Privacy Policy
Last updated 8 October 2026
Vaeli is a daily assistant: it keeps your timetable, your tasks and your things, and talks with you about them. To do that, it stores what you tell it. This page explains exactly what, where it lives, and how to take it back or erase it.
The short version. We store your email address, your tasks, timetable, notes and your conversation with the assistant. Text is sent to Anthropic's model so it can reply — and is not used to train it. Photos you take are not stored on our servers; pictures of your things stay on your phone. Subscriptions are paid through Google Play (or the App Store) and managed for us by RevenueCat; we never see your card. We show no advertising, sell nothing, and run no analytics on this site. Calendar and health connections are made only by you, read-only, and disconnect with one button. You can delete your account from inside the app, completely and immediately.
Who is responsible
Vaeli is run by an individual developer based in the United Kingdom, who is the data controller for the purposes of the UK GDPR. For anything in this document, write to privacy@vaeli.uk.
What we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Email address and password (stored as a hash, never as text) | So you have an account and can sign in | Performance of a contract |
| Name and profile picture, if you sign in with Google | So we can address you by name | Performance of a contract |
| Name and email address, if you sign in with Apple — the address may be Apple's private relay address — and the Apple token we use to revoke that sign-in when you delete your account | So you have an account, and so deleting it also disconnects Apple | Performance of a contract |
| Tasks, timetable, inventory, daily routine, study topics | This is what the app is for | Performance of a contract |
| Hours of sleep and a mood score from 1 to 5, if you note them on the Today screen | To show how your sleep and mood change over two weeks, and so the assistant can allow for a short night or a hard stretch | Explicit consent: noting them is optional, and skipping them changes nothing else |
| Your conversation with the assistant and what it remembers about you | So it answers with context rather than from scratch | Performance of a contract |
| Mock exam answers — typed, or photographed by you and turned into text — and the marks and comments the assistant gives them | To mark your practice papers; details under “Camera and photos” | Performance of a contract |
| Exam practice: photos of your handwritten answer to a single timed exam question, your typed answers to short drills, and the mark, level and comments the assistant gives them, with the gaps they show | To mark a practice question against the exam board's level grid and set drills on the mistakes it finds; details under “Camera and photos” | Performance of a contract |
| Photos you take or choose for the app to read: a timetable or an item for your wardrobe (photos of exam answers are in the two rows above) | To read the timetable or suggest a name for the item; details under “Camera and photos” | Performance of a contract |
| Data from services you connect — calendar, sleep, steps and workouts; details under “Connections to other services” | To show them on your day, and so the assistant doesn't message you in the middle of a meeting | Consent, given when you connect the service |
| Your subscription: which plan you bought, when, its price and currency, when it renews or ends, and the store's purchase reference | To give you the plan you paid for and restore it on a new phone; details under “Purchases and subscriptions” | Performance of a contract |
| Device identifiers: the push token for your phone (Expo and Firebase Cloud Messaging), the Firebase installation ID, and a random identifier of this installation of the app | So reminders reach the right phone, and stop reaching it when you sign out | Consent, given when you allow notifications; legitimate interests for the installation identifier |
| Daily count of assistant requests | To enforce the daily limit | Legitimate interests |
| The date you allowed the app to send your data to the assistant | To show we asked before sending anything to the model | Legitimate interests |
| Reports you send about something the assistant wrote — a reply, study notes or flashcards, a mock exam question or its marking, an exam practice question, its marking or a drill, a weekly review: that text (with the question, for an exam), the reason and your note | To review replies that were wrong or harmful | Legitimate interests |
| A one-way fingerprint of your email address (SHA-256) and the date your free week ends | So the free week of Pro is given once per address | Legitimate interests |
| Technical error details | To fix what is broken | Legitimate interests |
We collect nothing outside this table: the sections below describe the same data in more detail and add nothing to it. The app has no advertising identifiers, no behavioural analytics, and no access to your contacts, location, calls or messages.
Where data is stored
- Your account — with Supabase (AWS infrastructure, Europe): email address, password hash, and the link to your Google account if you use one.
- Your day — tasks, timetable, assistant memory and conversation, and a summary of the sleep and mood you note — in Cloudflare Workers KV.
- Your subscription — the plan and its dates on your account in Supabase; the purchase history with RevenueCat.
- A copy on your phone. The app keeps its state locally so it works offline. That copy disappears when you uninstall the app.
Who we share data with
Only with processors the app cannot run without. None of them is permitted to use your data for their own purposes, and we never sell it.
- Supabase — accounts and sign-in.
- Cloudflare — the app's server and content storage.
- Anthropic — the model that writes the assistant's replies, marks mock exams and exam practice answers and reads handwriting from photos you take of your answers.
- RevenueCat — manages subscriptions: it receives your account identifier and your purchase history from the store and tells our server which plan is active.
- Google Play (and the App Store on iPhone) — takes the payment. Your card details stay with the store; we never receive them.
- Expo and Google (Firebase Cloud Messaging) — delivery of push notifications.
- Resend — service emails: address confirmation, password reset, and a copy of a report about an assistant reply to the developer.
- Google — if you sign in with Google, it tells us your email address, name and profile picture.
- Apple — if you sign in with Apple, it tells us your name and email address (or a private relay address that forwards to it).
Google Calendar is not on this list: we pass none of your data to it. We only read from it what you have allowed, for as long as the connection is on.
Some of these companies are located outside the United Kingdom. Such transfers rely on the standard contractual safeguards provided for by the UK GDPR.
The assistant and AI
The assistant's replies are written by a model provided by Anthropic. To answer, it receives what the answer needs: your question, your tasks and timetable for the day, the facts the assistant has remembered about you, a summary of the sleep and mood you have noted (today's values, two-week averages and the trend — not day by day), and — if you have connected a calendar or Health Connect — today's and tomorrow's meetings and a summary of your sleep and steps. Exactly what, and from where, is set out under “Connections to other services”.
This data is not used to train models. Anthropic acts as a processor under commercial terms and does not train models on data submitted through its API. Requests may be retained by it for a limited period to prevent misuse, and are then deleted.
A model's answer is text, not professional advice. It can be wrong. Decisions that carry a cost when they go wrong remain yours.
Camera and photos
The app can read a timetable from a photo and suggest a name for an item from a picture. The image is sent to the model, the result comes back, and that is all: the image is not stored on our server. A photo of an item stays on your phone as that item's picture, and in a backup only if you export one. Anthropic may keep the request for a limited period, as described under “The assistant and AI”. The app asks for camera and gallery access at the moment it is needed, and declining breaks nothing else.
Mock exams. You can answer a practice paper on paper and photograph your pages. The photos are sent to Anthropic's model to turn your handwriting into text; you check that text and correct it before anything is marked. Then your answers — as text — are sent to the model for marking, with the question and the mark scheme. The photos are not stored on our server, and the app does not keep them on your phone either — only the text you confirmed. Our server keeps no copy of your answers or marks: the attempt, the text of your answers and the marks live on your phone and in a backup you export yourself. Typing your answers instead of photographing them works the same way, without the photo step.
Exam practice. Separately from mock exams, you can answer a single timed exam question on paper and photograph your pages. The photos go to Anthropic's model together with the question and its mark scheme, and the model reads them and marks the answer in one step. The photos are not stored on our server; on your phone they stay only with the attempt in progress, not in the app's records or backups. Short drills on the mistakes the marking found are answered as text, and that text is sent to the model to be checked. Our server keeps the question, the marking and a drill's check for a short time — an attempt for up to 7 days, a drill for up to a day — so that a retry after a lost connection returns the same result without charging again, and it keeps a list of the questions you have already been given, so you are not given the same one twice. Your record of attempts, gaps and drills lives on your phone and in a backup you export yourself; a short summary of open gaps and your last few marks goes to the assistant, so it can remind you about a gap you have not practised.
Microphone and voice
You can say a phrase out loud and the app turns it into a reminder, a study block, a topic to revise or a note for the assistant. The microphone is on only while the voice screen is open, and only after you allow it. Speech is recognised by the phone itself, using the recogniser built into Android or iOS. No audio is recorded or sent anywhere: only the recognised text reaches us and the model, so it can tell which action you meant. Nothing is saved until you confirm the card showing the action. Declining microphone access breaks nothing else, and you can type the same phrase instead.
Notifications
If you allow notifications, your device token is stored so reminders have somewhere to go. Firebase, which delivers them on Android, also creates its own installation identifier on the phone. Next to the token we keep a random identifier of this installation of the app, so that signing out removes exactly this phone from the list. None of these is an advertising identifier or tied to the hardware: reinstalling the app creates new ones. Notification text passes through Expo and Firebase Cloud Messaging — otherwise it would not reach the phone. Revoking the permission in your phone settings stops delivery; signing out removes the phone from our list.
Purchases and subscriptions
Paid plans are bought through Google Play on Android and the App Store on iPhone. The store takes the payment, and your card or other payment details stay with it — we never receive them.
Subscriptions are managed for us by RevenueCat, acting as our processor. It receives from the store, and stores, your purchase history in the app: the product, price and currency, when you bought it, when it renews or ends, and the store's reference for the purchase. It knows you only by your Vaeli account identifier — not by your name or email address. RevenueCat tells our server which plan is active, and we keep that on your account: the plan, its renewal date and, if you cancelled, the date it ends.
Records of a purchase are financial records. The store keeps them as long as tax and accounting law requires, even after you delete your account, and we cannot erase them from the store. When you delete your account, our server also asks RevenueCat to delete its record of you.
Connections to other services
Under Settings → Connections you can connect Google Calendar and Health Connect where your version of the app offers them. The version on Google Play does not include Health Connect yet, and Google Calendar opens to everyone once Google has finished reviewing our access; until then those rows say “soon”, like the other rows on that screen, and do nothing. The same rules apply to every connection:
- a connection is made only by your action, and is switched off in the same place with one button;
- access is read-only: the app never creates, changes or deletes anything in the connected service;
- you give consent on the service's own page, in your browser, and we never see its password. Our server receives the access key and stores it encrypted; it never reaches the phone;
- the data is used to show you your day and to pick a time when you are free for the assistant's messages — and for nothing else.
| Service | What we read | Where it is kept | Does it reach the model |
|---|---|---|---|
| Google Calendar | The list of your calendars and their events from yesterday to two weeks ahead: title, time, location, busy or free, and your own response to an invitation. We do not read descriptions, guest lists or attachments. The address of your primary calendar, to show which account is connected | On our server, while the calendar is connected; refreshed when you open the app and when the assistant decides whether to message you | Yes, but little. When you write to the assistant — today's and tomorrow's meetings: title, time, location. When the assistant decides to write first — the time until which you are free and the title of your next meeting, so it doesn't write in the middle of it |
| Health Connect (Android) | Sleep with stages, steps, workouts, resting heart rate, heart rate variability, breathing rate and blood oxygen for the last 30 days | On your phone. Only a summary goes to our server: steps today and on average over the week, hours of sleep last night, minutes of deep and REM sleep, the type and length of today's workouts, the number of workouts this week, and today's resting heart rate and heart rate variability with their 14-day averages | Only that summary — so the assistant knows, for example, that last night was short |
How to disconnect. Settings → Connections → the service → Disconnect. For Google Calendar the server revokes access with Google itself and erases the key along with everything that was fetched. For Health Connect the app withdraws its permissions and erases everything it read from your phone; you can also withdraw them in Health Connect's own settings. Deleting your account disconnects every service the same way.
Specifically regarding Google services: Vaeli's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained from Google APIs is not transferred to third parties, is not used for advertising, and is not read by humans — except where you have explicitly asked us to, where it is necessary for security purposes, or where required by law. The calendar details listed above are passed to Anthropic's model only to write a reply to you, with Anthropic acting as our processor, and are never used to train any AI or machine-learning model.
How long we keep it
For as long as you have an account. An exam practice attempt with its marking is kept for up to 7 days, and a drill with its check for up to a day. A report about an assistant reply is kept for up to a year — enough to see whether the same problem repeats — and the copy emailed to the developer is deleted within the same year. When you delete your account, everything above is deleted immediately rather than on a schedule. Nothing is retained beyond that except purchase records, which the store keeps as the law requires (see “Purchases and subscriptions”), what the law otherwise requires us to keep, and one record: the fingerprint of your email address with the date the free week ended. The address cannot be recovered from it and it cannot be used to find you — it can only recognise the same address at a new sign-up, so that the week of Pro is not given twice. It is kept without a time limit. The full list of what is kept and for how long is on the account deletion page.
Deletion and export
Both live inside the app:
- Settings → Account → Delete account. Erases the account and all of its content on the server.
- Settings → Backup. Exports your state as a file you can read yourself, not only a program.
No longer have the app? Email privacy@vaeli.uk from the address you sign in with and we will delete the account within 30 days. Step by step: vaeli.uk/delete-account-en.
Your rights
Under the UK GDPR you have the right to obtain a copy of your data, correct it, delete it, restrict or object to processing, receive it in a portable form, and withdraw consent where processing relies on it. Write to privacy@vaeli.uk and we will respond within one month.
If our answer does not satisfy you, you may complain to the UK supervisory authority, the ICO.
Age
Vaeli is intended for people aged 16 and over. We do not knowingly collect data from children under 16. If we learn that an account belongs to a child, we will delete the account and its data.
Security
Everything travels over HTTPS. Passwords are stored as hashes. Access to your rows is restricted by the database itself: another person's key will not open your data. Nobody has perfect security, and we will not promise it.
This website
This site carries no analytics, no advertising networks, no trackers, and no cookies set by us. Cloudflare, as the host, keeps technical request logs, which are necessary to operate and protect the site.
Changes
If this policy changes, a new date will appear at the top, and we will announce material changes in the app before they take effect.