Privacy Policy
Last updated 6 August 2026
The short version
Lactico has no accounts and no server for your health data. Your safety answers, your doses and how you felt are stored only on your device. We cannot read them, because they are never sent to us. Delete the app, or use “Delete my data” in Settings, and they are gone.
1. Who we are
Lactico (“we”, “us”) provides the Lactico mobile app. For questions about this policy or your data, contact karim@creativeapps.studio.
2. Health data stays on your device
Lactico is a local-first app. The following is written to your device’s private app storage and is not transmitted to us or to any third party:
- your answers to the three safety-screening questions;
- your personalisation answers (how strongly dairy affects you, what you miss, how often you have dairy);
- every entry in your dose log — the date, the amount, the dairy source, the symptom severity, any symptoms you flag, and your free-text notes;
- your reminder time preference.
Because this data never leaves your device, we hold no copy of it, cannot recover it if you lose your device, and cannot produce it in response to any request. If your device is backed up (for example by iCloud Backup or Android Backup), the backup is made by Apple or Google under their own terms, not ours.
3. What third parties do receive
| Who | What they receive | Why |
|---|---|---|
| Apple App Store / Google Play | Your purchase and subscription status, tied to your Apple or Google account. Also any crash or usage statistics you have opted into at the OS level. | To take payment and manage your subscription. |
| RevenueCat, Inc. | A randomly generated app user ID, your subscription receipt and status, and basic device/platform information. No health data, no name, no email address. | To check whether your subscription is active and to restore purchases on a new device. |
We do not use advertising SDKs, and we do not run any third-party analytics or tracking in the app. We do not sell or share personal information, and we do not engage in “sharing” for cross-context behavioural advertising as defined under California law.
4. Notifications
Your daily dose reminder is a local notification, scheduled on your device by the app itself. We do not operate a push server and we do not collect push tokens. The reminder text is generated on your device and contains no data we can see. You can turn reminders off at any time in Settings, or in your device’s notification settings.
5. Legal basis and your rights
Where the UK GDPR or EU GDPR applies, our processing of subscription data is based on performance of a contract with you (Article 6(1)(b)) — we need it to give you access to what you paid for. We do not process your health data as a controller, because we never receive it.
You have the right to:
- erase your data — use “Delete my data and start over” in Settings, or uninstall the app. This is immediate and irreversible;
- access or port your data — it is already on your device, in the app;
- ask us about subscription data — email us and we will retrieve or delete what RevenueCat holds against your app user ID;
- complain to your data protection authority (in the UK, the Information Commissioner’s Office).
6. Children
Lactico is not directed at children under 13, and we do not knowingly collect data from them. A dairy reintroduction plan for a child should be run by a paediatrician, not an app.
7. Retention
Your on-device data stays until you delete it. Subscription records held via RevenueCat are retained for as long as your subscription is active and afterwards as needed for tax, accounting and dispute-resolution purposes.
8. Changes
If we change this policy we will update the date above, and — where the change is significant, such as beginning to collect data we previously did not — tell you in the app before it takes effect.