Privacy Policy

Last updated: October 13, 2026

Vial keeps your tracking records on your device. Where available, Mira is an optional text assistant for Vial Pro. Mira requires Sign in with Apple and your permission before sending messages and limited tracking context through Vial’s service to OpenAI. You can use Vial’s core tracking features without enabling Mira.

1. Who we are

Vial is provided by Arvion Holdings LLC (“we”, “us”). For privacy questions or data requests, contact syed@arvionllc.com.

2. Your device records

Dose logs, protocols, vials and profile information are stored in the app’s private storage on your device. Your saved Mira conversation, approved memories and Mira reminders are also stored locally. These records are not uploaded as a cloud backup by Vial. Device backups you configure with Apple are governed by your Apple settings.

Core tracking does not send these records to our servers. The limited, optional sharing needed for Mira is described below. Information you export or send to support is shared at your direction.

3. Optional Mira sharing

Before the first message, Vial asks whether you allow sharing with OpenAI. When you agree, each message sends your typed text, recent conversation, approved memories and a limited snapshot of your records through Vial’s backend to OpenAI to check scope, generate an answer and review it.

• Up to 100 dose logs from the last 30 days, including names, amounts, dates and record identifiers.
• Active protocols, selected dose units, your time zone, and current half-life estimates calculated by Vial.
• Log notes only if you separately turn on “Include log notes”. Notes are off by default.

The automatic snapshot excludes profile name, contact details and body measurements. Information you type into chat, approved memories, protocol names or optional notes may still contain personal or health information, so share only what you want Mira to process.

Vial’s service processes this content to answer your request; it does not store prompts, answers or tracking records in its account and usage database. OpenAI’s API data policies are separate. We request that responses are not stored as API application state. This does not eliminate OpenAI’s abuse-monitoring retention, which normally lasts up to 30 days and can be longer for legal or safety reasons. We do not opt customer content into model training. See OpenAI’s API data controls.

Mira does not change your tracking records or save a proposed memory without your confirmation. It is intended for understanding your records and using Vial, not medical diagnosis or treatment advice.

4. Mira sign-in, subscriptions and usage information

Mira uses Sign in with Apple to verify identity. We do not request your name or email address from Apple. Our service keeps a pseudonymous account identifier, encrypted Apple refresh credentials, hashed session credentials and account timestamps to manage access and revocation. Your device keeps its sign-in session in the iOS Keychain.

We associate a server-issued pseudonymous identifier with your RevenueCat subscription record and check whether Vial Pro is active. Our service also keeps request identifiers, usage counters, token-cost accounting and security timestamps to enforce limits and prevent duplicate charges. These records do not contain chat text or health records. Limited usage and deletion-security records are retained for up to 90 days.

5. Service providers

• Apple: Processes App Store purchases and, when you enable Mira, Apple sign-in. We do not receive your payment-card details. See Apple’s privacy policy.
• RevenueCat: Processes app user identifiers, transactions, subscription status and technical information needed for subscription management. Vial does not send tracking records or chat content to RevenueCat. See RevenueCat’s privacy policy.
• OpenAI: Processes the Mira content you permit us to send, as explained above.
• Supabase: Hosts Mira’s service and private account/usage database in the United States. Request metadata may include IP addresses, request times, response status and technical diagnostics; our application does not log message bodies or answers. Netlify hosts this website and processes technical information needed to serve and secure it.

When Apple evaluates a refund, RevenueCat may provide available purchase-consumption and subscription information on our behalf where the required customer consent has been obtained. This does not include your dose logs, protocols, profile fields or Mira conversations. Apple decides whether to refund a purchase; this policy does not replace required consent.

If you email support, we receive your email address and information you choose to send. Avoid sending sensitive records unless necessary for your request.

Active Mira account credentials remain until account deletion or revocation; expired sessions and sign-in challenges are removed automatically. Operational usage and deletion-security markers are retained for up to 90 days. Supabase’s daily database backups retain operational metadata for seven days, so deleted metadata may remain in those backups until they expire. Provider security or legal retention may differ.

6. Your choices and deletion

• Turn off AI sharing: In Mira’s privacy settings, this stops future messages and clears the conversation on that device. It cannot recall information already processed by OpenAI.
• Clear conversation or edit memories: Use Mira’s privacy settings to manage locally saved content. Removing a memory also clears the conversation so old wording is not reused.
• Clear local Mira data: “Clear all Mira data on this device” removes chats, memories, sharing permission and Mira reminders from this device. It does not delete the server account, tracking records or subscription.
• Delete your Mira account: Open “Mira account & privacy” from onboarding, Profile or the expired-subscription screen. If needed, sign in with the same Apple Account using “Sign in to manage Mira account”, then choose “Delete Mira account”. An active Vial Pro subscription is not required for account management. Access sessions are invalidated immediately. We revoke Apple sign-in credentials and remove the Mira account; if Apple is unavailable, encrypted revocation credentials are kept only while automatic retries are needed. The initiating device clears its Mira conversation, memories and reminders. Clear local Mira history separately on other devices.
• Tracking records: Use Profile’s export and “Delete tracking data” controls for local protocols, dose logs and profile information. This control does not delete Mira’s account or locally saved Mira content; manage those separately above. Export creates a ZIP containing CSV and JSON files; export is also available after subscription access expires.
• Subscriptions: Deleting Mira does not cancel Vial Pro or delete billing records held by Apple and RevenueCat. Manage cancellation through your Apple subscription settings.

You can contact us for help with access, correction or deletion requests, including when you cannot sign in. We may need information to verify the request. Rights and applicable retention requirements depend on your location.

7. Security and international processing

iOS protects local app storage through its sandbox and device security controls. Network connections use HTTPS. Server credentials have restricted access; session tokens are stored as hashes and Apple refresh credentials are separately encrypted. No system can guarantee absolute security.

Apple, RevenueCat, OpenAI and hosting providers may process information outside your country. Enabling Mira can therefore involve international processing of the messages and tracking context you choose to share.

8. Advertising and children

Vial does not sell personal information, use advertising SDKs, or share identifiers with advertising networks. Subscription reporting and operational usage controls are used to run the service, not for targeted advertising.

Vial is intended for adults aged 18 and over. An App Store content rating is separate from this eligibility requirement. We do not knowingly collect personal information from children.

9. Changes and contact

We will update this policy when our practices change and provide additional notice where appropriate. A policy update does not replace the explicit permission Vial requests before optional AI sharing.

Contact: syed@arvionllc.com.