Privacy policy

Who we are

Tonelva is published by Vast Flow, LLP, which operates the app and this website and is the data controller for the limited processing described here. Write to [email protected] with any question about this policy, including a request to access or delete data.

The short version

Tonelva has no user accounts, no sign-in and no cloud sync. It never asks for your name, your email address or your date of birth. Every reading you record stays in the app's own storage on your device, every average and category is calculated locally, and the PDF report is generated on the phone. Nothing is transmitted to us at any point. Deleting the app deletes the data with it.

That is why the App Store privacy label reads Data Not Collected. In a category where several free apps monetise exactly this kind of information, it is worth stating that the label is a literal description of the architecture rather than a technicality.

Why we built it this way

A blood pressure history says a great deal about a person: that they have a chronic condition, roughly how well it is controlled, when they wake, and whether something changed. It is the sort of record that is valuable to advertisers and to data brokers, and that becomes a liability the moment it is held anywhere. The most reliable protection is not to hold it, so there is no server that could be compromised and no database that could be breached or sold.

The cost is real and we would rather name it than market the absence of a feature as a virtue: there is no cloud backup, no sync between your phone and your tablet, and no way for us to recover your history if you lose the device. Apple Health, if you enable it, effectively becomes your backup, and that is described below.

What the app stores on your device

Your readings with their date and time, any note you attach, the arm and the device if you record them, medication reminders, your chosen reference scale, and non-sensitive preference flags. Categories are derived from readings each time rather than stored, so switching between the American and European scales re-renders your whole history live. None of it is transmitted. It may be included in your own device backup if you have one enabled, in which case it is governed by Apple's or Google's terms rather than ours.

Apple Health

With your explicit permission the app can read and write blood pressure and heart rate in Apple Health. Readings you enter can be mirrored to Health, and readings recorded elsewhere can be imported with duplicates filtered out. All of that exchange happens on the device under Apple's HealthKit rules, which prohibit using health data for advertising. We never receive it and we have no way to see it.

Two honest notes. First, iOS deliberately hides read-permission status from apps, so what Tonelva shows you is our request rather than a confirmed connection. Second, imported readings are never re-mirrored back, and switching sync on does not backfill your existing history — both choices exist to prevent duplicate entries, and both surprise people if unstated.

The PDF report and export

The PDF and the CSV export are generated on your device. They leave it only through your own share sheet, to the destination you choose — your email, your messaging app, your printer, your doctor. We are not part of that transfer, we never receive a copy, and we have no record that it happened. Once a file has left your device through someone else's app, it is governed by that app's terms rather than by this policy, so take the same care you would with any other medical document.

Notifications

Measurement and medication reminders are scheduled locally by your device. There is no push server and no token, and nothing leaves the phone to make a reminder fire. Reminder text never contains a reading or a medication name, so a notification on a lock screen does not disclose anything to somebody glancing at your phone. That is a deliberate choice for a health app, not an oversight.

Purchases

Subscriptions are sold and processed by Apple and Google. We never see your payment details. To decide whether to unlock Pro features, the app uses RevenueCat, which processes an anonymous identifier and the receipt the store issues. That tells us that a subscription exists and what state it is in. It does not identify you, and it cannot be connected to any reading you have recorded.

Analytics: none in the app

The app contains no analytics SDK. No Firebase Analytics, no Crashlytics, no attribution SDK, no event tracking and no advertising identifier. There is no advertising in the app at all. We do not know how often you open it, which screens you use, or what your readings are. This costs us product insight and we accept that as the price of the privacy label.

This website is different and you should know it. It loads Microsoft Clarity, which records aggregate site usage — pages viewed, approximate region, device and browser, and anonymised interaction patterns such as scroll depth — so we can find pages that are broken or confusing. It is not connected to any app data, it does not follow you to other sites, and it cannot see anything you type into the tools. It sets cookies and honours the Global Privacy Control signal where your browser sends one. A content blocker will stop it and every tool here works normally without it.

The tools on this site

Readings you type into the category checker, the average calculator or any other tool on this website stay in your browser. They are never transmitted, never logged and never stored, because the arithmetic runs on your own machine in JavaScript. Closing the tab discards everything. There is no form submission anywhere on this site, which is also why none of these tools can email you a result.

What we never collect

We do not collect your name, email address, contacts, photos, location, advertising identifier or any health data. We do not sell data and we do not share it with data brokers. There is no mechanism by which we could build a profile of an individual, because there is no identity to attach one to.

Legal bases, for readers in the EEA and UK

Because the app processes your data on the device rather than transmitting it, most of it never becomes processing that we perform. Purchase-receipt validation is necessary to perform the contract you entered into when subscribing. Website analytics rest on our legitimate interest in improving a free resource, balanced against the fact that they do not identify you and cannot see your readings.

A note on special category data

Blood pressure readings are health data, which several privacy regimes treat as a special category attracting stricter protection. Our answer is architectural: we do not receive it. We hold no special category data about any user, we cannot be compelled to produce records we do not have, and no breach of our systems could expose your history. If that ever changed we would say so prominently rather than amending a clause on this page.

Retention

App data is retained on your device until you delete it or delete the app. We hold no copy and cannot retrieve or restore it. Purchase records are retained for as long as store receipt validation requires. Website analytics follow Microsoft Clarity's own retention schedule.

Your rights

You may have the right to access, correct, delete or port your personal data, and to object to certain processing. In practice the app satisfies all of them directly: editing a reading corrects it, deleting one deletes it, the export function provides portability, and deleting the app removes everything. For written confirmation of what we hold — which for an app user is a receipt state and nothing else — write to [email protected] and we will respond within thirty days.

Cookies

The app uses no cookies. On this website the only cookies are those set by Microsoft Clarity for the analytics described above. There is no advertising cookie, no remarketing pixel, no social login and no embedded third-party widget that could set one.

If you are in California

We do not sell personal information and we do not share it for cross-context behavioural advertising as those terms are defined in the California Consumer Privacy Act. You have the right to know what we hold, to request deletion, and not to be discriminated against for exercising either — and because there is no account, exercising them usually requires nothing more than deleting the app.

Children

Tonelva is not directed at children and we do not knowingly collect data from anyone under 13. The app is intended for adults keeping their own record.

Security

The strongest security property of this app is that there is nothing central to attack: no account to compromise, no password to steal, no server to breach, no database of user records to leak. Data on your device is protected by the operating system's own storage protections and by your device passcode, which is worth having enabled. Website traffic is served over an encrypted connection.

International transfers

We hold no user health data to transfer. Apple, Google, RevenueCat and Microsoft process data in the regions described in their own policies, which may include the United States, under the transfer mechanisms those providers publish.

Changes

If the way data is handled changes, this page changes and the date at the top changes with it. Material changes will also be announced in the app. If we ever added a server component or cloud sync, we would say so prominently rather than quietly amending a clause here.

Contact

Questions, deletion requests and complaints go to [email protected]. If you are in the EEA or the UK and are not satisfied with our response, you may complain to your national data protection authority.