Privacy Policy

Effective date: 20 July 2026 · Last updated: 7 October 2026

1. Who we are

Vatriq ("Vatriq", "we", "us") is a family-coordination mobile app. A household ("family space") uses it to share schedules, meals, groceries, tasks, finances, wellness notes, and a family bulletin.

• Data controller: Optimum Software Development SRL, a company registered in Romania.
• Privacy contact: [email protected]
• Lead supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), Romania's data protection authority — www.dataprotection.ro.
• Data Protection Officer: not appointed. A formal DPO is assessed as not mandatory at launch scale (Art. 37); the named privacy contact above handles requests.
• EU representative (Art. 27): not required — the controller is established in the EU.

We do not show ads, do not sell your data, and do not share your data with third parties for their own marketing. Vatriq is funded by subscriptions only.

2. The data we process, and why

We only collect data needed to run features your household actually uses. There is no speculative collection and there are no advertising identifiers. The app does not collect your device's location (no GPS, no location permission): the only "location" is text you type yourself, such as an event location or an away-status.

Lawful-basis legend (GDPR Art. 6 / Art. 9): 6(1)(b) = performance of our contract with you · 6(1)(f) = legitimate interests · 6(1)(c) = legal obligation · 9(2)(a) = your explicit consent (special-category data).

Calendars you connect (optional)

Any member of a space can add an outside calendar so that its events appear, read-only, in the space's calendar. Nothing is imported unless someone adds a calendar. There are two kinds:

• A calendar feed address (an "ICS" or "iCal" link, such as a school or club calendar, or the private address of your own Apple or Google calendar). Our server fetches the address you give us. We store the address itself, so treat a private calendar address like a password: anyone who has it can read that calendar.
• Your Google Calendar (Connect Google Calendar). You sign in to Google and allow Vatriq to view your calendars (Google's read-only calendar permission). We cannot create, change or delete anything in your Google Calendar. We read your list of calendars (to let you pick one), your Google account's email address (shown so you can tell which account is connected), and the events of the one calendar you pick, from 30 days ago to one year ahead. We store your Google access grant (a refresh token) encrypted, the id of the calendar you picked and that email address.

From either kind we keep only each event's title, start and end time, location and whether it lasts all day. We do not keep event descriptions or guest lists. The imported events are visible to every member of the space, so only connect a calendar whose events you are happy for them to see. We refresh them about once an hour, replacing the previous copy. Imported events are never sent to our AI provider.

How long we keep it, and how to remove it:

• The member who added a calendar, or an Admin, can remove it; removing it deletes the stored address or Google grant and every event imported from it. Pausing a calendar hides its events but keeps them, so turning it back on shows them again.
• A calendar you added is also deleted, with its events, when you leave the space, are removed from it, use "sign out everywhere", or delete your account, and when the space itself is deleted.
• When the last Vatriq calendar using a Google account is removed (by you, by leaving or being removed from the space, by signing out everywhere, or by deleting your account), we delete our copy of the grant and ask Google to withdraw Vatriq's permission. If Google cannot be reached at that moment, or another calendar in Vatriq still uses the same Google account, the permission stays; you can always remove Vatriq yourself under "Third-party apps & services" in your Google Account (myaccount.google.com/permissions).

Google is not our processor here: your Google account is yours, and Google provides your calendar to us at your request. Vatriq's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Special-category (health) data — cycle, mood, and allergens

Menstrual/cycle data, mood entries, and allergen data are special-category data under GDPR Art. 9. We process them only with your explicit consent (Art. 9(2)(a)):

• Cycle and mood tracking are off by default and opt-in. Until you consent, the feature is inert (the app returns nothing for it).
• Your consent is recorded (policy version, timestamp) and is revocable at any time. On withdrawal, the relevant endpoints stop returning data and you are offered deletion of that data.
• Discreet by default: cycle data is visible only to you unless you explicitly choose to share a low-detail "low energy" status with your family. Lock-screen notifications use generic wording and never reveal health content. An optional biometric lock protects private data.
• Age 16 and 17: an account holder aged 16 or 17 gives (and can withdraw) this consent themselves, in the same way as an adult (§5).
• Allergen safety carve-out: to protect life-threatening allergies, an in-family allergen warning always fires when a conflict is detected, but a non-consenting member's identity is hidden in that warning so their health status is not disclosed.

4. AI features and how we protect you

Some features (meal/task/schedule suggestions, grocery parsing, magic import, the weekly summary, onboarding starter pack) use a cloud AI model to generate suggestions. To do that, the content the feature works on — for example the titles and descriptions of your tasks, events and chores — is sent to our AI processor.

• Family members' full names are replaced before anything leaves our servers. Every prompt passes through a scrubbing step that replaces the full display name of each member of your family space with a placeholder (such as "Member1"), and the real names are put back only in the answer shown to you. Only a member's full name is replaced. A first name or surname written on its own is sent as written, and so is a name stuck directly onto a digit or onto the letters of a language written with spaces (such as a German genitive like "Annas") or changed by grammar. A name written directly against Chinese, Japanese, Korean or Thai text is replaced, except a very short name. Other names you type — for example a child's, since children do not have accounts (§5) — are sent as written too.
• Email addresses, phone numbers and street addresses are removed from the text a prompt carries — both what you paste or type into a smart-entry or import feature and the things already in your space that a suggestion, plan or optimisation is built from (titles, list items, names of recipes and categories). This works by recognising their format, so an unusually written one can get through. Text you paste or type that looks like health information is not sent at all.
• Never sent: a member's date of birth, age, or role in the family space.
• Health data (mood, cycle) enters an AI prompt only with that member's active consent (§3), and then without names. Each entry is described by how long ago it was (for example "2 days ago") rather than by its date, but a suggestion request also states today's date, so the AI processor can work out the date of each entry.
• We use Groq for inference (see §7). We do not store the prompts we send. Suggestion cards are stored until they are regenerated (usually within 2–7 days) or until you delete your family space or account; other AI answers expire from a short-lived cache within 24 hours. Whether Groq itself keeps or uses prompts (for example to train its models) is set by Groq's own terms, which we are still confirming; we will state the confirmed position here once our agreement with Groq is signed.
• AI in this space (on/off, for the whole space). Each family space has one switch, under Space settings → "AI in this space", on by default. An Admin or a Parent of the space can turn it off or on; the app asks them to confirm either way. When it is off, from now on nothing from that space is sent to our AI provider, from any member's device and from the overnight preparation: suggestion cards, the weekly summary's text, wellness insights, smart entry, Magic Import, the starter pack and the recipe / meal / prioritise / optimise helpers stop for everyone in the space, and everything that does not need AI keeps working. Suggestion cards already prepared for the space are deleted when it is turned off, and AI answers kept in our short-lived cache from before a change are not served again, even if AI is later turned back on. Data sent before it was turned off cannot be recalled from the provider, and a request already in progress at that moment may complete and return its answer to the person who asked; that answer is not cached and is never shown to anyone else (a duplicate-request safeguard can return the same answer to the same person for up to 5 minutes). Your other spaces are not affected.
• Who sees what. Every member of the space can see whether it is on, who last changed it and when. Turning it back on tells the space's other members, in their in-app notifications. If you are not an Admin or a Parent and want it off, write to [email protected] (§9): we can turn it off for the space and lock it, and we won't tell the other members it was you (they see only that it was turned off after a privacy request). You can also leave the space.
• "Show AI suggestions on this device" (App settings) only hides the suggestion cards on that device. It does not stop your space's content being sent to our AI provider; that is set for the whole space under "AI in this space". Push-notification wording is written from fixed templates without sending your space's content to our AI provider, so it does not depend on either switch.
• Between 20 August and 14 September 2026 a second provider (Google Gemini) was configured as a fallback for times when the first was unavailable, and received a small share of scrubbed prompts. It is currently disabled. We will not re-enable it, or add any other AI provider, without updating this policy first.

5. Children and teenagers

• Accounts are for people aged 16 and over. When you sign up with email we ask for your date of birth and refuse the account if you are under 16. If you sign up with Google or Apple we do not ask for your date of birth; instead, by continuing you confirm, in the line shown under those buttons, that you are 16 or older and accept the Terms and this policy.
• There are no child accounts and no child profiles. Children may not create accounts, and the app has no separate profile for a child. If we add parent-managed child profiles in the future, we will update this policy before they are available.
• Your family's content may mention children. Tasks, events, chores, meals, lists and messages are text that you and the other members type, and that text can name or describe a child. When an AI feature uses it, it is processed as described in §4: members' full names are replaced with placeholders, but a child's name is sent as written, because children are not members. Please avoid typing details about a child that you would not want processed in this way.
• 16- and 17-year-olds can use the optional health features, and the AI wellness suggestions built on them, by giving their own explicit consent (§3). That data is used only with consent, and is sent to the AI processor without names; the AI processor can work out the date of each entry, as explained in §4.
• No ads, no sale of data. We do not show ads, sell data, or use anyone's data — including information about a child mentioned in your content — for advertising.
• Analytics: product analytics are not active (§11).

6. Who your data is shared with

We share personal data only with the service providers (processors) that operate the app on our behalf, listed in §7. We do not sell data and do not share it for third-party marketing. Apple and Google act as independent controllers for your store purchase transactions (not our processors). When you connect a Google Calendar or add a calendar feed address, Google or the feed's host provides that calendar to us at your request; they are not our processors either (see Calendars you connect).

7. Subprocessors and international transfers

• Primary storage stays in the EU: Fly.io (Frankfurt) hosts the API and PostgreSQL; Aiven (Finnish company, Frankfurt region) provides the cache; Tigris stores photos/receipts, pinned to an EU region; Sentry (PII-scrubbed error tracking) stores error events in its EU region (Germany).
• Some processors are US-based: Groq (AI inference — prompts with members' full names replaced; the Google Gemini fallback is currently disabled, see §4), Twilio (SMS codes for phone verification, which is switched off at launch; numbers already stored remain and are processed as described in §2), Resend (transactional email), RevenueCat (subscription management), Google/Apple (push delivery), and Cloudflare (hosts this website and so processes visitors' IP addresses). PostHog (EU, analytics) is built into the app but not active — see §11.
• Transfer safeguards: transfers outside the EU/EEA are meant to rely on each provider's Standard Contractual Clauses and/or EU-US Data Privacy Framework certification. We are still completing and signing these agreements; in particular, our data-processing agreement with Groq is not yet signed. This section will be updated as each one is in place.

We publish subprocessor changes with a reasonable notice period.

8. How long we keep data

Most data is kept for the life of your account or family space and deleted when you delete it (§9). A small number of records are kept for a limited time for security and abuse-prevention purposes even after related data is deleted — for example phone-verification records, invite tokens, notifications, audit logs, away statuses, error-tracking events, post-erasure consent-proof records, and a minimal trial-abuse ledger (kept only to prevent repeated free-trial abuse). We do not store the prompts we send to the AI processor. Suggestion cards are stored until they are regenerated (usually within 2–7 days) or until you delete your family space or account; other AI answers expire from a short-lived cache within 24 hours (§4). Events imported from a calendar you connect are replaced at each refresh and deleted when that calendar is removed (Calendars you connect).

9. Your rights

Under GDPR (and equivalent laws) you can:

• Access / export your data — in-app export provides a portable copy (Art. 15/20).
• Delete your account and data — in-app deletion (Art. 17) cascades to your family data where you are the sole owner, member profiles, health and financial records, uploaded files, cached AI suggestions, and tokens.
• Delete your account and data without the app — email [email protected] from the address you sign in with and ask us to delete your account. Writing from that address is how we know the request comes from you; if you can no longer send from it, tell us, and we will send a confirmation code to that address instead. We delete the account and its data, as the in-app deletion does, and reply within 30 days (Art. 12(3) allows one month).
• Rectify data — everything is editable in the app (Art. 16).
• Restrict / object to processing, and withdraw consent for health features at any time (§3). To exercise restriction/objection, contact [email protected]. To object to your space's content being sent to our AI provider, ask your space's Admin or a Parent to turn off "AI in this space" (§4), or write to [email protected] — we won't tell the other members it was you.
• Complain to your supervisory authority (§1).

Backups: deleted data may persist briefly in encrypted backups before older backups are rotated out.

10. Security

TLS 1.2+ in transit; an encrypted on-device cache (AES-256); JWT access tokens with refresh-token rotation; strict per-family data isolation; secrets held outside the codebase; non-root containers; audit logging; PII-scrubbed error tracking; and a breach-response runbook (Art. 33/34; health/child-data breaches are treated as high-risk and trigger user notification). Data at rest is encrypted using our infrastructure providers' standard encryption.

11. Cookies & tracking

The mobile app uses no advertising SDKs, no cross-app/cross-company tracking, and no ad identifiers. No App Tracking Transparency prompt is required.

Analytics are not active. The app contains an integration with PostHog (EU cloud) for product analytics, but it sends nothing: it switches on only when we configure a key, and our released builds have none. We will update this policy before switching it on. If we do, it will use an anonymous per-install identifier (never your email or name), remove personal data from event properties, and tell PostHog not to work out a location from your IP address. PostHog would still receive your device's IP address with each event, as any internet service does; before switching analytics on we will set PostHog to discard IP addresses, and say so here.

12. Changes to this policy

We will update this policy as the app evolves and post the new effective date. Material changes affecting how we use your data will be notified in-app or by email.

13. Contact

Privacy questions and rights requests: [email protected]. Optimum Software Development SRL is registered in Romania; a full registered postal address is available on request.