Belong Spain, Privacy Policy
Belong Spain runs on your device. That is true on both phones. What you enter about your residence, your background and your travel stays on your phone. We do not collect it, we cannot see it, and it is never sent to us or to anyone else.
Who we are
Belong Spain is made by Belong Europe ApS, a company registered in Copenhagen, Denmark, CVR number 46649044. You can reach us at hello@belongeurope.com.
What you enter and where it lives
The month you became resident, your permanent residence and marital status, your citizenship background, the trips you log or plan ahead, your language level and CCSE status, the day you filed your application and the updates you log about it, the exam sitting you pick, the details of any second person you add and anything else you enter are stored only on your phone, in the app’s own storage. They are not uploaded, backed up to us, or shared with any third party. If you delete the app, that data goes with it.
The name and the photo you can add for yourself on the You tab are stored the same way: the name in the app’s own storage, the photo scaled down and saved as one file in the app’s private storage on your phone. Neither is uploaded, synced or shared, and removing them, or deleting the app, deletes them.
Your What if scenarios are not stored at all. The sandbox runs on a copy of your situation held in memory while the sheet is open, and it is discarded when you close it.
What we collect
Nothing. Belong Spain has no accounts, no sign-in, no analytics, no advertising, no tracking and no third-party software development kits that collect data about you. We do not know who you are, whether you opened the app today, or what you entered. The one exception is the optional Belong Spain Speak add-on, described below, and only if you add it.
That holds on both phones. Neither the iPhone app nor the Android app has an account: there is nothing to sign in to, nothing to link and no email address for us to hold. The Android app is unlocked by your Google Play subscription, and that question is asked and answered between the app and Google Play on your phone. No server of ours is involved in that decision.
This page, our terms page and belongspain.app are served by Cloudflare, which records anonymous page-load statistics for us without cookies. The app has no part in that and sends nothing about you.
A second person on your phone
On the iPhone and on Android you can add a second adult, such as a partner, on the You tab, and the app keeps a count for them alongside yours. What you enter about them, their name, their answers to the setup questions, the trips logged for them and any filing you record for them, is stored only on your phone, in the same place as your own entries, and is never sent to us or to anyone else. Practice, documents, reminders and, on the iPhone, the copy the widgets read hold your own entries only and never theirs. Removing a person deletes their entries from the phone; deleting the app deletes them with everything else.
News
The News segment, which sits in the Practice tab alongside Practice, Chapters and Progress, shows The Local Spain’s stories, from their public tag feeds at feeds.thelocal.com: the immigration tag and the Spanish citizenship tag. The app requests the two feeds directly from your phone when you open the segment or pull to refresh. The stories are already scoped to immigration and nationality by The Local’s own tags, and your device keeps the recent ones; no server of ours sees any of it. The request itself is an ordinary web request, so The Local’s servers see standard technical information such as your IP address, exactly as they would if you opened their site yourself. We add no identifier to the request, we do not tell The Local who you are, and we receive nothing back about you.
If you turn on news notifications, the check for new stories runs in the background and makes the same request, when the operating system decides to run it. The preference is stored on your device only. Tapping a story opens it in the in-app browser on The Local’s own site, where their privacy policy applies and some articles may require a subscription. Besides this, the app puts only three kinds of request on the network: the App Store or Google Play check on your subscription, the App Store’s own request to show you a rating card (on the iPhone only) and any page you choose to open, which loads from whoever publishes it, in the in-app browser or in your phone’s own browser.
Practice
The CCSE questions in the Practice tab come with the app rather than from a server, and on both phones practising works fully offline.
Your answers, your scores, your mistakes deck, the schedule that decides when a question comes back, your progress through the chapters, your run of days and the sitting date you can add are written to your own device and never sent anywhere. Nothing about how you practise reaches us, and no authority sees any of it.
Opening the Instituto Cervantes’ official material loads it from the Instituto’s own site, in an in-app browser on the iPhone and on Android, and none of your practice history goes with it.
Stage one and your permit
For most people the Path tab has two stages, Long-term residence and Citizenship. What you record on Stage one is stored only on your phone, in the same place as the rest of your entries: the requirements you mark with I meet this, whether you have told the app you hold long-term residence, the day your residence permit ends if you add it and your answer if you tell the app you have no permit that ends. None of it is sent to us or to anyone else, and what you record there for a second person is stored the same way, with their other entries. The requirements, fees and renewal rules shown there ship inside the app, and showing them makes no network request. Opening an official source loads it from the authority’s own site and carries nothing you entered.
The dates worked out from your permit, such as when to apply to renew it, appear in What’s coming. They reach you through the same alerts as the other dates, only if you have turned those alerts on and only for your own permit, never for a second person’s. Like any notification they can appear on your lock screen, and they say that they are about renewing your residence permit. Most of them also give the day it ends.
After you apply
If you tell the app that you have applied, the day you filed, the reference from the authority’s receipt if you choose to enter it, and the updates you log from the authority’s letters, each with its date, its kind and any note you write, are stored only on your phone. None of it is sent to us, and the reference in particular is never transmitted anywhere: the app cannot look your case up and does not try. The link to the authority’s own page opens as an ordinary web request, exactly like any other link in the app, and carries nothing you entered. Removing the filing deletes all of it from the phone.
Exam sittings and guides
The CCSE sittings and registration deadlines shown on the Practice tab, and the guides in the Guides segment, ship inside the app. Showing them makes no network request, and the day each was read from the authority is printed on the card or the guide itself. Which sitting you pick, and which guides you have opened, are settings stored on your phone only.
Passport
The facts on the Passport tab (validity, fee, where to apply, dual nationality and the notes on the Spanish passport’s design) ship with the app and are shown without any network request. If you add your name or a photo on the You tab, the Passport tab displays them; they are the same name and photo described above, and nothing else is collected. Opening the issuing authority’s page loads it from the authority’s own site, in an in-app browser on the iPhone and on Android, and none of your data goes with it.
Documents you attach
On the Path tab you can attach a document to a requirement (a language certificate, a residence permit, a payslip, a test result) with a name and, if you want, an expiry date. The file stays on this phone and we never receive it.
On iPhone, documents are written inside the app’s own storage with iOS file protection switched on, so the system keeps them encrypted and unreadable while your iPhone is locked. The name and the expiry date you give a document are kept alongside it, in the same place. Files up to 15 MB are accepted; anything larger is refused with a plain error rather than trimmed. If you set an expiry date and turn milestone alerts on, the name you gave the document is used as the title of that alert, and like any notification it can appear on your lock screen. That is worth knowing when you name something sensitive. Only that name leaves the vault; the file itself never does.
On Android, they are written inside the app’s own private storage, which Android keeps encrypted under your device credential and unreadable until the phone has been unlocked once after a restart. No other app can read them. The same 15 MB limit applies. They are excluded from cloud backup and from device transfer, so they cannot be copied onto a new phone during its setup either. If you set an expiry date and turn alerts on, the name you gave the document is used as the title of that alert and is handed to the system’s own scheduler until it fires, so that name waits outside the app’s storage. That is worth knowing when you name something sensitive: only the name ever leaves, never the file.
On both phones, removing a document deletes the file, and deleting the app deletes all of them. They are never uploaded, we never see them, and we keep no copy anywhere else. Attaching copies the file into the app: the photo or file you picked stays where it was, in your photo library or in Files, and remains your own copy.
One thing worth knowing: on iPhone these files are deliberately kept out of your iPhone backup. If you back your device up to iCloud or to a computer, your documents are not part of that backup, so they cannot reach another phone that way. The cost is worth stating plainly: restoring a new phone from a backup, or setting one up from your old one, will not bring your documents back, and you attach them again. That is the version of this we can stand behind. Papers this sensitive should not travel further than the phone you chose to put them on. Keep your own copies of anything you cannot easily get again, and attach only what you actually need.
Trips from your calendar
On the iPhone and on Android, the Standing screen can look through your calendar for flights, holidays and stays away and offer each one as a trip for you to check and save. It asks for access only when you tap Find trips in your calendar: on the iPhone that is iOS’s own question for full calendar access, because iOS offers no way to read a calendar with less, and on Android it is the calendar permission, the only permission the app asks for besides notifications. You can refuse, and you can withdraw it at any time in Settings.
Your calendar is read on your phone and only while that screen is looking. The app picks out events by a few travel words in English, Spanish, Catalan, Galician and Basque, by flight numbers and by stays of two days or more with a place on them, and it does all of that on the device. It never changes or adds anything in your calendar, keeps no copy of it and sends nothing from it anywhere: not to us, not to anyone. Nothing becomes a trip unless you open it and tap Save, and a saved trip is stored like any other trip you log.
The application pack
On the iPhone and on Android, the Path tab can make one PDF of what you have entered: your situation, the requirements on your route, your trips with their days per year, your application and the names of the documents you hold. It is made on your phone and kept only while its sheet is open: the file is deleted when you close it. It goes only where you send it from the share sheet, and the app you send it to handles it under its own terms. The documents themselves are not inside it, only their names, and a pack made for a second person lists no documents at all.
Listen
Practice questions can be read aloud in Spanish, the language of the CCSE, by your phone’s own text to speech. The question is spoken on the device and nothing is sent to us. On Android the voice belongs to the text to speech service you have chosen in Android Settings, which may need its Spanish voice installed first.
Shortcuts and Siri
On the iPhone you can ask Siri, in English or in Spanish, or run a shortcut, for your days abroad, to log a trip or to start Today’s five. The answer is worked out inside the app on your phone from what is already there, and the app sends nothing anywhere. Siri itself is Apple’s and handles your voice under Apple’s terms. On both phones you can also touch and hold the app icon for the same actions, which simply open the app.
Fees, language exams and the small i
The language path under the language requirement, with the DELE dates, the fees in What it costs and the short explanations behind the small i beside each feature ship inside the app and make no network request. Which explanations you have opened is a setting stored on your device only. A source link opens the authority’s or the Instituto Cervantes’ own page in the in-app browser and carries nothing you entered.
Reminders and alerts
Alerts for the dates in What’s coming, the daily practice reminder and the weekly Sunday standing are local notifications, and so is the news alert; they are off until you turn them on. Your phone schedules them from information already on it, so they use no server of ours, no push service and no device token. Nothing about them reaches us: not that you switched them on, not when one fires, not whether you opened it. The settings are stored on your device.
On Android, the kinds of alert sit in their own notification channels, so you can mute one in Android Settings without losing the others, and nothing is posted at all unless Android’s notification permission is granted. Every scheduler checks that permission again immediately before posting, so turning notifications off in Settings takes effect whether or not the app hears about it.
What a notification says is worth knowing, because like any notification it can appear on your lock screen. A Daily 5 reminder quotes one of the questions in that day’s round; on both phones the reminders are scheduled up to two weeks ahead from what is on your phone, and a day’s reminder is withdrawn once that day’s round is done. An alert for a date in What’s coming carries the title of that date, which for a trip includes the destination you named, so name a trip with that in mind. A news alert carries the story’s headline. An alert for a CCSE sitting names the test and who runs it, and one for a registration deadline gives the date of the sitting it is for. An alert for a filing carries the authority’s deadline where the law writes one, and an alert for a reply window you logged carries the date of the letter and the note you wrote when you logged it, so write that note with the lock screen in mind. The Sunday standing, if you turn it on, carries three numbers: your residence time so far, your longest stay abroad logged against the three month guidance line and the practice questions you hold, so it says on your lock screen roughly where you are in the process. Tapping any of them opens the screen it names inside the app, and nothing about the tap leaves your phone.
Widgets
On the iPhone you can add Belong Spain widgets to your home screen and to the Lock Screen: where you stand, your longest stay abroad, Today’s five and the newest story from The Local. A widget shows what the app already holds, run through the same rules, and nothing else. The app keeps a copy of your own entries, which the widgets read, in a container Apple sets aside on your device for the app and its widgets, so a widget can read it without the app running. That copy does not leave your phone, and no server of ours is involved in drawing a widget. Whatever a widget shows is visible to anyone who can see your home screen or Lock Screen, so remove the widget if that matters to you. The widgets show figures only while your subscription is active and show nothing until your situation is set up, and the news widget makes no request of its own: it shows the story the app last fetched. The Android app has no widgets.
Recommending the app
The Recommend Belong Spain button on the You tab opens your phone’s own share sheet with a short message and a link to belongspain.app. You choose whether to send it, to whom and with which app, and that app handles it under its own terms. The link carries no code or identifier and the app sends us nothing when you share it. We never learn whether or to whom anything was sent. Nothing is tracked, counted or rewarded.
Belong Spain Speak
Belong Spain Speak is an optional add-on for the iPhone and Android apps: a monthly subscription of its own that lets you practise everyday Spanish out loud with Saga, an AI speaking partner, in a voice call. It is the one part of the apps that sends anything to a server of ours, and only for people who add it and call Saga. If you never add Speak, everything above about the apps keeping your data on your device stays exactly as it is.
The microphone. The first time you call Saga, the app asks for access to your microphone: on the iPhone that is iOS’s own question, and on Android it is the microphone permission. You can refuse, and you can withdraw it at any time in Settings; Speak simply cannot hear you without it. The microphone is used only while a call is open. Ending the call, swiping Saga back to the water or leaving the app ends the call and stops the microphone. On Android the app also adjusts the phone’s audio settings during a call, so your voice and Saga’s are routed like a phone call. It puts them back afterwards.
Before each call the app asks our Speak server, speak.belongspain.app, for a single-use pass for that one call. With that request it sends the store’s own identifier for your Speak purchase (Apple’s transaction number on the iPhone, Google Play’s purchase token on Android), the level you chose, the language the app is shown in (English or Spanish, so your debrief comes back in it) and your phone’s time zone, so your daily minutes start again at your own midnight. Our server asks Apple or Google whether that purchase is active, and that is all it learns from them. It never receives your name, your email address or your payment details.
During the call your phone connects directly to Google’s Gemini API, which listens to what you say, writes down what you and Saga say for the subtitles and speaks Saga’s replies. Your voice goes from your phone to Google and does not pass through any server of ours; we never receive or store any audio. Along with the call go the instructions Saga follows: your level, the app’s language and the short note Saga keeps between calls, described below. Google provides this as a paid service. Under its Gemini API terms Google does not use what is sent to improve its products. It logs it for a limited period, only to detect and prevent misuse, and it may process it in any country where Google or its agents have facilities. Google’s own privacy policy and terms govern that processing.
After the call the app sends the written transcript of the call, the words and not the audio, to our server, which passes it to Anthropic’s Claude API to write your debrief: what went well, what to fix, your new words and one idea for next time, explained in the app’s language. Claude also writes the short note Saga keeps for your next call. Our server does not store the transcript. Anthropic deletes what it receives through its API within 30 days, or keeps it for up to two years only if it is flagged for breaking Anthropic’s usage policy, and its commercial terms do not allow it to train its models on it. Anthropic is based in the United States, so this is a transfer outside the European Economic Area, made under the safeguards in Anthropic’s data processing terms. If your phone is offline when a call ends, the transcript waits on your phone until Speak next reaches our server, is sent then and is deleted from the phone.
What our server keeps is linked only to the store’s identifier for your Speak subscription (Apple’s original transaction number, or a one-way hash of Google Play’s purchase token), never to your name or email: how many seconds you talked each day; for each call, when it started and ended, the level, the app’s language, the minutes counted and how much processing it used; and Saga’s note. The note is at most 500 characters and holds the topics you talked about, how comfortable you seemed and the one or two mistakes that keep coming back. Claude is instructed to leave out names, contact details and health, religion, politics or other sensitive personal details. We cannot promise it never slips, so please do not share such details in a call. The server runs on Cloudflare and its database is kept in the European Union. We delete call records and daily counts a year after the call, and everything we hold about a subscription, the note included, once a year has passed without a call.
On your phone the app keeps your debriefs, the words saved from them and your level, in its own storage with your other entries. They are not sent to us. Deleting the app deletes them.
Forget what Saga remembers, on the You tab, deletes Saga’s note and your call records on our server, and the call history and saved words on your phone. The daily counts stay until they are a year old, because they hold only a day and a number of seconds and are what keeps the daily allowance fair. Report a reply, on the call screen, opens your own email app with a message to us that you write and choose to send; nothing is sent unless you send it.
Purchases of Speak are handled by Apple or Google exactly as described under Subscriptions and payments, and we never see your payment details. For what our server holds you have the rights described under Your data and your rights. Because we do not know your name, the quickest way to delete it is Forget what Saga remembers in the app; you can also write to us at hello@belongeurope.com. Speak is for adults only.
Subscriptions and payments
Belong Spain Pro is an optional auto-renewable subscription at 34,99 EUR per year, with a 7-day free trial.
On the iPhone, payment is handled entirely by Apple through your Apple Account. On Android it is handled entirely by Google through Google Play. We never see your card, your billing address or your name. Each store reports sales to us only in aggregate, as numbers, with no way to identify individual subscribers, and each store’s own privacy policy governs that transaction.
Because neither app has an account, a subscription bought in one store is not visible to the other: it unlocks the app you bought it in, on the store account you bought it with.
Language
Your choice of English or Español is a setting stored on your device. It is not a profile and it is not sent anywhere, with one exception: if you add Belong Spain Speak, each call tells our Speak server which of the two it is, so your debrief comes back in it.
Diagnostics
If you have turned on Apple’s optional analytics sharing in iOS Settings, Apple may send us crash and performance reports in a form that does not identify you. We use them only to find and fix problems. You can turn this off at any time in Settings → Privacy & Security → Analytics & Improvements.
Android works the same way. If you have turned on Google’s optional usage and diagnostics sharing, Google may show us crash and performance reports in the Play Console, again in a form that does not identify you, and again used only to find and fix problems. You can turn it off in your phone’s Settings, under Google, in Usage & diagnostics.
We add no crash reporting of our own to either app.
Your data and your rights
Because your data never reaches us, there is no account for us to export, correct or delete. You already hold all of it, and deleting the app deletes it. The one exception is Belong Spain Speak, if you add it: what our server keeps for Speak is set out in that section, and you can delete it with Forget what Saga remembers in the app or by writing to us at hello@belongeurope.com. Under the GDPR you keep your rights of access, rectification, erasure, restriction, portability and objection against any personal data a company actually holds about you. If you believe we have mishandled personal data, you can contact us first, and you have the right to complain to your supervisory authority: in Spain, the Agencia Española de Protección de Datos (AEPD) at aepd.es, or, since we are established in Denmark, the Danish Datatilsynet at datatilsynet.dk.
Children
Belong Spain is made for adults navigating their own immigration and nationality path. It is not directed at children and we do not knowingly collect anything from them.
Changes to this policy
If we change how the app handles data, we will update this page and its effective date, and we will say so in the app when the change is material. In particular, this page is updated before any feature that makes a network request ships, as it was for the news feed.
Contact
Questions about this policy: hello@belongeurope.com.