Velita Privacy Policy

1. Who we are

Velita: Baby Sleep Planner (“Velita”, “we”, “us”) is developed by DuoDevApps, which is responsible for the processing described here. Contact: velita@duodevapps.com · Website: duodevapps.com.

This policy covers the Velita app, its optional online services and the Velita pages of duodevapps.com.

2. What stays on your iPhone

When you use Velita, you enter:

• your baby's name or nickname and date of birth;
• if your baby was born early, the gestational age at birth, used to calculate corrected age;
• sleep records: naps and nights with their start and end times, night wakings and the time zone;
• optional day notes: tags such as travel, visitors, vaccines or unwell, and a short note if you write one;
• plans you add for the day (for example an outing), your settings and your choice of companion.

Velita also keeps on your iPhone the estimates it showed you and what happened afterwards, to measure its own accuracy.

All of this stays on your iPhone, protected by iOS data protection. Velita calculates its estimates on your iPhone and sends nothing anywhere to compute them. We cannot see this information.

• Backups. If you back up your iPhone to iCloud or to a computer, this data is included in that backup, under your Apple or computer settings.
• Lock Screen. While a sleep is running, a Live Activity can show your baby's name and the sleep on your Lock Screen. You can hide the name in Velita's settings.
• Export. When you export, Velita creates a file and you decide where it goes.
• Notifications. Reminders (such as the trial reminder) are scheduled on your iPhone; they don't go through our servers.

We treat sleep records, gestational age, day notes and Velita's estimates as health data about your child (a special category of data under Article 9 of the GDPR), even while they stay on your device.

3. Optional account and family sync

Family sync lets you share your baby's sleep log with a partner or other caregivers. It is optional and off by default, and it arrives in an app update: if your version of Velita doesn't offer it yet, this section doesn't apply to you.

• Account. To use family sync you sign in with Apple or with Google. We receive an account identifier and, depending on what you allow, your name and email address (Sign in with Apple lets you hide your email). We use them to sign you in, to show your name to the members of your family group and to contact you about your account.
• Your explicit consent. Before anything is uploaded, Velita asks for your explicit consent to process your baby's sleep data, which is health data about a child, in order to sync it (Article 9(2)(a) GDPR). You give it as the parent or caregiver. You can withdraw it at any time by turning sync off or deleting your account; this doesn't affect what happened before.
• What is uploaded. The baby profile (name or nickname, date of birth, gestational age if given, time zone); sleep records and night wakings; day notes and tags; the technical details needed to sync (who changed each record and when, and revision numbers); and your membership of the family group (account identifier, role and display name). Velita's estimates and its accuracy log stay on your iPhone.
• Where. In Google Cloud Firestore and Cloud Functions, provided by Google as our processor, in the EU region europe-west1 (Belgium). Data is encrypted in transit and at rest. Sign-in is handled by Firebase Authentication, a Google service that may process account data (identifier, email, name) outside the EU, including in the United States (see section 9).
• Who can see it. Only the members of your family group. The admin invites people with a single-use code that expires after 72 hours and chooses whether each person can edit or only view. An admin can remove members, and anyone can leave.
• Protection against abuse. Velita uses Firebase App Check with Apple's App Attest to check that requests come from a genuine copy of the app. It doesn't identify you.

4. Optional usage statistics

Velita can share anonymous usage statistics with us so we can understand which features help and fix problems. It's off unless you say yes, and you can change your mind at any time in Velita's settings.

• Service. Google Analytics for Firebase (Google Analytics 4), provided by Google as our processor.
• What it sends. Events such as screens and features used, paywall views and purchase steps, the app version, device model, iOS version, language and country, and a random identifier for your installation. Logging activity is counted on your iPhone and sent as a daily total, without times.
• What it never sends. Your baby's name, date of birth or age in days, sleep times or durations, notes, your name or email, your precise location or your advertising identifier.
• We turn off advertising features and Google signals, and we don't link statistics to your family sync account. Event data is kept for 2 months.
• Legal basis. Your consent (Article 6(1)(a) GDPR and article 22.2 of Spain's LSSI).

Crash reports from Apple. If you allow “Share with App Developers” in your iPhone's settings, Apple shares crash reports and usage statistics with us. They don't identify you.

5. Purchases

Velita Premium is sold by Apple through the App Store. Apple handles the payment; we never see your card or bank details. Velita receives from Apple only what it needs to unlock Premium: your plan, its dates and status, and a transaction identifier. This check happens on your iPhone. If you use family sync, we may also check your subscription status with Apple's servers so Premium works across your devices. Apple's privacy policy applies to the purchase itself.

6. When you write to us

If you email velita@duodevapps.com, we use your email address and what you tell us to answer you. Please only share details about your baby's health if you need to; if you do, we use them only to help you. We keep support emails only as long as we need to answer you, and at most 12 months, and then delete them. Our email is handled by our email hosting provider.

7. What we never do

• No advertising and no ad networks. No tracking across other companies' apps or websites.
• We don't sell or rent your data, or share it for advertising.
• We don't send your baby's data to analytics, advertising or AI services.
• Velita doesn't read from or write to Apple Health.
• We don't use your data for automated decisions that have legal or similarly significant effects on you.

8. Why we use data (legal bases)

• Providing the app and the features you ask for: performance of our contract with you (Article 6(1)(b) GDPR).
• Family sync of your baby's health data: your explicit consent (Article 9(2)(a)), together with the contract.
• Usage statistics: your consent (Article 6(1)(a)).
• Purchases and records we must keep: the contract and our legal obligations (Article 6(1)(c)).
• Keeping the service secure (App Check, limits on failed invitation codes): our legitimate interest in preventing abuse (Article 6(1)(f)).
• Answering support emails: the contract or our legitimate interest in helping you.

9. Who receives data, and where

• Google (Google Ireland Limited and Google LLC), for Firebase Authentication, Cloud Firestore, Cloud Functions, Firebase App Check and Google Analytics for Firebase. Only for the optional features you turn on, as our processor under Google's data processing terms.
• Apple, for App Store purchases, Sign in with Apple and App Attest, under Apple's own terms and privacy policy.
• Our email hosting provider, for support email.
• Public authorities, when the law requires it.

Family sync data is stored in the EU. Some services (Firebase Authentication, Google Analytics and Apple's) may process data in the United States or other countries. When that happens, the transfer relies on the EU-U.S. Data Privacy Framework, where the recipient is certified, or on the European Commission's Standard Contractual Clauses.

10. How long we keep data

• On your iPhone: until you delete it in Velita (Settings › Your data › Delete all data) or delete the app.
• Family sync: while your account exists. When you delete your account or withdraw your consent to sync, we delete the cloud copy: your account, and any family group where you are the last member. In a family group that still has other members, the baby's shared records stay with them, because they are that family's shared history; your membership and your name are removed.
• Invitation codes expire after 72 hours. Technical records that protect the service (such as counters of failed codes) are kept for up to 7 days.
• Usage statistics: 2 months. Support emails: only as long as needed to answer you, and at most 12 months.

11. Your choices and rights

• In the app: export your data (Settings › Your data › Export my data), delete everything on this iPhone (Settings › Your data › Delete all data), turn family sync and usage statistics on or off, and delete your account when family sync is available.
• Your rights: you can ask us for access to your data, and to correct, delete, restrict or port it, and you can object to its use. You can withdraw consent at any time. Write to velita@duodevapps.com; we answer within one month and may ask you to confirm you are the account holder. Because we can't see the data that stays on your iPhone, the in-app tools are the quickest way to manage it.
• Complaints: you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the authority where you live.

12. If you live in the United States

Some U.S. state laws, such as Washington's My Health My Data Act, give you rights over consumer health data. Velita's sleep records can be consumer health data. We collect them only to provide the app and the features you choose; we share them only with the processors in section 9, for the features you turn on; we never sell them; you can access and delete them as described in section 11; and we won't treat you differently for using your rights.

13. Children

Velita is for parents and caregivers aged 18 or over. It is not directed at children, and children should not use it. The information about your baby is entered by you, as the parent or caregiver, and you decide what to record, share and delete. We don't knowingly collect personal information from children as users of the app; if you think a child has given us information, write to us and we will delete it.

14. Security

Data on your iPhone is protected by iOS data protection. Family sync data is encrypted in transit and at rest, and server rules allow only members of a family group to read it. We limit our own access to what is needed to keep the service running and to help you when you ask. No system is completely secure: if a breach affects your data, we will tell you and the authorities as the law requires.

15. This website

The Velita pages of duodevapps.com use no cookies, analytics or advertising. They load fonts from Google Fonts, so your browser's IP address is sent to Google when a page loads. If you choose a language, your browser remembers the choice locally. Our hosting provider (Google App Engine) keeps standard server logs (IP address, time and page requested) for security, for up to 30 days.

16. Changes to this policy

If we change this policy, we will update the date at the top. For important changes, we will tell you in the app before they apply, and ask for your consent again where needed.

17. Contact

Questions about your data or this policy: velita@duodevapps.com.