Privacy Policy

Effective 9 November 2026 · Last updated 9 November 2026

This Privacy Policy applies to the Lymiflow app for iPhone and the website lymiflow.com (together, the “Application”), operated by Devan Hedglin (“we”, “us”). It explains what data the Application collects, how and why, who it is shared with, how long it is kept, and how you can withdraw consent or ask for deletion.

1. Who is responsible for your data

Devan Hedglin is the data controller for the Application. For any privacy question, or to exercise any of your rights, email support@lymiflow.com.

2. Data that stays on your iPhone

The following is created and stored only on your device. We never receive it, it is never sent to iCloud, and it is never shared with anyone:

• Your setup answers: the areas you want to focus on, the kit you have (such as compression wear), your activity and routine preferences, and your name if you enter one.
• Health and fitness information: your check-ins about how you feel (for example “heavy”, “achy” or “light”), the sessions you finish, and your progress history.
• Your settings: pace, days per week and reminder times. Reminders are local notifications scheduled on your iPhone; nothing about them leaves the device.

The Application does not read from or write to Apple Health (HealthKit), and does not use the camera, photos, microphone, contacts or location.

3. Data that leaves your iPhone, and why

3.1 Subscriptions and purchases

Lymiflow Plus is sold through Apple’s App Store. Apple processes your payment; we never receive your name, Apple ID, email, card or billing address. To know whether your subscription is active, the Application uses RevenueCat, a subscription service. RevenueCat receives:

• A random, anonymous app user ID created on your device.
• Your purchase and subscription history for Lymiflow (product, dates, trial and renewal status, App Store country and currency).
• Technical details needed to process requests: app version, iOS version, device model and the IP address of the request.
• Your answer to “How did you hear about us?”, only if you choose to give one. This is the only setup answer that ever leaves your device. It is used solely to understand which channels bring people to the app, and is never combined with your check-ins or health and fitness information.

Purpose: to provide the subscription you paid for (contract), restore purchases, prevent fraud, and understand how people find the app (legitimate interest).

3.2 Routines and videos

The Application downloads its routines and move videos from our content server, hosted by Supabase. The content is the same for every user. Like any internet request, it carries your IP address and app version, which the host may keep briefly in standard server logs for security and reliability. We do not link these logs to you.

3.3 Emails you send us

If you email support@lymiflow.com, we receive your email address and whatever you choose to write. We use it only to reply and to help you. Mail is forwarded by Cloudflare Email Routing to our inbox.

3.4 This website

lymiflow.com sets no cookies and runs no analytics or advertising. It is served by Cloudflare, which processes request data such as your IP address to deliver and protect the site. Fonts are loaded from Google Fonts, which receives your IP address when the page loads.

4. What we never do

• We do not show ads, and we do not use any data for advertising, marketing or data mining.
• We do not track you across other companies’ apps or websites, and the Application never asks for tracking permission because it does not track.
• We do not sell or “share” personal information (as those terms are used in California law), and we do not build profiles of you.
• We do not use health or fitness information for anything other than showing it back to you on your own device.
• We do not use artificial intelligence to process your data, and we make no automated decisions about you.

5. Third parties

We share data only with the service providers below, only for the purposes described above, and only what each needs to do its job. Each of them provides the same or equal protection of user data as stated in this Privacy Policy and as required by Apple’s App Review Guidelines, under its own privacy terms and its data processing agreement with us:

• Apple: App Store distribution and payments. Privacy policy
• RevenueCat: subscription status. Privacy policy
• Supabase: hosting of routines and videos. Privacy policy
• Cloudflare: website hosting and email forwarding. Privacy policy
• Google Fonts (website only): typefaces. Privacy policy

We may also disclose information if required by law (for example to comply with a subpoena or similar legal process), or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

6. Legal basis (EEA and UK users)

Where the GDPR or UK GDPR applies, we process personal data on these bases: contract, to provide the subscription and the content you use; consent, for the optional “How did you hear about us?” answer and for emails you choose to send; and legitimate interests, to keep the service secure, prevent fraud and keep it working. You can withdraw consent at any time (see section 9); this does not affect processing that happened before.

7. International transfers

Our service providers may process data in the United States and other countries. Where personal data from the EEA, UK or Switzerland is transferred, it is protected by an appropriate safeguard such as an adequacy decision or the European Commission’s Standard Contractual Clauses.

8. How long we keep data

• On-device data: kept on your iPhone until you delete it in the app or delete the app.
• Subscription records at RevenueCat: kept while your subscription is active and afterwards as long as needed for accounting, tax and fraud-prevention duties, then deleted.
• Server and website logs: kept for a short period by the hosting providers for security, then deleted.
• Support emails: kept while needed to help you, and deleted within 24 months of the last message.

9. Deleting your data and withdrawing consent

• Everything on your iPhone: open the app, go to Settings and tap Delete all my data. Deleting the app also removes it.
• Your subscription record and “How did you hear about us?” answer: email support@lymiflow.com and ask for deletion. We will delete it from RevenueCat, usually within 30 days. Because the record is anonymous, include the date you subscribed so we can find it, or use Restore purchases first and tell us.
• Emails: ask us to delete your messages at support@lymiflow.com.
• Withdrawing consent: you can stop any further collection at any time by deleting the app. To withdraw consent for data already sent, email support@lymiflow.com and we will delete it. Cancelling a subscription is done in your iPhone’s Settings and does not by itself delete data.

We respond to requests within one month, extendable by two months where the law allows for complex requests, and we never charge for them.

10. Your rights

Wherever you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent. Email support@lymiflow.com; we may need to ask for details to verify the request.

EEA and UK residents may also complain to their local data protection authority (EU authorities, UK ICO).

California residents have the right to know, delete and correct personal information, to opt out of its sale or sharing (we do neither), to limit the use of sensitive personal information (we use it only to provide the app), and not to be discriminated against for using these rights. You may use an authorised agent.

11. Children

The Application is meant for adults and is not directed to children. We do not knowingly collect personal data from anyone under the age of digital consent in their country. If you believe a child has sent us personal data, email support@lymiflow.com and we will delete it.

12. Security

On-device data is protected by your iPhone’s own security and encryption. Data sent to our providers travels over encrypted connections (HTTPS). Access to service accounts is limited to the developer. No system is perfectly secure, but if a breach affecting your personal data occurs, we will notify the relevant authority and, where required, you, within the timeframes set by law.

13. Changes to this policy

We may update this Privacy Policy. The “Last updated” date above will change, and material changes will also be noted in the app’s release notes. Where the law requires, we will ask for your consent before a material change takes effect. Earlier versions are available on request.

14. Contact

Devan Hedglin, developer of Lymiflow
support@lymiflow.com