is not a medical or psychological service. If you are in a crisis, call your local emergency number or find a helpline in your country at findahelpline.com.
• Cittadella is for people aged 14 and over.

What stays on your device

Cittadella saves this information in the app's private storage on your iPhone or iPad (and on your Android phone, once Cittadella is available there):

• your journal: the morning preparations, the evening reviews, the path reflections and your notes, each with its date;
• the Ask the Stoics answers and the Your week reflections you save to your journal;
• your progress: the days you practiced, the paths and the days you completed, your bookmarks and your reading position in the library;
• your settings: reminder times, text size and typeface for reading, light or dark appearance;
• the answers you give at the start (what brings you here, how well you know Stoicism), which are used to suggest passages and paths. The usage statistics receive only how many answers you chose about what brings you here, never which ones;
• the count of your free Ask the Stoics questions, and your choices about consent for artificial intelligence and about usage statistics;
• a random installation identifier, saved in the device keychain, which is used to count free questions and remains even if you delete and reinstall the app.

The library texts are included in the app and work offline. The widget shows the passage of the day by reading it from the app, on the device. Like other app data, Cittadella's data can be included in the device backups you make with iCloud, with Google or on a computer.

Cittadella asks to send notifications for the reminders you turn on and, when you start a free trial, for a reminder before the trial ends. It asks for the microphone only when you tap to answer by voice: the speech recognition built into your iPhone or iPad turns your voice into text on the device, and Cittadella neither records nor sends the audio. It asks for add-only access to Photos only to save what you choose to share. It does not ask for your location, your contacts, your camera, data from the Health app or the advertising identifier (IDFA). It does not ask for your date of birth.

The journal and sensitive data

What you write in your journal can reveal information about your health, for example anxiety, sadness or grief, or about your beliefs. Under the European data protection regulation (GDPR), this can be a special category of personal data (Art. 9). That is why:

• your journal stays on your device unless you choose to sync it;
• we keep a copy of your journal on the server only if you sign in with an account and give your explicit consent to journal sync;
• we send the text of your journal, or the situation you describe, to the artificial intelligence provider only when you use Ask the Stoics or Your week, and only after your explicit consent;
• we do not use your journal for statistics, for advertising or to train artificial intelligence models, and we do not sell it;
• Cittadella does not diagnose, does not measure your mood and does not give you scores.

You can withdraw each consent at any time in Settings. Withdrawing it does not delete what you have already written on your device and does not take away the app's other features.

Ask the Stoics and Your week

These are the two features that send what you write to an artificial intelligence provider. Before you use them for the first time, the app explains what is sent and asks for your consent.

Ask the Stoics. When you ask a question, the app sends the text you wrote (at most 2,000 characters) and, if you choose to include them, some recent entries from your journal to Cittadella's server (api.cittadella.app, on Cloudflare). The server picks the passages from Cittadella's texts that are closest to your situation and sends your text and those passages to an OpenAI artificial intelligence model through its API. OpenAI returns an answer in the app's language that quotes some of those passages and suggests an exercise. The server checks that every quoted passage exists in Cittadella's texts and shows it with the text of Cittadella's translation, not with generated words.

Your week. With Cittadella Pro, the app sends the week's journal entries to the server. The server sends them to the same OpenAI model, which returns the themes that keep coming back, what changed and a passage to carry into the next week.

In both cases:

• OpenAI does not receive your name, your email, your account or device identifiers. The request goes out with response storage turned off. Under its terms, OpenAI does not use data sent through its API to train its models, and it may keep that data for a limited period to monitor abuse.
• Our server does not save the text you send, and it does not write your text or the answer to its technical logs. It keeps the answer, encrypted, for at most 10 minutes, so that if the app sends the same request again, for example after a dropped connection, it receives the same answer; then it deletes it. If you save the answer to your journal, it stays on your device and, if you sync your journal, in the synced copy.
• If what you write seems to be about a danger to you or to others, Cittadella does not write an answer: it points you to your local emergency number and to findahelpline.com. This request does not count toward your limits.
• The answers are generated by an artificial intelligence system, they are Cittadella's words and not the philosophers', and they can contain mistakes. They are not medical, psychological or any other kind of advice.
• Cittadella does not make automated decisions that produce legal or similar effects on you.

Reporting an answer

If you report an Ask the Stoics or Your week answer because it is wrong or offensive, the app sends the reason, the text of the reported answer and the note you write, if any, to the server. The report is linked to a cryptographic hash that identifies your device and, if you are signed in, to your account. Your question and your journal are not sent with the report. We use reports to check and fix the service. If you delete your account, the report remains, but without the link to your account.

Plan limits and security

Every request to Ask the Stoics or Your week carries:

• an app integrity check: Apple's App Attest on iPhone and iPad, Google's Play Integrity on Android, which shows that the request comes from the Cittadella app;
• the random installation identifier;
• your account token, if you are signed in;
• if you are not signed in, the anonymous RevenueCat identifier described below, to recognize a Pro subscription.

The server keeps count of the questions of each week (and of each day with Pro) and of the Your week reflections. The device counters use a cryptographic hash of the verification key and of the installation identifier, not the original values, and they are not linked to your account. If you are signed in, there is also a counter for your account. That is why deleting the app or your account does not reset the week's free question.

Your IP address is used to limit the number of requests and to protect the service: it is not saved with your data. The server's technical logs contain codes and counts, not your texts.

Voice videos

When you create a voice video, the app asks Cittadella's server to read the passage aloud. The first time a passage is requested, the server sends its text to OpenAI, which reads it in a voice generated by artificial intelligence and returns the timing of each word, for the captions; then the server keeps the reading and reuses it for anyone who asks for the same passage. The reading holds only the audio and the timing of the words. OpenAI receives only the text of the passage and the audio of its reading, never what you write, your account or device identifiers.

The request carries the app integrity check, the random installation identifier and your account token or, if you are not signed in, the anonymous RevenueCat identifier, to recognize Pro. To protect the service, the server accepts at most 30 readings a day from a device without Pro.

Account (optional) and sync

You can use Cittadella without an account. An account saves a copy of your data, lets you find it on another device and lets you use the same subscription on iPhone and Android. If you sign in with Apple, with Google or with a code by email, we process:

• a random identifier for your Cittadella account;
• the identifier that Apple or Google gives us and your email address, if the service provides it (with Apple, it can be an anonymous relay address);
• the sign-in methods you link and your session data (we store the session data only as cryptographic hashes);
• for Sign in with Apple, an encrypted token that lets us revoke access when you delete your account;
• the expiration date of Cittadella Pro, if you subscribe.

The email sign-in code has 6 digits, is valid for 10 minutes and is sent by Resend. On the server, the code is stored only as a cryptographic hash. Accounts are never merged just because they have the same email. You can add or remove sign-in methods in Settings, as long as at least one remains.

When you are signed in, the server saves in your account a copy of your path progress, your bookmarks, your reading position and your settings (including the answers you gave at the start about what brings you here) and, only with your explicit consent, of your journal. All these copies are stored encrypted. The keys are managed by our server, so this is not end-to-end encryption: the encryption protects the stored copies, and we use the content only to return it to your devices. When you delete an entry, only a marker without content remains on the server, so that your other devices delete it too.

The server database is on Cloudflare; we have asked Cloudflare to place it in Western Europe. If you sign out, the data stays on the device and the copy stays in your account. If you turn off journal sync, we delete the copies of your journal entries from the server; the journal stays on your device. If you delete all data from a device, the app also signs out of your account; the copy in your account remains until you delete the account.

Notifications

If you turn them on, Cittadella sends you a reminder in the morning and one in the evening, at the times you choose, for the morning preparation and the evening review. During a free trial that will renew, it also sends a reminder before the trial ends. Notifications are scheduled on the device: the server sends no notifications and receives no notification token.

Subscriptions

Payment for Cittadella Pro is handled by Apple on the App Store and by Google on Google Play (and by Samsung on the Galaxy Store, once the app is available there). RevenueCat receives purchase and subscription information from the store, linked to an anonymous RevenueCat identifier, to unlock and restore Pro. If you sign in, that identifier is linked to your Cittadella account. If you are not signed in, the app sends the anonymous identifier to our server, which asks RevenueCat whether Pro is active and keeps the answer for at most one day, storing the identifier only as a cryptographic hash. The server also receives subscription events from RevenueCat (event type and expiration date) linked to your account. We never receive your card number or the password of your Apple or Google account.

Usage statistics and diagnostics

The app contains no third-party analytics or advertising software (such as the PostHog, Firebase, Amplitude, Mixpanel or Segment SDKs, or attribution tools). It sends fixed events without content to our statistics server (e.cittadella.app), which forwards them to PostHog Cloud EU. The events describe the screens you open and the actions you take, with fixed values: for example "morning practice completed", the day reached in a path, the library passage opened, saved or shared (passages on sensitive topics are labeled only as "sensitive"), the type of app chosen for sharing (for example WhatsApp), "Ask the Stoics answer received", how well you know Stoicism according to the answer you give at the start. Measurements travel in ranges, not as exact values: the length of what you write (for example "between 50 and 199 characters"), the number of entries, results or passages read, waiting times and durations. The events also carry the context of the app and the device: app and system version, device model, language, light or dark appearance, text size, reduced motion, whether notifications and the widget are on, whether you have Pro and whether you are signed in (yes or no), how long ago you installed the app (in ranges). When you start a trial or a subscription, the event reports the plan, the price and the currency. The events never contain your journal, your questions, the answers, the text of your searches, the answers you give at the start about what brings you here, your email or your account identifier.

The app decides on the device, before sending any event:

• in Germany and Austria, and on devices whose region is unknown, statistics start only if you choose Allow;
• in other regions, Italy included, statistics are on and you can turn them off in Settings, under Privacy and data. When you turn them off, the events stop and the app deletes the statistics identifier and any pending events.

The statistics server then applies one of two rules:

• for the European Economic Area, the United Kingdom, Switzerland and unknown regions, each event gets its own random identifier, the IP address and the country are not forwarded and no profile is created: the events cannot be linked to each other. Only the name of the event, its fixed labels, the app version, the device type and the language remain; the rest of the context, the durations and the personal counts are removed, and the events about purchases and subscriptions are not forwarded;
• for other countries, the app creates a random identifier dedicated to statistics after the server confirms this rule. It is not your name, your email, your account or the IDFA. The events of a single app session also carry a random session identifier, different each time you open the app.

Apple's crash and performance reports (MetricKit: the number of crashes, hangs and exceptions, with the app and system version) are always on and carry no identifiers. When an action fails, the app can send a fixed report (screen, action, error code, versions, whether you were signed in), with no free text and no identifiers. These reports are kept for up to 90 days.

Ad measurement without tracking. When you complete certain steps (the end of the introduction, your first practice, the start of a trial or a purchase, an evening review if you have also started a trial), the app can update a numeric value of SKAdNetwork, an Apple system. If you installed Cittadella after seeing an ad, Apple tells the ad network only that value, without any identifier of yours or of your device. Cittadella does not use the IDFA, does not show Apple's tracking prompt and contains no third-party attribution tools.

Why we process data

• To provide the service you ask for (Art. 6(1)(b) GDPR): account, sync of progress, bookmarks and settings, subscription, support, export and deletion.
• With your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR): the copy of your journal on the server when you sync it, and sending your situation and your journal to the artificial intelligence provider for Ask the Stoics and Your week. You can withdraw it at any time; withdrawing it does not affect the lawfulness of the processing carried out before you withdrew it.
• For our legitimate interest (Art. 6(1)(f) GDPR): security, abuse prevention, the limits of the free plan and fair use of Pro, stability of the service, handling reports, statistics without content outside Germany and Austria, crash reports, ad measurement without identifiers. For these purposes we use only data without content and, in the European Economic Area, no identifiers that link events to a person. You can object at any time.
• With your consent (Art. 6(1)(a) GDPR): usage statistics in Germany and Austria.
• For legal obligations (Art. 6(1)(c) GDPR).

Providers and international transfers

Cittadella uses these providers:

• Cloudflare: servers, database, backup storage, statistics, website and support email;
• OpenAI: Ask the Stoics answers, Your week reflections and the reading of passages in voice videos;
• PostHog Cloud EU: usage statistics and diagnostics;
• Apple: App Store, Sign in with Apple, App Attest, MetricKit, SKAdNetwork;
• Google: Sign in with Google, if you choose it; Google Play and Play Integrity on Android;
• Samsung: Galaxy Store, once the app is available there;
• RevenueCat: subscription management;
• Resend: sending the emails with the sign-in code;
• Slack: internal notifications about support and about how the service is running.

Processing can take place in the European Union, the United Kingdom, Switzerland, the United Arab Emirates, the United States and the other countries named in each provider's list of subprocessors. Where the European or UK rules on transfers apply, we rely on the providers' standard contractual clauses or UK transfer agreements, together with data minimization, encryption in transit and access control.

How long we keep data

• On the device: until you delete the data or the app.
• Text sent to Ask the Stoics or Your week, and its answer: our server does not keep the text after the answer, and it keeps the answer, encrypted, for at most 10 minutes, for a request the app repeats. OpenAI may keep them under its terms, for a limited period.
• Plan counters: weekly ones for 26 weeks, the daily Pro ones for 3 days.
• Pro check without an account: at most one day.
• Email sign-in codes: 10 minutes. Sessions: 1 hour for the access token, 30 days for the refresh token.
• Account and synced data, journal included: as long as the account exists, or until you withdraw your consent to journal sync.
• Daily database backups: about 35 days.
• Deletion log: the random identifier of the deleted account and the date, kept for 90 days after the deletion is complete, as proof and to prevent data from reaching a deleted account.
• Error reports: up to 90 days.
• Answer reports: 24 months; after the account is deleted, they remain without a link to the account.
• Device verification key: 12 months after its last use.
• Statistics: events from the European Economic Area cannot be linked to you; the others follow the retention settings of the PostHog project.
• Purchases: the data held by Apple, Google, Samsung and RevenueCat follows their retention obligations.

Exporting and deleting your data

• Export: in Settings you can export your journal and your progress to a file. To also get the data of your account (email, sign-in methods, counters), write to support@cittadella.app.
• Delete a journal entry: you delete it from the device and, if you sync your journal, from the synced copy too.
• Delete the data on a device: in Settings you can delete all of Cittadella's data from that device. If you have an account, the copy in your account remains.
• Delete your account: in Settings, at the bottom, tap Delete account. We delete your account, your journal and your other synced data, your settings, your sign-in methods, your account's counters, the subscription events and your sign-in sessions, and we revoke Sign in with Apple if you used it. The app also deletes the data on that device: if you want to keep it, export it first. Device counters are not linked to your account and remain until they expire. The reports you sent remain without the link to your account. Backups that contain the account expire within about 35 days.
• Without the app: write to support@cittadella.app from your account's email address, with the subject "Delete my Cittadella account". Before deleting, we check that the account is yours. The full instructions are at cittadella.app/delete-account.

Deleting your account does not cancel Cittadella Pro. To stop paying, cancel the subscription in your Apple Account settings or in Google Play.

Your rights

You can ask to access your data, correct it, delete it, restrict its processing, receive it in a machine-readable format (portability), object to processing and withdraw your consent at any time. You can also file a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the country where you live.

To exercise your rights, use the Prighter portal or write to support@cittadella.app. Before showing or deleting the data of an account, we verify who is making the request. We reply within one month.

Cittadella does not sell personal data and does not share it for behavioral advertising.

Minimum age

Cittadella is for people aged 14 and over, the age from which a person in Italy can consent to online services on their own (Art. 2-quinquies of the Italian Personal Data Protection Code, Legislative Decree 196/2003). If you are under 14, do not use Cittadella. If a parent tells us that a child under 14 uses Cittadella, we delete the account and the data on the server.

Not a medical service

Cittadella is a practice of reading and reflection. It is not a medical, psychological or emergency service, it does not diagnose and it does not replace a professional. If you are in danger or are thinking of hurting yourself, call your local emergency number or find a helpline in your country at findahelpline.com.

Security

Cittadella uses encrypted connections (TLS), app integrity checks, limits on requests and on spending, authorizations tied to each account, cryptographic hashes for codes and tokens, encryption of the Apple token and of all synced data, and the file protection of the operating system. No measure removes every risk.

Changes to this policy

We update this policy when the processing, the providers or the law change. The date at the top shows when this policy was last updated. If a change concerns your journal or the artificial intelligence features, we will tell you in the app.

Contact

• Support and privacy: support@cittadella.app
• Data protection requests: privacy@geometryapps.com
• Rights portal: app.prighter.com/portal/geometry