Privacy Policy

This policy covers the Lavenda iPhone app and this website. “We” and “us” refer to the operator identified below. It explains how information is handled; it does not turn use of the app into consent for optional tracking or permissions.

1. Face data and other information on your iPhone

Face data: your photo diary

Your diary contains photographs of your face. The app captures and stores these photos on your iPhone; this is different from sending them to us. Here is what happens to that information:

• Collection and use. When you choose to take a diary photo, Lavenda uses the camera with your permission. It keeps the photo and its capture date locally so you can view and compare your own photos. Local file details include the file size, pixel dimensions, file identifiers and a checksum used to check file integrity. Image preparation for storage and display happens on the device.
• Facial measurements and biometric data. Lavenda does not perform facial recognition, identify or authenticate you from a photo, or create or store faceprints or biometric templates. It does not compute facial landmarks, facial measurements or attractiveness scores. Lavenda does not use your diary photos to train AI or machine-learning models.
• Sharing and third-party AI. Taking, storing, viewing and comparing diary photos does not transmit them or their diary records to our servers, analytics or subscription providers, or any third-party AI service. Lavenda does not use cloud or third-party AI processing for the diary. The separate export you can choose is explained below.
• Storage. Photos and diary records stay in the app's private storage on your iPhone, protected by iOS file protection and excluded from device backups. Lavenda does not save diary photos to your camera roll.
• Retention and deletion. Photos are kept locally until you delete them. You can delete individual photos in the diary, delete all photos, or delete all local data using the app's data controls. Deleting the app also removes its local diary. These controls do not require a subscription. There is no copy of your diary on our servers for us to retrieve or delete.

The app records usage events when a photo is added, compared or deleted. These events describe the action, not the contents of your face or diary: they do not include the photo, its file identifiers, dimensions, checksum or diary record. Online analytics are described in section 2.

When you choose to export. Your data export includes diary photos and their records. Nothing is shared with a recipient merely by taking or viewing a photo: you choose a destination using the iOS share sheet. That recipient or service then handles the exported copy under its own rules. Deleting the diary later does not delete copies you have already saved or shared elsewhere.

You can refuse camera permission or revoke it in iPhone Settings. This stops Lavenda from taking new camera photos; it does not give us access to existing photos or prevent you from using the app's data-deletion controls.

Practice, preferences and schedule

The app stores lesson progress, practice history, your selected schedule, settings and confirmation of the current safety rules on your device. The safety confirmation records agreement with the rules; it is not a medical assessment. Local reminders use iOS notifications only if you allow them.

Local photos and records are not an online backup. Do not assume they will return after deleting the app, erasing data or moving to another phone.

2. Online services

Lavenda uses our backend for app configuration, the selected lesson schedule, feature and paywall variants, subscription status and product usage events. The backend receives an installation identifier, authentication credentials and technical app and device information. Installation identifiers are also used by RevenueCat, Amplitude and AppsFlyer to associate the records described below. They are not a name or email, but the information is not necessarily anonymous and can be linked to your Lavenda account if you sign in.

Optional Apple sign-in. You can use Lavenda without signing in. If you choose Sign in with Apple, we receive Apple's identifier for your account and authentication information to link the installation to that account. We store the account identifier and, when issued and verified, a token used to revoke our access when the account is deleted. We do not request your name or email through Apple sign-in. Signing in does not upload or restore your local diary or practice history.

Purchases. Apple and RevenueCat process purchases and subscription access. We receive product and transaction identifiers, purchase, renewal, expiry and refund information, subscription status, price and currency information, and related app identifiers. We do not receive your payment-card details. RevenueCat also receives device identifiers and the AppsFlyer identifier for purchase attribution; its AppsFlyer integration sends subscription events so we can understand campaign performance.

Product analytics. Our backend and Amplitude receive events about screens, onboarding, permission choices, lesson actions and completion, reported discomfort, schedule changes, photo-feature actions, paywalls and data controls. Events have a time and limited properties such as lesson identifiers, progress counters or a selected variant. They do not contain diary photos, diary file records or support-message text. Amplitude also receives app, device and session context; providers receive network information such as your IP address when their services are contacted.

Attribution and tracking choices. AppsFlyer receives installation, session and campaign information. Our backend records the device's vendor identifier (IDFV), tracking-permission status, the AppsFlyer identifier and campaign tags when available, app and OS versions, and the App Store storefront's country code. That country code comes from the storefront your Apple Account uses, not from GPS or our server looking up your IP address. The advertising identifier (IDFA) is used only when you allow tracking through the iOS App Tracking Transparency prompt. AppsFlyer starts after the permission decision, including a refusal; refusing tracking prevents use of IDFA but does not turn off all product analytics or attribution that operates without it. You can change tracking permission in iPhone Settings, and refusing it does not restrict app features or subscription access.

Website links. The App Store button may use AppsFlyer OneLink to count the click and carry the campaign tags the visit arrived with (for example utm_ parameters) through to the App Store. AppsFlyer's script reads the page URL and referring-page address and keeps those campaign tags in your browser's local storage. This website link does not use your Lavenda account or diary.

3. Support messages and this website

When you submit the support form, we receive your subject, message, page language and, only if you provide them, a reply email and diagnostic code. We record the submission time and a random ticket identifier. The code is a troubleshooting reference, not proof of identity or permission to access an account. We do not attach your diary, practice archive, photos or account credentials to a request.

The form accepts text only and has no attachment upload. Please do not send passwords, payment credentials, photographs or sensitive health information. Your message is used for support and is not sent to product analytics or advertising services. Without a reply email, we may be unable to contact you about the request.

The site uses your network address to deliver pages and limit repeated requests. The address is not stored in a support ticket. Anti-abuse counters are temporary. This website does not set analytics or advertising cookies, load tracking pixels, use an external font service or save your form draft in browser storage. A failed submission leaves your text in the open form; reloading or leaving the page may lose it.

Links to Apple or another external service take you to that service, which handles the visit under its own privacy policy.

4. Service providers

Apple provides optional sign-in, iOS permissions, device security, distribution and App Store payment services. Apple processes App Store payments under its own terms; Lavenda does not receive your card details. We use these providers for connected services:

Sentry crash reporting and OneSignal marketing notifications are not active in the current app.

We do not sell diary photos or support messages, and do not use them for advertising. Where a provider processes information on our behalf, we require protection consistent with this policy and applicable law, and limit access to its stated purpose. We may disclose information if required by law, to protect legal rights or to address abuse, with appropriate safeguards.

5. Why information is used

• To provide the features you choose: local lessons, history, reminders, the diary, subscription access and optional account sign-in.
• To understand feature use, evaluate product and paywall variants and measure campaign and subscription performance using the online records described in section 2.
• To handle your support request, diagnose the reported problem and reply if you supply contact details.
• To protect the service against abuse and comply with applicable legal obligations.

Where data-protection law requires a legal basis, we rely on performing the service you request, proportionate legitimate interests in running and improving the service, support and security, legal obligations, or consent where required. Optional device permissions and tracking are choices of their own. You may withdraw consent without affecting the lawfulness of earlier processing.

6. Retention and deletion

• Local diary and practice records: retained on your device until you delete them. The app provides separate controls for deleting all photos and all data. All-data deletion also clears practice history, the schedule, safety confirmation and app-managed export archives. Deleting only photos does not delete your account or other online records.
• Exports: the app removes its temporary export archive after the sharing flow and clears leftover archives on a later app launch. Copies you have saved or sent elsewhere remain under your or the recipient's control and are not removed by an in-app reset.
• Online usage and device records: daily maintenance removes backend usage events older than 90 days and device records not seen for more than 365 days. Installation records and the current schedule, variant assignments and subscription-access records remain until you use all-data deletion; they do not all have the same automatic expiry. These backend periods do not describe the retention of copies held by separate providers.
• Support correspondence: scheduled for deletion after 180 days from submission through daily maintenance. You can request earlier deletion using the support form and your ticket reference or reply address. We may ask for proportionate verification; the ticket number alone is not authority to disclose a message.
• In-app deletion: Profile's Delete all data flow deletes this installation's sessions, usage events, device records, selected schedule, variant assignments and subscription-access record from our active database. If the installation is linked to a Lavenda account through Apple, that account is deleted and its other installations are unlinked. Data stored locally or separately for those other installations is not remotely erased. This deletes the Lavenda account, not your Apple Account. Signing out disconnects this installation without erasing its diary or other installation data; if no installations remain linked, the unused Lavenda account record is removed.
• Provider requests: all-data deletion queues deletion requests to Amplitude and RevenueCat and, when we have an attribution identifier, AppsFlyer. It also queues revocation of the linked Apple sign-in token when one has been stored. Provider processing is separate from deletion in our database and may finish later; a request being sent or accepted does not prove that every provider copy has been erased. Contact support about a pending request.
• Records retained after deletion: we keep an inactive installation identifier and related transaction records, including transaction identifiers, amounts and dates, so late purchase notifications can be recognised and subscription transactions accounted for. These records do not include diary photos, the deleted Apple account link or device advertising identifiers. They currently have no automatic expiry. Temporary identifiers needed to deliver provider-deletion requests remain separately while those requests are pending, subject to a 30-day delivery window.
• Recovery backups: deleted online records may remain in restricted database backups until those backups expire. Our object-storage backup rotation is configured for up to 28 days. This applies to backend records, not your local diary, which is never included in our server backups.

Uninstalling Lavenda removes its local diary but does not itself send a server or provider deletion request. Use Delete all data before uninstalling, or contact support about online records.

Deleting data or the app does not cancel an App Store subscription. Manage subscriptions with Apple. Apple's payment records are subject to Apple's retention obligations.

7. Your choices and rights

You can decline optional camera, notification and tracking permissions, change them in iPhone Settings, remove photos or use Delete all data, and choose whether to export anything. Apple sign-in, a support email and a diagnostic code are optional. The photo diary and data deletion do not require a subscription. The effect of tracking choices is explained in section 2 and the scope of deletion in section 6.

Depending on where you live, you may have rights to access, correct, erase, restrict or object to processing of personal information, receive portable information, withdraw consent, and complain to a data-protection authority. Contact us to exercise them. We cannot retrieve a diary photo from our servers because the diary is not uploaded.

8. Security and international processing

We use access restrictions, limited collection and iOS file protection to protect information. No system is completely secure. Keep your device secure and review the destination before sharing an export.

The connected services in section 4 are in use. Online records are stored in our hosted backend and by the relevant service providers, and may be processed outside your country. Our Amplitude project uses its US service region. Where applicable law requires protection for an international transfer, we require appropriate contractual and transfer safeguards. Contact us for information about the providers and safeguards relevant to your request. Diary photos remain on your device unless you choose an export destination.

9. Age requirements

Lavenda is intended for people aged 16 and over. We do not knowingly collect personal information from anyone under 16. Contact us if you believe someone under 16 has submitted personal information through support.

10. Updates and contact

We update this policy when processing changes and change the date above. We provide appropriate notice of material changes and obtain consent where required. Continuing to use the app does not by itself grant permission for optional tracking.

Contact us through the support form or at support@lavenda.fit.