Privacy Policy

Effective 13 May 2026

This Privacy Policy explains what information the Vialy iOS app (“Vialy”, “we”, “our”) collects when you use it, why we collect it, and the rights you have over your data. Vialy is provided by Lunium AB, a Swedish limited company (“Lunium”).

We designed Vialy to collect as little as we can while still doing its job. There are no analytics SDKs, no advertising, no tracking, and no third-party data sharing.

1. Who we are

Vialy is operated by Lunium AB, registered in Sweden. References to “we” and “our” in this policy mean Lunium AB. You can reach us at [email protected].

For data protection purposes, Lunium AB is the data controller for personal data processed in connection with Vialy.

2. What we collect

2.1 Information you provide via Sign in with Apple

Vialy uses Sign in with Apple as the only way to create an account. When you sign in, Apple sends us:

• Email address — either your real Apple ID email or a private relay address you choose to share.
• Name — only if you choose to share it (you can use a different name or hide it).
• Apple user identifier — a stable string Apple gives us to recognize you across sessions. It is unique to Vialy and cannot be linked to your other Apple ID activity.

We never see your Apple ID password.

2.2 Information you create inside the app

Vialy stores the content you create so it syncs across your devices:

• Vials you reconstitute (peptide, milligrams, BAC water volume, syringe type, reconstitution date, optional cost)
• Plans and phases (cadence, scheduled days, dose, grace window, notification times)
• Injection logs (timestamp, dose in milligrams and units, body site, route, optional notes)
• Preferences (default syringe, default route, reorder threshold, notification toggles)
• Peptide associations you select from the in-app reference catalog

This information is content you choose to record. We treat it as your personal data.

2.3 Information we do not collect

• No HealthKit data. Vialy does not request HealthKit access.
• No location, contacts, camera, microphone, or photos.
• No advertising identifier (IDFA), no app tracking.
• No analytics events about how you use the app.
• No crash-reporting telemetry beyond what Apple itself collects with your separate consent in iOS Settings.

3. Why we collect it

We collect the information above only to operate Vialy:

• Authentication — to recognize you when you sign in and to keep your data separate from other accounts.
• App functionality — to store, sync, and display the vials, plans, and logs you create.
• Support — to respond to you if you contact us.

We do not use your information for marketing, profiling, or any purpose other than running the app and supporting your account.

Our lawful basis under GDPR is the performance of our agreement with you (Article 6(1)(b)) for everything required to operate the service, and our legitimate interest (Article 6(1)(f)) for fraud prevention and securing the service.

4. Where your data lives

Your data is stored on servers we operate at appwrite.lunium.io. The infrastructure is hosted in Europe. Data is encrypted in transit using TLS, and our backend stores account data in an encrypted database.

Your data is associated with your Apple user identifier so that only you can read or modify it through the Vialy app.

5. Sharing and third parties

We do not sell, rent, or share your personal information with third parties for their own purposes. The only parties that ever see your data are:

• Apple, as the operator of Sign in with Apple and the App Store. Apple’s handling of your Apple ID is governed by Apple’s privacy policy.
• Our hosting provider, which runs the physical servers our backend uses. They process data only on our instructions and only to keep the servers running.

We do not use third-party analytics, advertising networks, attribution SDKs, or social-login providers other than Apple.

6. How long we keep it

We keep your data for as long as your account is active. When you delete your account from the in-app Settings screen, we delete the personal data associated with your account from our active systems promptly, typically within 30 days. Backup copies, if any, are overwritten on our normal backup rotation.

We may retain a minimal record (your Apple user identifier in a tombstone state) for fraud prevention and to enforce account-deletion. This tombstone contains no profile data, vials, plans, injection logs, or contact information.

7. Your rights

You can exercise all of the following from within the app:

• Access and portability — export your data as JSON or CSV from Settings.
• Correction — edit any vial, plan, phase, or injection log directly in the app.
• Deletion — tap “Delete account” in Settings to remove your account and personal data.

If you are in the EU, EEA, UK, or another jurisdiction with applicable data-protection law, you also have the right to lodge a complaint with your local supervisory authority. In Sweden this is the Integritetsskyddsmyndigheten (IMY).

You may also email us at [email protected] with any rights request and we will respond within 30 days.

8. Tracking and advertising

Vialy does not track you across apps and websites. The App Tracking Transparency framework is not used because there is no tracking to disclose. There are no ads, no measurement, and no cross-context behavioral profiling of any kind.

9. Children

Vialy is intended for adults. The App Store age rating is 17+. We do not knowingly collect personal information from anyone under that age. If you believe a child has provided us information, contact us at [email protected] and we will delete it.

10. Security

We use industry-standard protections, including TLS for traffic between the app and our backend and database-level encryption at rest. Authentication is handled exclusively through Sign in with Apple, so we never see, store, or transmit your password. No system is perfectly secure, but we keep dependencies updated and limit what we collect to reduce the impact of any incident.

11. Changes to this policy

If we make a material change to this policy, we will update the “Effective” date at the top and, where appropriate, notify you through the app or by email. Continuing to use Vialy after a change means you accept the updated policy.

12. Contact

Privacy questions: [email protected]

Mail: Lunium AB, Sweden.