Garnet Privacy Policy

Effective: 15 October 2026. Last updated: 15 October 2026.

Who is responsible

Vlas Laptev is the developer of Garnet and the person responsible for data processing by the service. For privacy, support and deletion requests, contact vlas.developer@icloud.com.

Garnet is a personal cycle diary. Calendar estimates are not intended for diagnosis, treatment or contraception.

Your diary on your device

You enter period records, symptoms, emotions, temperature, test results, sexual activity, notes and custom tags. These may include sensitive health and personal information. Diary storage and calendar calculations run on your device. Diary files are encrypted, and the key is kept in the system Keychain. Protected diary files are excluded from the app's system backup.

Using the local diary does not require a name, email address or password. Garnet has no advertising or third-party analytics SDKs, advertising tracking, contacts access, location access or HealthKit integration. Separate TestFlight processing is described below.

Optional backups

After you enable automatic backup, the app uploads a complete encrypted diary copy, including notes, sexual activity records, tags and settings. Encryption happens before upload. The developer and server operator do not receive the content decryption key or your recovery code.

Restoring requires your independently saved code or an available recovery secret in iCloud Keychain. Saving to iCloud Keychain is a separate option, initially off. It stores a random secret, an opaque vault identifier and an environment identifier; diary entries are not sent there. Apple controls synchronization. Anyone with the code or secret may be able to decrypt a backup; the developer cannot recover its contents without them.

Turning automatic backup off stops new uploads. Previously uploaded versions remain until you separately delete server backups or delete the account and associated data.

Partner access and exports

You initiate sharing, choose the recipient, fields and history range, compare verification codes and approve access. Selected data is encrypted for the authorized recipient. Private free-text notes cannot currently be selected for partner sharing.

Revocation stops further authorized sharing. A previously verified offline copy may remain available to the recipient for up to 24 hours. Files, screenshots and other independent copies already saved by the recipient cannot be remotely erased.

PDF and CSV exports contain readable information. An encrypted backup file requires the recovery code. You choose the destination app or storage, including third-party cloud services; subsequent handling is controlled by you and the recipient. Garnet cleans up temporary export files within its own container.

The camera is used only after a permission request to read a QR code on the device. Camera images are not uploaded to Garnet's server. Codes can also be entered manually.

What the server receives

Network features create a technical device account. The server processes random account, device, vault and access identifiers; public keys and cryptographic proofs; recipient relationships; operation states; request times; payload sizes; and uploaded encrypted content. The infrastructure sees your IP address when you connect. The server application uses it to limit request rates.

These data support authentication, delivery, restoration, revocation, deletion, replay prevention and abuse protection. Content encryption does not conceal the connection itself or access relationships and does not make all metadata anonymous.

The current server is https://167.179.116.35, hosted by Vultr in Tokyo, Japan. The working database and developer-managed infrastructure archives are on this VPS; automatic off-server copying of these archives is not configured. Enabling network features transfers data to Japan, including from other countries. Connections use HTTPS.

A separate log of all HTTP requests is disabled in the current proxy. Application, database and proxy service logs support operations and diagnosis; errors may include technical information. Regular application code does not log diary contents, recovery codes or full QR codes. The infrastructure provider may process network and operational metadata under its own terms.

Other recipients

Vultr provides server infrastructure. Apple provides iCloud Keychain, the support email service and TestFlight. They process information necessary for those services. Apple may process data in different countries under its privacy terms. User-directed exports and authorized partner access are described above.

We do not sell data, use diary contents for advertising or provide them to analytics services. A binding lawful requirement may require disclosure of information we hold; the service does not hold the decryption keys to user content.

TestFlight and support

During TestFlight testing, Apple automatically shares usage and crash information with the developer; names and email addresses may be available depending on the invitation. Submitted feedback and screenshots are also shared. We use this information to fix Garnet and do not disclose it to third parties. See TestFlight privacy terms.

If you email support, we receive your address, message and attachments to answer and resolve your request. Do not send your diary, medical details, recovery code or active access QR code. A device model, iOS and Garnet versions, and reproduction steps using fictional records are normally sufficient.

Retention

After full account deletion, minimal protective records remain: hashes of erased technical identifiers, a deletion operation identifier, proof hashes, status and timestamps. They contain no diary entries or content keys. They verify completion and prevent reuse of erased identities. The current implementation has no automatic expiry for these records. Deletion does not physically overwrite every disk sector.

Your controls and deletion

You can edit records and export your diary in the app. Automatic backup, iCloud Keychain and partner access have separate controls. Camera permission can be revoked in iOS Settings. Disabling optional features stops the corresponding further processing but does not itself erase previously stored data.

For full deletion, open Settings → Account and data → Delete account and all data and confirm. A server connection is required to finish the server portion. The app shows progress and allows an unfinished operation to resume. After server confirmation, it clears local data, accounts accessible to the app, associated server copies and partner connections. If another device has already taken over a backup vault, deleting it requires its recovery code or the currently authorized device.

The app also requests removal of recovery material used on this phone from iCloud Keychain. Propagation to other devices depends on Apple and may be delayed. Exports outside the app, independent recipient copies, minimal protective records and infrastructure archives awaiting rotation have the limitations described above.

For access, correction, deletion, restriction or consent withdrawal requests, email vlas.developer@icloud.com. We handle requests under applicable law; available rights and deadlines depend on your country. You may contact the competent data protection authority. An email address does not identify a technical account: locating and verifying a request may require confirmation from the app. Do not email a recovery code for this purpose. We cannot decrypt a diary or recover a lost key.

Your choices and policy changes

Optional uploads follow your activation and confirmation. We process necessary technical data to provide the features you request and respond to support inquiries. Where permitted by law, service security and abuse prevention rely on legitimate interests; optional transmission of sensitive content relies on your consent and authorization of the chosen recipient. You may withdraw consent using the controls above; withdrawal does not undo earlier processing. If the law requires parental or guardian authorization for your age, obtain it before using the app. Store age ratings do not replace that authorization.

Updates will carry a new revision date. Before introducing new purposes or material processing changes, we will provide information and, where required, a separate choice.