Your photo diary stays on your iPhone. Lavenda does not upload your photos, score your face, create facial measurements or use your photos to train a model.
You control what you keep, delete and export. An export includes photos and leaves the app only when you choose a destination. If you contact support, we receive the text and optional contact details you choose to send.
This policy covers the Lavenda iPhone app and this website. “We” and “us” refer to the operator identified below. It explains how information is handled; it does not turn use of the app into consent for optional tracking or permissions.
1. Face data and other information on your iPhone
Face data: your photo diary
Your diary contains photographs of your face. The app captures and stores these photos on your iPhone; this is different from sending them to us. Here is what happens to that information:
- Collection and use. When you choose to take a diary photo, Lavenda uses the camera with your permission. It keeps the photo and its capture date locally so you can view and compare your own photos. Local file details include the file size, pixel dimensions, file identifiers and a checksum used to check file integrity. Image preparation for storage and display happens on the device.
- Facial measurements and biometric data. Lavenda does not perform facial recognition, identify or authenticate you from a photo, or create or store faceprints or biometric templates. It does not compute facial landmarks, facial measurements or attractiveness scores. Lavenda does not use your diary photos to train AI or machine-learning models.
- Sharing and third-party AI. Taking, storing, viewing and comparing diary photos does not transmit them or their diary records to our servers, analytics or subscription providers, or any third-party AI service. Lavenda does not use cloud or third-party AI processing for the diary. The separate export you can choose is explained below.
- Storage. Photos and diary records stay in the app's private storage on your iPhone, protected by iOS file protection and excluded from device backups. Lavenda does not save diary photos to your camera roll.
- Retention and deletion. Photos are kept locally until you delete them. You can delete individual photos in the diary, delete all photos, or delete all local data using the app's data controls. Deleting the app also removes its local diary. These controls do not require a subscription. There is no copy of your diary on our servers for us to retrieve or delete.
When you choose to export. Your data export includes diary photos and their records. Nothing is shared with a recipient merely by taking or viewing a photo: you choose a destination using the iOS share sheet. That recipient or service then handles the exported copy under its own rules. Deleting the diary later does not delete copies you have already saved or shared elsewhere.
You can refuse camera permission or revoke it in iPhone Settings. This stops Lavenda from taking new camera photos; it does not give us access to existing photos or prevent you from using the app's data-deletion controls.
Practice, preferences and schedule
The app stores lesson progress, practice history, your selected schedule, settings and confirmation of the current safety rules on your device. The safety confirmation records agreement with the rules; it is not a medical assessment. Local reminders use iOS notifications only if you allow them.
Local photos and records are not an online backup. Do not assume they will return after deleting the app, erasing data or moving to another phone.
2. Online services and app versions
Lavenda's online services are separate from its local diary. When a version connects to those services, they can receive an installation identifier and session credentials, technical app and device information, the selected lesson schedule, subscription status and the limited usage events described below. Diary photos and the contents of support messages are never part of app analytics.
The current development app has not activated Sign in with Apple, purchases, product-analytics or advertising-attribution SDKs. These integrations are planned; listing a provider below does not mean the current app sends it data. We will update this policy to describe the actual fields, enabled services and deletion process before enabling them for users.
Installation identifiers distinguish an app installation from another installation; they are not a name or email and do not make information necessarily anonymous. If Sign in with Apple becomes available, the app will explain what account information is requested. Sign-in will not upload the local diary.
3. Support messages and this website
When you submit the support form, we receive your subject, message, page language and, only if you provide them, a reply email and diagnostic code. We record the submission time and a random ticket identifier. The code is a troubleshooting reference, not proof of identity or permission to access an account. We do not attach your diary, practice archive, photos or account credentials to a request.
The form accepts text only and has no attachment upload. Please do not send passwords, payment credentials, photographs or sensitive health information. Your message is used for support and is not sent to product analytics or advertising services. Without a reply email, we may be unable to contact you about the request.
The site uses your network address to deliver pages and limit repeated requests. The address is not stored in a support ticket. Anti-abuse counters are temporary. This website does not set analytics or advertising cookies, load tracking pixels, use an external font service or save your form draft in browser storage. A failed submission leaves your text in the open form; reloading or leaving the page may lose it.
Links to Apple or another external service take you to that service, which handles the visit under its own privacy policy.
4. Service providers
Apple provides iOS permissions, device security, distribution and App Store payment services. Apple processes any App Store payment under its own terms; Lavenda does not receive your card details. Providers planned for connected app features are:
| Provider | Limited purpose, when enabled |
|---|---|
| RevenueCat | App purchase and entitlement status, associated with an app identifier, to confirm subscription access. |
| Amplitude | Product usage events such as screens viewed and lesson actions, with bounded technical properties. No diary photos or support-message text. |
| AppsFlyer | Installation and campaign attribution. An advertising identifier may be used only after the relevant iOS tracking permission. Refusing tracking does not remove paid access. |
Sentry crash reporting and OneSignal marketing notifications are not active in the current app.
We do not sell diary photos or support messages, and do not use them for advertising. Where a provider processes information on our behalf, we require protection consistent with this policy and applicable law, and limit access to its stated purpose. We may disclose information if required by law, to protect legal rights or to address abuse, with appropriate safeguards.
5. Why information is used
- To provide the features you choose: local lessons, history, reminders, the diary and, when enabled, subscription access and connected services.
- To handle your support request, diagnose the reported problem and reply if you supply contact details.
- To protect the service against abuse and comply with applicable legal obligations.
Where data-protection law requires a legal basis, we rely on performing the service you request, proportionate legitimate interests in support and security, legal obligations, or consent where required. Optional device permissions and tracking are choices of their own. You may withdraw consent without affecting the lawfulness of earlier processing.
6. Retention and deletion
- Local diary and practice records: retained on your device until you delete them. The app provides separate controls for deleting all photos and all local data. All-local-data deletion also clears practice history, the schedule, safety confirmation and app-managed export archives.
- Exports: the app removes its temporary export archive after the sharing flow. Copies you have saved or sent elsewhere remain under your or the recipient's control and are not removed by an in-app reset.
- Support correspondence: retained for up to 180 days from submission. You can request earlier deletion using the support form and your ticket reference or reply address. We may ask for proportionate verification; the ticket number alone is not authority to disclose a message.
- Connected services: local reset does not itself prove deletion on a server, from an Apple Account or at another provider. Ask support about server-side information. We do not promise completion of provider deletion before it has been confirmed, or a backup-expiry period that has not been established.
Deleting data or the app does not cancel an App Store subscription. Manage subscriptions with Apple. Apple's payment records are subject to Apple's retention obligations.
7. Your choices and rights
You can decline optional camera and notification permissions, turn them off in iPhone Settings, remove photos or local data, and choose whether to export anything. A support email and diagnostic code are optional. The photo diary and data deletion do not require a subscription.
Depending on where you live, you may have rights to access, correct, erase, restrict or object to processing of personal information, receive portable information, withdraw consent, and complain to a data-protection authority. Contact us to exercise them. We cannot retrieve a diary photo from our servers because the diary is not uploaded.
8. Security and international processing
We use access restrictions, limited collection and iOS file protection to protect information. No system is completely secure. Keep your device secure and review the destination before sharing an export.
Information you choose to send to an online service may be processed outside your country. Before activating an external processor, we establish the required contractual and transfer safeguards. This policy does not claim a particular hosting country or backup lifetime for services that are not yet deployed.
9. Adults only
Lavenda is intended for adults aged 18 and over. We do not knowingly solicit personal information from children. Contact us if you believe a child has submitted personal information through support.
10. Updates and contact
We update this policy when processing changes and change the date above. We provide appropriate notice of material changes and obtain consent where required. Continuing to use the app does not by itself grant permission for optional tracking.
Contact us through the support form or at support@lavenda.fit.