Legal

Privacy Policy

Effective date: 2026-07-14

Last updated: 2026-07-14

This Privacy Policy explains how Dary (“Dary”, “we”, “us”, or “our”) collects, uses, and protects your personal data when you use the Dary mobile application (the “App”) for iOS and Android, and when you use our website at dary.care (including the waitlist).

Dary is a medication and supplement reminder app. It is a general wellness tool. It is not a medical device, does not provide medical advice, and is not intended to diagnose, treat, cure, or prevent any disease. See our Medical Disclaimer.

1. Who we are (data controller)

The data controller responsible for your personal data is:

Arstanbek Aibekovich Rakhimov, individual entrepreneur registered in the Kyrgyz Republic (TIN 21708199801141) Manas street 43, apt. 13, Bishkek, Kyrgyz Republic Contact: [email protected]

For any privacy questions or to exercise your rights, contact us at the email above.

2. What we collect

We collect only what we need to run the reminder service:

Category Examples Why
Account data Email address, password (hashed by our auth provider), your name (if provided by you or shared by Google / Apple sign-in), or sign-in identifier from Google / Apple To create and secure your account
Health data Medication and supplement names, dosages, schedules, and intake logs you enter To provide reminders and show your history — see §3
Device data Push notification token, time zone, app language (locale) To deliver reminders at the right time in the right language
Preferences Marketing / news notification opt-in (on or off in Settings) To send optional product news and updates only if you opt in
Subscription data Purchase and entitlement status (via our billing provider) To unlock Dary+ features
Usage & diagnostics data App interaction events (screens viewed, features used), crash reports, device model and OS version To understand how the App is used, fix crashes, and improve the App — see §5
Website waitlist Email address, preferred platform (iOS / Android), and site language To notify you about the beta and product launch; you can unsubscribe anytime

We do NOT collect:

3. Health data and your explicit consent

Medication names, schedules, and intake logs are treated as special-category health data under the GDPR (Article 9) and as sensitive personal information under applicable US state laws.

We process this data only with your explicit consent, which you give during sign-up. You can withdraw consent at any time by deleting your account (see §8). We use health data solely to:

We do not use your health data for advertising, and we do not sell it.

4. Legal bases for processing (GDPR / UK GDPR)

Purpose Legal basis
Creating your account, syncing data, sending reminders Performance of a contract (Art. 6(1)(b))
Processing health data (medications, schedules, logs) Your explicit consent (Art. 9(2)(a))
Push notifications (reminders) Your consent (device permission + in-app explanation)
Optional marketing / news push in the App Your consent (opt-in in Settings; you can turn it off anytime)
Website waitlist and beta / launch emails Your consent (submitting the waitlist form; unsubscribe anytime)
Usage analytics and crash reporting Our legitimate interests (Art. 6(1)(f)) — see §5
Keeping the service secure and preventing abuse Our legitimate interests (Art. 6(1)(f))

5. Analytics and crash reporting

We use Firebase Analytics and Firebase Crashlytics (services provided by Google) to understand how the App is used and to find and fix crashes.

What this includes:

What this never includes: medication or supplement names, dosages, notes, or any other health data content; your precise location; advertising identifiers. Analytics events are recorded under a random, app-specific identifier that is not linked to your name or email address.

We also pass this random identifier to RevenueCat (§6) so that subscription lifecycle events (such as a trial starting or a renewal) appear in our analytics.

We process this data on the basis of our legitimate interests (Art. 6(1)(f)) in improving the App and keeping it reliable. We do not use this data for advertising, and we do not sell it. You can object to this processing at any time by contacting us (see §9).

6. How your data is shared (subprocessors)

We do not sell your personal data. We share it only with service providers (“subprocessors”) that help us run the App, under contracts that require them to protect your data:

Provider Purpose Location
Supabase Database, authentication, backend Hosted in the EU (Ireland)
Google (Firebase Cloud Messaging) Delivering push notifications Google infrastructure (may include US)
Google (Firebase Analytics & Crashlytics) Pseudonymous usage analytics and crash reporting (§5) Google infrastructure (may include US)
Google (BigQuery) Storage and analysis of raw analytics and crash events (§5) EU (Belgium)
RevenueCat Managing subscription status; receives a pseudonymous analytics identifier (§5) US
Apple / Google App distribution and payment processing US / global
Cloudflare Hosting the website and the waitlist API Cloudflare global network (may include EU and US)
Brevo Waitlist contacts and beta / product email EU (primarily France)

Your medication data is stored in the EU and is not included in push notification content sent through third-party infrastructure.

Waitlist emails are used only for beta access and product updates related to Dary. Marketing and news push notifications in the App are sent only if you opt in, and you can disable them in Settings.

7. International data transfers

Your core data is stored in the European Union (Ireland). Some subprocessors (§6) may process limited data outside your country, including in the United States. Pseudonymous analytics and crash data processed by Google (§5) may also be processed in the United States; our raw analytics export is stored in the EU. Where required, these transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses and, for UK users, the UK International Data Transfer Addendum. Our agreement with Supabase includes a signed Data Processing Addendum with these safeguards.

8. Data retention and deletion

9. Your rights

Depending on where you live, you have the right to:

To exercise any right, email [email protected]. We respond within the time limits required by applicable law.

10. UK users

If you are in the United Kingdom, the UK GDPR applies to your data. You have the same rights as listed in §9, and you may lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

11. California users (CCPA / CPRA)

If you are a California resident:

To exercise these rights, email [email protected].

12. Children

Dary is not directed to children. We do not knowingly collect personal data from anyone under the age of 16 (or the minimum age required in your country). If you believe a child has provided us with personal data, contact us and we will delete it.

13. Security

We protect your data with encryption in transit and at rest, row-level access controls so that you can only access your own data, and server-side notification delivery. No system is perfectly secure, but we work to keep your data safe and to notify you and the relevant authorities if a data breach affects you.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above and, for material changes, notify you in the App. Continued use of the App after changes means you accept the updated policy.

15. Contact

Privacy / data controller: Arstanbek Aibekovich Rakhimov — [email protected] Support: [email protected]

Dary — medication reminders, done right.