Your information, explained plainly
Privacy Policy
This policy explains what happens to information you share with Varelune through this website or the app. We wrote it to be clear about what the product does today, what is still being reviewed, and what remains in your control.
The short version
Varelune is being built to keep your health record on your device and work without an account or cloud sync. The website’s contact, beta, and support forms are separate from that record. They send the details you choose to provide to our email systems so we can respond.
Please do not send symptoms, diagnoses, medications, fertility, pregnancy, sexual-health, or other sensitive health information through a website form or email. Varelune is not a substitute for professional medical care.
1. Health information in the app
You may use Varelune to record information about cycles, fertility, pregnancy, postpartum recovery, menopause, mental and emotional wellbeing, symptoms, medications, digestion, bowel health, pelvic-floor health, appointments, and personal notes.
The app is designed for local, offline use. No account is required for that experience, and we do not currently have a health-data cloud sync path or a third-party analytics SDK in the app.
Encryption at rest is now implemented on iOS: your vault database and its photo, document, and audio attachments are encrypted, protected by your passcode, and designed to detect tampering. This hasn't been independently reviewed yet, isn't ready on Android, and doesn't protect against everything, like screenshots, an already-unlocked device, or copies you keep elsewhere. We will not describe the product as ready for sensitive health data until the applicable review gates have passed.
Local storage does not prevent every possible copy. Device backups, exports, screenshots, notifications, operating-system services, and apps you choose to share with may create additional copies. Your device settings and sharing choices matter.
2. Information you send through the website
The beta, contact, and support forms are separate from the Varelune health record. If you use one, you may choose to provide an email address, name or preferred name, request type, support topic, and message. We also receive limited technical details needed to deliver and protect the form, such as an IP address, request metadata, and abuse-prevention signals.
Cloudflare and our email provider process these submissions. They are delivered to developer@varelune.app and stored in email systems. They are not added to the app or a Varelune application database. Provider logs and backups may keep limited copies according to their own retention and security practices.
3. How we use information
We use website submissions to answer questions, review beta interest, provide support, communicate about Varelune when appropriate, prevent abuse, protect the service, and keep records needed for legitimate business or legal purposes. We do not use website submissions to provide medical advice.
Varelune is not designed to sell your personal information or use your health record for advertising. We do not describe the app as anonymous or risk-free.
4. When information may be shared
We may share website information with service providers that help us run the website and contact flow, including Cloudflare and email providers. They process information on our behalf and may retain logs or backups under their own practices.
We may also disclose information when required by law, in response to valid legal process, to protect users or the service, or as part of a business transfer. We do not share information with clinicians, insurers, employers, advertisers, or other third parties for their own use unless you ask us to or the law requires it.
5. Retention and deletion requests
We keep information for as long as we reasonably need it for the reason it was collected, security, support, legal obligations, or legitimate business records. Cloudflare and email providers may retain copies in logs or backups according to their own schedules.
To ask us to delete a website submission or to ask a privacy question, email developer@varelune.app. Please include enough information for us to find the request, but do not send health information. Removing a submission from active systems may not immediately remove copies in provider backups or security logs.
6. Security
We use reasonable measures for the information and services we operate. Encryption at rest is now implemented on iOS: your vault database and its photo, document, and audio attachments are encrypted, protected by your passcode, and designed to detect tampering. This hasn't been independently reviewed yet, isn't ready on Android, and doesn't protect against everything, like screenshots, an already-unlocked device, or copies you keep elsewhere. No service or device is perfectly secure.
You are responsible for protecting your device, passcode, operating-system account, and any exports or backups you create. Please do not rely on a pre-release app for information that requires a completed and independently verified security design.
7. Children and sensitive use
Varelune is not directed to children. Do not use the website contact form to submit information about a child. If you believe a child has provided personal information, contact us at developer@varelune.app.
8. Changes to this policy
Varelune is still developing, so this policy may change as our data practices change. The effective date above shows when the current version took effect. If a change is material, we will provide notice through the website or app where reasonably practicable.
9. Contact
For privacy questions or deletion requests, email developer@varelune.app.
Important: This policy is a product draft for review. Before publication as a final legal policy, it should be checked against the released app, legal entity, jurisdictions, provider contracts, retention settings, and App Store privacy disclosures.