We don't sell your data. We barely collect any. 40/12 is a reference app that works almost entirely on your device. There is no account to create, we don't track you across apps, and we don't run ads. Everything you write in the App, including your notes, your My Summary card, your checklist and your reading history, is stored only on your device. We never receive it. The App does fetch its reference content from our own server, and those requests tell that server which page you asked for (including your current pregnancy week or postpartum month on the Today screen); they carry no name, no account and no device identifier, because the App has none.
Scope
This Privacy Policy applies to the 40/12 iOS application ("the App") published on the Apple App Store. It explains what data is collected, how it is used, and your rights regarding that data.
The App Store privacy nutrition label for 40/12 is the authoritative, Apple-reviewed disclosure. This policy provides additional detail.
Who We Are
Contact: developers@vrunik.com
We are a small independent developer. No designated Data Protection Officer is required under GDPR Article 37 given our processing scale.
What Information We Collect
3.1 Information stored locally on your device only
The following is stored in Apple UserDefaults and in a local database (Apple SwiftData) on your device. It is never transmitted to us or to any third party:
- Your current stage (pregnancy week, postpartum month, or preconception)
- Whether you have completed onboarding, and whether you have seen the notification prompt
- Whether you have unlocked the full app (purchase status)
- App preferences and navigation state
- My Summary: the details you choose to enter: name, blood type, OB practice, allergies, medical conditions, medications, dietary requirements, and an emergency contact
- Notes for your provider: the text, date and tag of each note you write
- Weekly checklist: which foods you have ticked, and the week they were ticked in
- Recently viewed: the last 20 nutrient and food pages you opened
About the health information you enter. My Summary and Notes let you record what is, under GDPR Article 9, special-category health data. We have designed these features so that we never become a recipient of it: there is no account, no sync and no backup to any server we operate. It stays in the App's own storage on your device, protected by the iOS data protection layer, and is removed when you delete the App. It leaves your device only when you choose to export or share it. See 3.6.
3.2 Purchase receipts (via RevenueCat)
When you make a one-time purchase, Apple processes the payment. We use RevenueCat to verify and manage entitlements. RevenueCat receives your App Store receipt and assigns it an anonymous identifier. No payment card details or personal financial information pass through our systems. RevenueCat's privacy policy applies: revenuecat.com/privacy.
3.3 Content requests to our own server
The App fetches its reference content from the 40/12 content API at fortytwelve-api.onrender.com, which we operate and which is hosted for us by Render, Inc. These are ordinary unauthenticated GET requests. They carry no account identifier, no device identifier and no advertising identifier, because the App has none of those.
What they do carry is the page being requested. On the Today screen that includes your current stage and week or month (for example stage=pregnancy&week=17); elsewhere it is the nutrient, food or stage page you opened. As with any internet request, our server and its hosting provider also receive the originating IP address. We use this solely to return the page you asked for. We do not build reading profiles, we do not link these requests to your purchase record, and we do not use them for analytics or advertising.
Responses are cached on your device so that repeat views need no further request, and the App's core content is bundled inside the App itself, so it opens and works with no network connection at all.
Nutrition figures shown in the App are drawn from published USDA and NIH sources and are credited to them in the interface. The App does not call any USDA service directly, and USDA receives nothing from the App.
3.4 Performance metrics (MetricKit, on-device only)
The App uses Apple's MetricKit framework to collect on-device performance diagnostics (hang rates, crash logs, memory usage). This data is processed entirely on your device and delivered to us only through Apple's aggregated, privacy-preserving MetricKit reports. We never receive personally identifiable data through this channel.
3.5 Support communications
If you contact us by email, we receive your email address and the contents of your message. We use this solely to respond to your enquiry and retain it for up to 24 months.
3.6 Documents and audio generated on your device
Provider Packet and My Summary PDFs. These are rendered entirely on your device and written to the App's temporary storage. The file is then handed to the standard iOS share sheet, so you decide whether it goes to email, Messages, Files, AirDrop, a printer, or nowhere at all. We never receive the file and have no way to retrieve it. Once you share it, the destination you chose, such as your mail provider or your OB's systems, is governed by that recipient's own privacy terms, not ours.
Listen. Audio is produced by Apple's on-device speech synthesiser reading text already stored in the App. Nothing is recorded, no microphone access is requested, and no audio or text is sent to us or to Apple for this purpose.
Reminders. Stage reminders are local notifications scheduled by the App on your device. They are opt-in, they involve no server, and no push token is created or sent anywhere. You can revoke them at any time in iOS Settings.
3.7 What we do not collect
- Any account, login, password, or email address in order to use the App
- The personal and health details you enter in My Summary or Notes. You store these on your device; we never receive them (see 3.1)
- Date of birth
- Location data
- Contacts, photos, microphone, or camera access
- Advertising identifiers (IDFA)
- Behavioural analytics or usage events
- Device fingerprints or cross-app tracking
We also run no third-party analytics, attribution or advertising SDKs of any kind.
Why We Use Your Information
We process data only for the following limited purposes:
- Making the App function: local preferences and purchase status are needed to deliver the correct content and experience.
- Verifying your purchase: RevenueCat checks your entitlement so you can access paid content on any device linked to your Apple ID.
- Delivering content: our content API returns the reference page you opened, and nothing more.
- Performance monitoring: aggregated, anonymised crash and hang diagnostics help us fix bugs.
- Customer support: responding to your emails.
- Legal compliance: retaining purchase records as required for tax purposes.
Legal Bases for Processing (GDPR)
For users in the EU, EEA, UK, and Switzerland, our legal bases under Article 6 GDPR are:
- Contract (Art. 6(1)(b)): processing necessary to deliver the service you purchased.
- Legitimate interests (Art. 6(1)(f)): performance monitoring and security, balanced against minimal privacy impact.
- Legal obligation (Art. 6(1)(c)): retaining purchase records for tax compliance.
- Consent (Art. 6(1)(a)): notification scheduling, which is opt-in and revocable at any time in iOS Settings.
Who We Share Information With
We share data only with the following categories of recipient, and only to the extent necessary:
- Apple Inc. processes your App Store payment and delivers MetricKit diagnostics. Apple's privacy policy governs this data.
- RevenueCat, Inc. manages purchase entitlements using your App Store receipt. No personally identifiable data beyond what Apple includes in the receipt is shared.
- Render, Inc. hosts the 40/12 content API described in 3.3, and therefore processes those content requests and the IP addresses inherent to them on our behalf.
- Legal authorities: only if required by a valid court order or equivalent legal process.
We do not sell, rent, or share your data for advertising or marketing purposes. We have no advertising partners.
Data Retention
- On-device data: your preferences, My Summary, Notes, checklist and reading history are retained until you delete them in the App, delete the App, or reset your device. Deleting the App removes all of it.
- Generated PDFs: written to temporary storage and cleared by iOS; any copy you shared lives wherever you sent it.
- Content cache: stored locally on your device and refreshed when we publish a new content version.
- RevenueCat entitlement records: retained as long as your Apple ID has a purchase history; governed by RevenueCat's retention policy.
- Content API server logs: standard web server logs held by our hosting provider. We do not query them to identify individuals and we do not link them to any other record.
- Support emails: 24 months from last contact.
- Purchase records: 7 years for tax compliance.
Security
All data in transit between the App and external services (our content API, RevenueCat) is encrypted using TLS 1.2 or higher. On-device data, including My Summary, Notes and your checklist, is protected by the iOS data protection layer. Our content API serves published reference content only: it has no user accounts and stores no personal data, so there is no central database of user information to breach.
Cookies & Tracking
The App contains no cookies, advertising trackers, analytics SDKs, or cross-app tracking. The App does not request your IDFA (Advertising Identifier). No App Tracking Transparency prompt will appear.
Children
40/12 is designed for adults who are pregnant or in the postpartum period. The App is not directed at children. We do not knowingly collect personal information from anyone under the age of 13 (US), 16 (EU/EEA/UK), or 18 (India). If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
Your Rights
EU / EEA / UK / Switzerland (GDPR & UK GDPR)
You have the right to: access your data · correct inaccurate data · erasure ("right to be forgotten") · restrict processing · data portability · object to processing · withdraw consent at any time · lodge a complaint with your supervisory authority.
We will respond within one calendar month (extendable to three months for complex requests).
United States (California, Colorado, Virginia, and other US states)
You have the right to: know what personal information is collected · delete personal information · correct inaccurate information · opt out of sale or sharing (we do not sell or share your data) · non-discrimination for exercising rights.
We will respond within 45 days (extendable to 90 days).
Because almost all data is stored locally on your device, you exercise most of these rights directly in the App rather than through us. You can edit or clear any My Summary field, delete individual notes, and untick checklist items at any time; deleting the App removes everything stored locally, including My Summary, Notes, your checklist and your reading history. We cannot access, correct, export or delete that data on your behalf, because we never hold a copy of it.
For data we or our processors do hold, such as your RevenueCat purchase receipt or support emails you have sent us, contact us at developers@vrunik.com and we will action the request or submit it to the processor on your behalf.
International Transfers
RevenueCat, Inc. and Render, Inc. are US-based processors. Transfers to them from the EEA are covered by Standard Contractual Clauses (EU Commission Decision 2021/914). Apple's privacy framework and data processing addendum cover App Store receipt data.
Changes to This Policy
We will update this policy when our practices change. Material changes will be noted prominently in the App or via the App Store update release notes. Continued use of the App after changes take effect constitutes acceptance.