Privacy Policy

Effective 10 November 2026 · Last updated 10 November 2026

This Privacy Policy applies to the Lymiflow app for iPhone and the website lymiflow.com (together, the “Application”), operated by Devan Hedglin (“we”, “us”). It explains what data the Application collects, how and why, who it is shared with, how long it is kept, and how you can withdraw consent or ask for deletion.

1. Who is responsible for your data

Devan Hedglin is the data controller for the Application. For any privacy question, or to exercise any of your rights, email [email protected].

2. Data that stays on your iPhone

The following is created and stored only on your device. We never receive it, it is never sent to iCloud, and it is never shared with anyone:

• Your setup answers: the areas you want to focus on, the kit you have (such as compression wear), your activity and routine preferences, and your name if you enter one.
• Health and fitness information: your check-ins about how you feel (for example “heavy”, “achy” or “light”), the sessions you finish, and your progress history.
• Your settings: pace, days per week and reminder times. Reminders are local notifications scheduled on your iPhone; nothing about them leaves the device.

The Application does not read from or write to Apple Health (HealthKit), and does not use the camera, photos, microphone, contacts or location.

3. Data that leaves your iPhone, and why

3.1 Subscriptions and purchases

Lymiflow Plus is sold through Apple’s App Store. Apple processes your payment; we never receive your name, Apple ID, email, card or billing address. To know whether your subscription is active, the Application uses RevenueCat, a subscription service. RevenueCat receives:

• A random, anonymous app user ID created on your device.
• Your purchase and subscription history for Lymiflow (product, dates, trial and renewal status, App Store country and currency).
• Technical details needed to process requests: app version, iOS version, device model and the IP address of the request.
• Your answer to “How did you hear about us?”, only if you choose to give one. This is the only setup answer that ever leaves your device. It is used solely to understand which channels bring people to the app, and is never combined with your check-ins or health and fitness information.

Purpose: to provide the subscription you paid for (contract), restore purchases, prevent fraud, and understand how people find the app (legitimate interest).

3.2 Measuring our ads (Meta)

We advertise Lymiflow on Facebook and Instagram. To know whether those ads lead to installs and subscriptions, the app includes Meta’s SDK, and RevenueCat reports subscription events to Meta. Meta Platforms, Inc. receives only:

• That the app was installed and opened.
• That you finished setup, with no details of your answers.
• From RevenueCat: that a free trial or subscription started or renewed, with its price and currency.
• A random ID the Meta SDK creates on your iPhone, which ties these events together, plus basic device details (model, iOS version, language, time zone, app version) and the IP address of the request.

Meta never receives your name, your Apple Account, your device’s advertising identifier (IDFA), your setup answers, the areas you focus on, how you feel, your sessions, your check-ins, or your “How did you hear about us?” answer. The app never asks for tracking permission, and every event is sent with tracking marked as not allowed, so Meta uses it only for aggregated ad measurement. Purpose: measuring and improving our own advertising (legitimate interest). See Meta’s Privacy Policy.

3.3 Routines and videos

The Application downloads its routines and move videos from our content server, hosted by Supabase. The content is the same for every user. Like any internet request, it carries your IP address and app version, which the host may keep briefly in standard server logs for security and reliability. We do not link these logs to you.

3.4 Emails you send us

If you email [email protected], we receive your email address and whatever you choose to write. We use it only to reply and to help you. Mail is forwarded by Cloudflare Email Routing to our inbox.

3.5 This website

lymiflow.com sets no cookies and runs no analytics or advertising. It is served by Cloudflare, which processes request data such as your IP address to deliver and protect the site. Fonts are loaded from Google Fonts, which receives your IP address when the page loads.

4. What we never do

• The app shows no ads. We use the Meta events in section 3.2 only to measure our own ads, and we never use health or fitness information, setup answers or check-ins for advertising, marketing or data mining.
• We do not track you across other companies’ apps or websites, and the Application never asks for tracking permission because it does not track.
• We do not sell or rent personal information, and we do not build profiles of you.
• We do not share health or fitness information with anyone. It is used only to show it back to you on your own device.
• We do not use artificial intelligence to process your data, and we make no automated decisions about you.

5. Third parties

We share data only with the service providers below, only for the purposes described above, and only what each needs to do its job. Each of them provides the same or equal protection of user data as stated in this Privacy Policy and as required by Apple’s App Review Guidelines, under its own privacy terms and its data processing agreement with us:

• Apple: App Store distribution and payments. Privacy policy
• RevenueCat: subscription status. Privacy policy
• Meta Platforms: measurement of our Facebook and Instagram ads. Privacy policy
• Supabase: hosting of routines and videos. Privacy policy
• Cloudflare: website hosting and email forwarding. Privacy policy
• Google Fonts (website only): typefaces. Privacy policy

We may also disclose information if required by law (for example to comply with a subpoena or similar legal process), or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

6. Legal basis (EEA and UK users)

Where the GDPR or UK GDPR applies, we process personal data on these bases: contract, to provide the subscription and the content you use; consent, for the optional “How did you hear about us?” answer and for emails you choose to send; and legitimate interests, to keep the service secure, prevent fraud, keep it working, and measure our own advertising. You can withdraw consent at any time (see section 9); this does not affect processing that happened before.

7. International transfers

Our service providers may process data in the United States and other countries. Where personal data from the EEA, UK or Switzerland is transferred, it is protected by an appropriate safeguard such as an adequacy decision or the European Commission’s Standard Contractual Clauses.

8. How long we keep data

• On-device data: kept on your iPhone until you delete it in the app or delete the app.
• Subscription records at RevenueCat: kept while your subscription is active and afterwards as long as needed for accounting, tax and fraud-prevention duties, then deleted.
• Ad measurement events at Meta: kept by Meta under its own retention policy; Meta uses them only in aggregate for us.
• Server and website logs: kept for a short period by the hosting providers for security, then deleted.
• Support emails: kept while needed to help you, and deleted within 24 months of the last message.

9. Deleting your data and withdrawing consent

• Everything on your iPhone: open the app, go to Settings and tap Delete all my data. Deleting the app also removes it.
• Your subscription record and “How did you hear about us?” answer: email [email protected] and ask for deletion. We will delete it from RevenueCat, usually within 30 days. Because the record is anonymous, include the date you subscribed so we can find it, or use Restore purchases first and tell us.
• Ad measurement: you can disconnect activity Meta receives from apps in your Facebook or Instagram account (Accounts Center › Your information and permissions › Your activity off Meta technologies), or email us and we will ask Meta to delete events tied to your install.
• Emails: ask us to delete your messages at [email protected].
• Withdrawing consent: you can stop any further collection at any time by deleting the app. To withdraw consent for data already sent, email [email protected] and we will delete it. Cancelling a subscription is done in your iPhone’s Settings and does not by itself delete data.

We respond to requests within one month, extendable by two months where the law allows for complex requests, and we never charge for them.

10. Your rights

Wherever you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent. Email [email protected]; we may need to ask for details to verify the request.

EEA and UK residents may also complain to their local data protection authority (EU authorities, UK ICO).

California residents have the right to know, delete and correct personal information, to opt out of its sale (we do not sell it) or of its sharing for cross-context behavioural advertising (email us to opt out of the Meta measurement events), to limit the use of sensitive personal information (we use it only to provide the app), and not to be discriminated against for using these rights. You may use an authorised agent.

11. Children

The Application is meant for adults and is not directed to children. We do not knowingly collect personal data from anyone under the age of digital consent in their country. If you believe a child has sent us personal data, email [email protected] and we will delete it.

12. Security

On-device data is protected by your iPhone’s own security and encryption. Data sent to our providers travels over encrypted connections (HTTPS). Access to service accounts is limited to the developer. No system is perfectly secure, but if a breach affecting your personal data occurs, we will notify the relevant authority and, where required, you, within the timeframes set by law.

13. Changes to this policy

We may update this Privacy Policy. The “Last updated” date above will change, and material changes will also be noted in the app’s release notes. Where the law requires, we will ask for your consent before a material change takes effect. Earlier versions are available on request.

14. Contact

Devan Hedglin, developer of Lymiflow
[email protected]