Privacy Policy
Velune is a routine and skincare companion. It is built to keep your information on your phone. This page says what stays there, what can leave it, and what you can do about it.
The short version
- You can use Velune for 30 days without an account, an email address or a payment card.
- Your routines, notes, products and photos are stored on your phone.
- We do not sell your information, and we do not show ads.
- Velune does not score your appearance and does not diagnose anything.
What stays on your phone
Routines and steps, reminders, streaks, journal notes, photos, your shelf and wishlist, your settings, your display name and your profile photo. The database is encrypted on your phone. Your profile photo is a file in Velune’s own folder, never in your Photos. We cannot read any of it, and “Delete all data” removes all of it.
When you share a link, some text or a picture to Velune from another app, it is read on your phone: the product name comes from the words you shared or from the web address, and Velune never opens or downloads the link. Nothing is saved until you check it and press Save.
What can leave your phone
| What | When | Where it goes | Why |
|---|---|---|---|
| Chat messages, and the notes you allow it to remember | If you use the chat | Our server on Cloudflare, then the AI provider DeepInfra | To write replies. See “AI chat” below |
| Your voice, as audio | Only while you hold the microphone button to talk to Velune | Your phone’s own speech service (Apple or Google), which may process it on their servers | To turn your speech into text. We do not receive or keep the audio |
| Product photo | If you scan a product | Our server on Cloudflare, then DeepInfra | To read the product’s name and details. It is not stored after the answer |
| Purchase confirmation | If you subscribe | Apple or Google, and our server | To confirm your plan. We never see your card number |
| An anonymous device check | During the free trial, when you use online features | Our server, using Apple App Attest or Google Play Integrity | To give the 30 free days once per device. It contains a random installation number and no name, email or photo |
| Anonymous usage counts | Only if you turn on “Share anonymous usage” | Velune’s own analytics server (run on Cloudflare) | To count feature use, session length and a few fixed moments (such as finishing a routine, opening the plan screen, using a timer or adding a photo), so we can see what helps people keep going. It contains a random installation ID, fixed event names, times, platform and app version. Raw events are removed after 90 days |
Nothing is uploaded when you take a photo or write a note. Share pictures, including wishlist cards, are made on your phone from product names only. When you share to Instagram or TikTok, Velune hands the picture to that app; you post it yourself and that app’s own policy applies. The Spotify button only opens Spotify (the app or its web page); Velune does not connect to your Spotify account and Spotify’s own policy applies. Music inside Velune plays from files stored in the app.
Accounts, sync between phones and cloud photo backup are not offered yet. If we add them, we will update this policy and ask you before anything is uploaded.
AI helpers
Velune has a few optional AI helpers, such as “Let Velune write it” for a new routine, reading a product or a shared picture, and suggesting steps. There is no open chat. The first time you use one you are told it is an AI and asked to agree. What is sent is only what that one request needs: the answers you chose on that screen, or the picture you gave it. Your name, notes, journal and saved photos are not sent. Nothing the AI suggests is saved until you confirm it. Our server keeps counts of requests, not their text; the AI provider handles each request and may keep some briefly for debugging. The AI can make mistakes. It gives ideas, not medical advice.
Open counts
Each time Velune opens, it adds one to a counter on our server. The counter is filed only under the day, how many days old your install is (in groups such as “4 to 7 days”) and whether the phone is an iPhone or Android. There is no ID, no account, no location and no IP address kept, so the number cannot be traced to you. We use it to see how many people keep coming back. It needs no setting because it contains nothing about you.
The iPhone waitlist
If you leave your email on our website to hear when Velune reaches the App Store, we keep that address and the day you added it, and use it once to tell you. Nothing else is collected there. Write to hello@velune.phinneas.me and we remove it.
Permissions
- Camera: only when you take a photo after a routine or scan a product.
- Photos: only to add photos you choose, or to save a picture you chose to share.
- Microphone: only while you talk to Velune.
- Notifications: only after you ask for a reminder. Reminders are made on your phone.
Who we share with
Service providers that run the parts above (Cloudflare for our server, DeepInfra for AI replies), Apple and Google for purchases and device checks, and authorities if the law requires it. We do not sell or rent your information. We do not use advertising identifiers, cross-app tracking, device fingerprinting or precise location.
How long we keep it
On your phone: until you remove it. Our server passes chat messages and product photos to the AI provider and does not store them; it keeps only daily message counts for fair-use limits, for 90 days. Device check results: one hour. Usage counts: 90 days. What DeepInfra keeps is set by its own policy. Chat memory stays on your phone until you remove it.
Your choices and rights
You can export your data and clear everything on your phone in the app (Settings › Privacy and security › Privacy and storage). Depending on where you live (for example the UK and EU under GDPR, or California and other US states) you can also ask us to access, correct, delete or move your information, and to stop certain processing. Write to hello@velune.phinneas.me. If you are in the EU or UK you may complain to your data protection authority.
Children
Velune is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has given us any, write to us and we will remove it.
Security
Data on your phone is encrypted. Data sent to our server travels encrypted. No system is perfectly secure.
Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect.