Who we are
This policy covers the Orlina app for iPhone and Android and this website. Orlina (“we”, “us”) is responsible for the personal data described here. You can reach us at contact@kryptontech.app.
Orlina is a tracker for the vitamins and supplements you take. It records what you log and does not give medical advice.
What stays on your phone
You can use every free feature of Orlina without an account. In that case, what you enter is stored only in a database on your phone, and we never receive it:
- your supplements: names, doses, notes, schedules and reminder times;
- your log of doses taken, skipped or missed, with any notes;
- medications you add, to show reported interactions;
- blood-test results you log;
- cycle dates, if you use cycle tracking;
- symptom ratings and notes recorded in earlier versions of the app;
- the sex you choose in onboarding, which only decides whether cycle features are shown;
- app settings such as theme and reminder options.
Reminders are scheduled by your phone's operating system. No server sends them.
The PDF report and CSV export are made on your phone. They only leave it if you send them somewhere yourself, for example to your doctor.
Links to sources, such as the government fact sheets on the interactions screen, open those websites in your browser. Their own privacy policies apply there.
Your phone's own backups (iCloud or Google) may include Orlina's data, depending on your device settings. Those backups are handled by Apple or Google, not by us.
If you sign in
Signing in is optional. You can sign in with Apple or with Google. We then receive and store:
- your email address and name, as shared by Apple or Google. With Sign in with Apple you can hide your email, and we only receive a private relay address;
- an account ID, the sign-in method you used, and when you created your account and last signed in;
- whether and when you agreed to cloud backup, and which version of the wording you agreed to.
From Google we only ask for your basic profile (name, email and profile picture link), never access to your Gmail, Drive, contacts or anything else.
Our server provider, Supabase, keeps technical logs of sign-ins and requests (such as IP address and time) to keep the service secure and working.
We use this to give you an account, keep it secure, and contact you about it if we need to. Legal basis (where GDPR applies): performing our contract with you, and our legitimate interest in keeping the service secure.
If you turn on cloud backup
Cloud backup and sync are part of Orlina Pro and need an account. Nothing is uploaded until you agree in the app. Once you agree, Orlina stores a copy of the following on our server, linked to your account:
- your supplements, schedules and notes;
- your dose log;
- symptom ratings and notes, if you recorded any in an earlier version;
- medications you add;
- cycle dates;
- blood-test results.
This is health data. We use it only to back up your data and keep it in sync between your devices. We don't analyse it, profile you with it, or use it for anything else. Legal basis (where GDPR applies): your explicit consent, which you give in the app.
Your choice is saved with your account, so backup also starts when you sign in on another device. You can pause backup on any device at any time in Settings. Pausing stops new uploads; the copy already stored stays until you delete your account.
If you subscribe to Orlina Pro
Subscriptions are bought and paid for through Apple's App Store or Google Play. We never see your card or payment details.
We use RevenueCat to confirm which plan you have. RevenueCat receives your purchase information from Apple or Google (such as the product, price, dates and renewal status) together with an ID: your Orlina account ID if you're signed in, or a random ID if you're not. It doesn't receive your health data.
Legal basis (where GDPR applies): performing our contract with you, and our legal obligations for tax and accounting records.
This website
This website has no cookies, no analytics and no tracking. Its fonts are served from the site itself, not from a font service. Our hosting provider, Vercel, processes your IP address and basic request information to deliver the pages and protect the site from abuse.
What we don't do
- We don't show ads.
- We don't include analytics, advertising or tracking tools in the app or on this website.
- We don't sell your personal data or share it for advertising.
- We don't use your health data to make decisions about you or to train AI models.
Service providers
We use these companies to run Orlina. They process data on our behalf and under their own data processing terms.
| Provider | What for | Where data is stored |
|---|---|---|
| Supabase | Accounts, sign-in, cloud backup and sync | European Union (Frankfurt, Germany) |
| RevenueCat | Subscription status | United States |
| Apple | Sign in with Apple, App Store purchases | Under Apple's terms |
| Sign in with Google, Google Play purchases | Under Google's terms | |
| Vercel | Hosting this website | United States and its global network |
Your account and cloud backup, including your health data, are stored in the European Union. Some other providers handle data outside your country, including in the United States. Where the law requires it, these transfers are covered by safeguards such as the European Commission's standard contractual clauses.
How long we keep data
- Data on your phone stays until you delete it in the app or delete the app.
- Your account and cloud backup stay until you delete your account. Deleting it removes them from our database straight away. Copies in our server backups are deleted when those backups expire, within 7 days.
- Purchase records are kept by Apple, Google and RevenueCat for as long as they need them, including for tax and legal reasons.
- Server and hosting logs are kept for a limited time, as set by Supabase and Vercel.
Your rights and choices
Wherever you live, you can:
- Delete your data: Settings → Delete my data in the app, or follow these steps if you no longer have the app.
- Take a copy of your data: Settings → Export logs (CSV) or Share PDF report.
- Correct your data: edit or delete any entry in the app.
- Withdraw consent to cloud backup: pause it in Settings, and delete your account to remove the stored copy.
- Ask us for access to, correction or deletion of the data we hold, or object to how we use it, by emailing contact@kryptontech.app. We reply within one month.
Security
Data sent between the app and our server is encrypted in transit (HTTPS). On the server it's encrypted at rest, and access rules make sure each account can only read its own data.
On your phone, Orlina's data is protected by your device's own security, such as its passcode and encryption. Keep your phone locked to keep your data private.
Children
Orlina isn't meant for children under 16, and we don't knowingly collect their data. If you think a child has given us personal data, contact us and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change affects what cloud backup stores or how it's used, we'll tell you in the app before it applies to your data.
Contact
Questions or requests about your privacy: contact@kryptontech.app.