Privacy Policy

Effective date: October 19, 2026

Vialy ("we", "our", "us") is an app published by Crascodes that helps you log peptide and GLP-1 doses, vials, weight, meals and how you feel. This policy explains what we collect, why, who processes it, and the choices you have.

The short version: what you type into Vialy is stored on our servers so the app works across sessions and devices. Apple Health data is read on your iPhone and never uploaded. We do not sell your data, and we never share your health entries with advertising or analytics companies.

Information we collect

Account data: an anonymous account is created on first launch. When you sign in with Apple or Google, we receive your name and email address (Apple may give us a private relay address instead).
Device identifiers: a random ID generated by the app and kept in your device's keychain, plus your time zone, language, app version, OS version and App Store country.
Approximate location: our servers keep only your country. AppsFlyer and PostHog may derive an approximate location (country or city) from your IP address for attribution and analytics; we do not store the IP address.
Health and wellness entries you make: the protocols, doses and injection sites you log, vials (compound, strength, reconstitution date, price), weight you enter by hand, side-effect and wellbeing scores, notes, meals and nutrition goals, and onboarding answers such as date of birth, height, gender, starting and goal weight.
Photos you choose to scan: when you photograph a meal or a vial label, the image is resized (which removes location and other metadata), uploaded, analysed, and deleted. Leftover uploads are swept within 24 hours.
AI chat: the messages you send to the in-app assistant, together with the protocols you logged so the answer has context.
Feedback: ratings and messages you send us from the app.
Purchases: subscription status and purchase history. Payments are handled by Apple; we never see your card.
Usage and diagnostics: which screens and features you use (for example "a dose was logged", without the dose itself), and crash reports.
Advertising identifier (IDFA): only if you allow tracking when iOS asks. See "Advertising and tracking" below.

Apple Health

If you connect Apple Health, Vialy reads weight, body measurements, steps, active energy, heart rate, heart-rate variability and sleep to show your trends. This data is processed only on your iPhone. It is never uploaded to our servers, never sent to third parties, and never used for advertising or marketing. Vialy does not write to Apple Health.

How we use data

To provide the app: schedules, reminders, dose and vial tracking, results, widgets and reports.
To answer your questions in the AI assistant and read meal or label photos.
To manage your subscription and restore purchases.
To send the notifications you turn on.
To understand which features help people and to fix bugs and crashes.
To measure which of our ads and links bring people to the app (see below).
To prevent abuse and enforce usage limits.

Service providers

We share only what each provider needs to do its job for us:

Provider	Purpose	What it receives
Supabase	Our backend: accounts, database, file storage	Your account and the entries listed above
OpenAI	AI assistant, meal and vial-label reading	Chat messages, your logged protocols, scanned photos. Sent through our server; not used to train their models under their API terms
Apple, Google	Sign-in	Sign-in tokens
RevenueCat	Subscriptions	App user ID, purchase history
OneSignal	Push notifications	Push token, account ID, subscriber status
PostHog	Product analytics	App user ID, feature-usage events, app version. No health values; IP addresses are discarded
Firebase Crashlytics (Google)	Crash reports	Crash logs, device model, app user ID
AppsFlyer	Install attribution	Device and install data, onboarding-completed and paywall-viewed events, purchase events, and the IDFA only if you allowed tracking
Open Food Facts	Barcode lookup	Only the scanned barcode number and language — no ID

We do not sell personal data, and we do not share your health entries with AppsFlyer, PostHog or any advertiser.

Advertising and tracking

Vialy asks for permission through Apple's App Tracking Transparency prompt. If you allow it, AppsFlyer receives your advertising identifier so we can tell which ad campaigns led to installs and subscriptions. If you decline, the identifier is never collected, and attribution relies on Apple's privacy-preserving tools (SKAdNetwork and AdServices) and aggregated data. You can change this any time in iOS Settings → Privacy & Security → Tracking.

Data retention

Your account and entries: until you delete your account.
Scanned photos: deleted right after analysis, and within 24 hours at most.
AI chat: kept on your device; a backup of recent conversations and a server log are deleted after 30 days without chat activity.
Usage events: 13 months. Error logs: 30 days. Notification history: 90 days.

Deleting your data

You can delete your account in the app under Profile → Delete account. When you delete your account, we delete your account and the data tied to it (your entries, chat backups and any stored photos) from our servers, revoke your Sign in with Apple authorization, and ask our subscription provider (RevenueCat) to delete your record. We keep purchase and subscription event records received from Apple and RevenueCat where needed for accounting and legal obligations, and one-way hashed codes used only to prevent repeated use of free trials and referral rewards; these do not identify you. Analytics and attribution providers (PostHog, AppsFlyer) may keep a device identifier; to have it deleted, email support@crascodes.com with the device ID shown in the app. Uninstalling the app removes the data stored on your phone. An active subscription is billed by Apple until you cancel it in Settings.

Your rights

Depending on where you live (for example under the GDPR, UK GDPR, KVKK, or US state laws such as the CCPA and Washington's My Health My Data Act), you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent. We process health entries on the basis of your explicit consent, which you give when you enter them; you can withdraw it by deleting the entries or your account. To exercise any right, contact us below. We will not discriminate against you for doing so.

Security

Data is encrypted in transit (HTTPS) and access to it is restricted. No method of storage is perfectly secure, but we work to protect your information.

Children

Vialy is intended for adults aged 18 and over and is not directed to children. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, contact us and we will delete it.

International transfers

Our providers may store and process data in the United States, the European Union and other countries. Where required, transfers rely on safeguards such as the EU Standard Contractual Clauses.

Not medical advice

Vialy is a tracking tool, not a medical device. See our Terms of Use.

Changes

We may update this policy. Material changes will be announced in the app or reflected by updating the effective date above.

Contact

Questions or requests: support@crascodes.com