Privacy
Policy
Data stored on your device
IrisVault stores the following data locally on your iPhone using Apple's SwiftData framework. It does not leave your device unless you have iCloud sync enabled:
- Exercise sessions — which exercises you completed and how long each took
- Symptom check-in scores from the CVS-Q questionnaire
- Custom routines you have created
- Reminder schedules
- Articles you have read and tips you have marked as applied
- App preferences set during onboarding (screen hours, concerns)
If you enable iCloud sync, this data is encrypted end-to-end by Apple and synced through your private iCloud account. I have no access to it.
Sign in with Apple
Sign in with Apple is optional. If you use it, Apple may share your name and a private email relay address with the app. This information is stored locally on your device and is used only to display your name inside the app. I do not store it on any server.
Subscriptions and payments
Subscription and one-time purchases are processed entirely by Apple through StoreKit. I never see your payment card, billing address, or Apple ID. Apple provides the app with a verified receipt confirming your entitlement — nothing more.
Advertising (free tier only)
If you use IrisVault on the free tier, the app displays banner advertisements provided by Google AdMob (Google LLC). Google AdMob may collect and use the following data to serve relevant ads:
- Advertising identifier (IDFA), if you grant permission via the App Tracking Transparency prompt
- IP address and coarse location derived from it
- Device model, OS version, and app version
- Ad interaction data (impressions and taps)
When you first open IrisVault, you will see Apple's App Tracking Transparency prompt asking whether you allow tracking across apps and websites. If you decline, Google AdMob will still show ads but will not use your advertising identifier for personalisation. If you later want to change this choice, go to iPhone Settings → Privacy & Security → Tracking → IrisVault.
Google's own privacy policy applies to data collected through AdMob: policies.google.com/privacy.
Upgrading to IrisVault Pro removes all advertising.
Notifications
Reminders are scheduled locally on your device using Apple's UserNotifications framework. They are not routed through any server I operate. You can disable them at any time in iPhone Settings → Notifications → IrisVault, or by deleting all reminders in the app.
What I do not collect
Data retention and deletion
All locally stored data remains on your device until you delete it. To delete everything, go to Settings → Delete all local data inside the app. Uninstalling IrisVault from your iPhone also removes all local data. If you created an account with Sign in with Apple, you can additionally delete your account from Settings → Delete account, which removes any account record from Apple's systems.
Your rights under GDPR
Cyprus is an EU member state. You have the following rights under the General Data Protection Regulation:
Right of access — your data lives on your device and is visible in the app.
Right to rectification — you can edit or overwrite your data inside the app.
Right to erasure — use Settings → Delete all local data.
Right to data portability — contact me and I will assist you.
Right to restrict or object to processing — stop using the app and delete local data. For advertising data processed by Google, use the opt-out described in section 4.
To exercise any of these rights or ask a question, contact me at support@steplan.app.
Children's privacy
IrisVault is not directed at children under 13. I do not knowingly collect personal data from children. If you believe a child has provided personal information through the app, please contact me and I will delete it promptly.
Changes to this policy
If this policy changes in a meaningful way, I will update the date at the top of this page and, where appropriate, notify users inside the app. Continued use of IrisVault after a change constitutes acceptance of the updated policy.