Vina Privacy Policy

Last updated: 08/10/2026

1. Data controller

• Application: Vina
• Controller: Héctor López Roldán (HLR Studio)
• Contact email: hello@hlrstudio.dev
• Location: Zaragoza, Spain

This Privacy Policy explains how the personal data of people who use the Vina mobile application (hereinafter, "the App") is collected, used and protected.

Vina is designed to help you remember to take or use a contraceptive method, and to show information related to your cycle.

2. Data we process

Depending on how you use the App, we may process the following categories of data. Some of them are special category data (health data) within the meaning of Article 9 GDPR (contraceptive method, cycle, symptoms, mood), which receive reinforced protection.

2.1. Health and usage data you enter (local storage)

By default, this data is stored locally on your device (local Hive-type databases and system preferences):

• Chosen contraceptive method (e.g. pill, ring, patch, injection, IUD, implant).
• Cycle configuration (active days, break days, cycle start, IUD or implant insertion/removal dates, etc.).
• History of recorded periods.
• Health check-ups you set up (gynecological check-up, cervical screening, prescription renewal, STI test, self-exam, or any you create), how often they repeat, and any notes you write on them.
• History of completed check-ups: type, date, and any notes or results you choose to record.
• Notes, mood and symptoms you record.
• Adherence log (whether you took or used the method, streaks, percentages).
• Reminder schedule and language, theme and notification preferences.

The App can be used without creating an account. In that case, what you log (cycle, periods, doses, notes, symptoms, check-ups and medications) stays on your device. The only things that leave it are those described in section 2.3 (usage analytics, errors and advertising) and, only if you turn them on, partner mode (2.4) and the Health integration (2.5).

2.2. Account and cloud sync (optional — only if you sign in)

If you choose to sign in with your Google account to back up and sync across devices:

• Firebase Authentication is used. By default the session is anonymous (a technical identifier with no personal data); when you link Google, your account's email address and name are stored.
• All the history described in section 2.1 (cycle, method, periods, notes, mood, symptoms, adherence, and health check-ups with their history) is uploaded and synced to the cloud via Cloud Firestore, associated with your user identifier, so that it is available on your devices and as a backup.
• You can disconnect the account and delete all your data (local and in the cloud) from the App's Settings.
• You can also sign in with Apple: the email address (or Apple's private relay address) and the name Apple shares are stored.
• The "Delete my data" option erases your history on the device and in the cloud and also deletes your account (your email and name are no longer stored); if you signed in with Apple, Vina's access to your Apple ID is also revoked.

2.3. Technical and usage data (analytics, errors, advertising)

The App uses Google/Firebase services:

• Firebase Analytics: usage statistics. Events include the contraceptive method you have set up (for example, pill or implant) and usage actions, such as marking a dose, logging a period or opening a screen, with the time you use the App. They do not include the dates you log, the text of your notes, your symptoms or your mood (at most, how many symptoms you ticked). The most sensitive data is sent grouped: the reasons you stop a method do not distinguish "trying to get pregnant" or "menopause", incidents with your method do not say which one, and check-ups do not distinguish the STI test.
• Firebase Crashlytics: logging of technical errors and crashes.
• Google Mobile Ads / AdMob: advertising for the free version.

These services may automatically collect device and advertising identifiers, system version, model, language, approximate country and technical events. In the European Economic Area, advertising is governed by your choice in the consent notice shown in the App (see section 4); if you do not consent, non-personalised ads are served or processing is limited.

2.4. Partner mode (optional)

If you enable partner mode to share information with another person, a summary of your cycle (cycle day, phase and estimated next period) is published to the cloud for that person to consult. Mood and symptoms are only shared if you expressly enable them (they are off by default). Your notes and your health check-ups or their history are never shared. You can revoke access at any time, which removes the link on both sides. Vina does not send alerts to your partner: they see what you share when they open the App.

2.5. Health integration (optional)

If you enable it, the App can write and read menstrual flow data in Apple Health (iOS) or Health Connect (Android). This integration is off by default and requires your explicit consent through the operating system.

2.6. Premium subscriptions

Subscription management (purchase, restore) is handled through RevenueCat and the app stores (App Store / Google Play), which process the identifiers needed to validate the purchase. We do not process or store your payment card details.

2.7. Other medications (optional)

If you use the Other medications section, which asks for your explicit consent before saving anything, the App stores the medications you add (name, dose, schedule, stock and the doses you mark) and, if you use them, the family member profiles you manage them for. They are stored on your device and, only if you have connected an account, also in the cloud as a backup. They are never used for advertising, and analytics only receives counts, never names, doses or times. If you add someone else's medications, make sure they agree. You can withdraw consent and delete everything from the section itself ("Delete all my medications") or with "Delete my data".

Under no circumstances do we sell your personal data to third parties.

3. Purposes of processing

We use the data for the following purposes:

1. Providing and maintaining the App
   • Saving your contraceptive method and cycle configuration.
   • Showing you the "Today" section, the calendar and other personalised data.
2. Local reminders and notifications
   • Scheduling notifications on your device at the configured time.
   • Reminding you to take or use your contraceptive method.
3. Improving the quality of the App
   • Analysing in aggregate how the App is used (Firebase Analytics).
   • Detecting technical failures and errors (Crashlytics).
4. Advertising (where enabled)
   • Showing ads via Google AdMob.
   • Where applicable, personalising advertising according to your consent settings (for example, non-personalised ads in the EU if so configured).

4. Legal basis for processing

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), the legal bases are:

• Performance of a contract / provision of the service (Art. 6(1)(b)) To provide you with the App's core functionality (saving your configuration on the device, showing your cycle, scheduling reminders).
• Explicit consent for health data (Arts. 6(1)(a) and 9(2)(a)) Processing your special category data (cycle, method, symptoms, mood) beyond your own device requires your explicit consent. Specifically:
• Cloud sync of your health history only happens if you voluntarily sign in (section 2.2).
• Partner mode only shares information if you enable it, and mood/symptoms only if you expressly enable them (section 2.4).
• The Health integration only works if you enable it and grant the system permission (section 2.5).

You can withdraw your consent at any time: by disconnecting the account, revoking partner mode, disabling the Health integration, deleting your data from Settings, or uninstalling the App.

• Consent for advertising (under ePrivacy/GDPR rules) For personalised advertising in the EEA, via the consent notice shown in the App. You can review your choice by returning to that notice.
• Legitimate interest (Art. 6(1)(f)) To keep the App secure, prevent abuse and errors, and produce aggregated usage statistics that do not include your health data.

5. Data retention

• Data stored on your device (cycle, method, histories) is kept for as long as you have the App installed or until you delete the data or uninstall the App.
• If you have signed in, your synced history is kept in the cloud (Cloud Firestore) until you use the "Delete my data" option in Settings or request its erasure. Important: uninstalling the App deletes local data, but not the cloud copy; to delete it, use "Delete my data" before uninstalling, or write to us.
• Technical and usage data managed by Firebase and similar services is retained in accordance with each provider's policies, applying reasonable retention and anonymisation periods as far as possible.

The "Delete my data" option erases your history both locally and in the cloud, revokes partner links and deletes your account.

6. Disclosure of data to third parties

We do not sell your personal data to third parties.

However, in order to provide the service, we work with the following processors / providers:

• Google LLC and its affiliates — Firebase Authentication, Cloud Firestore, Firebase Cloud Messaging, Firebase Analytics, Crashlytics, Remote Config and Google Mobile Ads (AdMob). They host the account, the cloud sync of your history (if you sign in), the partner mode summary, push notifications, analytics, error logging and advertising.
• RevenueCat, Inc. — premium subscription management.
• Apple Inc. and Google (Health Connect) — only if you enable the Health integration, to read/write menstrual flow on your device.
• Apple App Store / Google Play — processing of subscription payments.

In addition, in partner mode, the person you authorise will be able to see the cycle summary you share (this is not a "provider", but another user to whom you grant access; you can revoke it whenever you want).

These services may process data on servers located outside the European Economic Area. Their providers state that they apply appropriate international transfer mechanisms in accordance with the GDPR (for example, the EU Standard Contractual Clauses).

Should other providers be used in the future, this Privacy Policy will be updated to include them.

7. International transfers

When using services such as Firebase or AdMob, international data transfers may take place (for example, to the United States or other countries).

In such cases, we seek to ensure there is an appropriate legal basis, including, where applicable:

• The signing of Standard Contractual Clauses approved by the European Commission.
• Other safeguards recognised by the GDPR.

8. Your rights

As a user, you have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Request the erasure of your data (right to be forgotten).
• Request the restriction of processing.
• Object to processing where the legal basis is legitimate interest.
• Request data portability, where applicable.

You can exercise these rights by contacting the controller at: hello@hlrstudio.dev Please state clearly which right you wish to exercise and, where necessary, provide the information needed to identify you.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

9. Minors

The App is intended for adults. If you are under 14, you must use the App with the consent and supervision of your mother, father or legal guardian.

If it is detected that data from a minor has been collected without the corresponding consent, we will attempt to delete it as soon as possible.

10. Security

Reasonable technical and organisational measures are applied to protect the data:

• Use of standard security mechanisms of the systems hosting the services (such as Firebase).
• Regular updates of the App to fix errors and vulnerabilities.

No system is completely secure, but we will work to minimise the risks.

11. Changes to this Privacy Policy

This Privacy Policy may be updated to reflect changes in the App, in legislation or in the services used (for example, new providers).

In the event of significant changes, we will try to inform you through the App itself or by other reasonable means.

12. Contact

For any questions about this Privacy Policy or about the processing of your data, you can write to:

hello@hlrstudio.dev