Join the waitlist

Privacy

Privacy policy

Last updated 26 October 2026

The short version

  • You can use Kroky without an account. Then everything stays on your phone and we receive none of it.
  • If you create an account, your data is backed up on servers in the EU so you can restore it or use it on another phone.
  • No ads, no analytics, no tracking, and we never sell or share your data.
  • You can delete your account and all its data from the app at any time.

Who we are

Kroky is made by Yuliia Polishchuk, a sole trader in the United Kingdom, who is responsible for your data (the "controller" under the UK GDPR). For people in Ukraine, we also follow the Law of Ukraine "On Personal Data Protection". Questions about privacy go to krokyapp@gmail.com.

This policy covers the Kroky app for iOS and Android and this website.

What we collect and why

Using the app without an account

Everything you enter stays on your phone, encrypted (AES-GCM, with the key kept in the iOS Keychain or Android Keystore). We don't receive it. The only thing that can leave your phone is a crash report (see below).

With an account (optional backup)

If you sign up, we store the following so we can back it up and keep it in sync between your phones:

  • Account: your email and password. Passwords are stored hashed by our database provider; we can't see them.
  • Profile: your name, language, your companion's name and level, reminder settings, and when you gave consent.
  • Health data: your dose plan, pens, logged doses, weight, daily check-ins (appetite, nausea, energy, mood) and habits.

Health data is a special category of data under the UK GDPR and "sensitive" data under Ukrainian law. We only store it with your explicit consent, which you give when you create an account (UK GDPR Article 9(2)(a)). You can withdraw it at any time by deleting your account.

Feedback you send

If you send feedback from Settings, we store your message, its type (idea, problem, other), the app version, platform and language, linked to your account so we can follow up. Please leave out personal medical details.

Crash reports

When the app crashes, it sends a crash report so we can fix the bug. It contains the error, the app version, your device model and operating system, and which screens you opened just before the crash. It does not contain your account, email, health data, screenshots, network requests or anything you typed. We do this on the basis of our legitimate interest in keeping the app working (UK GDPR Article 6(1)(f)).

Reminders

Reminders are scheduled on your phone and never go through our servers. They show your medicine and dose, so they may be visible on your lock screen; you can change that in your phone's notification settings.

The waitlist

If you join the waitlist on this website, we store your email, the language you chose and which form you used. We use it only to tell you when Kroky launches. That's based on your consent, and you can ask us to remove it at any time.

This website

The website uses no cookies, analytics or trackers, and loads nothing from third parties. It remembers your language choice in your own browser's storage, which never reaches us.

What we never do

  • Show ads or use advertising or analytics tools.
  • Sell, rent or share your data with advertisers, data brokers, insurers or employers.
  • Use your health data for anything other than showing it to you and backing it up.
  • Give medical advice or make decisions about you automatically.

Who processes your data for us

We use three service providers, each under a data processing agreement:

  • Supabase: database and sign-in, hosted in the EU.
  • Resend: sends account emails (confirming your email, resetting your password), hosted in the EU (Ireland).
  • Sentry: crash reports, hosted in the EU (Germany).

If we use an email service to send the launch email to the waitlist, we'll list it here before we send anything. The UK recognises the EU as giving your data equal protection, so storing it there keeps the same safeguards. We'll only share data with authorities if the law requires it.

How long we keep it

  • Account and health data: until you delete your account. Deleting removes it from our database straight away; copies in our encrypted backups are gone within 7 days.
  • Feedback: until you delete your account, or sooner once we've dealt with it.
  • Crash reports: up to 90 days.
  • Waitlist emails: until we've sent the launch email, or until you ask us to remove yours.

Your rights

You can ask to see, correct, export or delete your data, restrict or object to how we use it, and withdraw your consent at any time. Most of this you can do yourself in the app: Settings → Delete account removes your account and all its data from our servers and your phone. For anything else, email krokyapp@gmail.com and we'll reply within 30 days.

If you think we've mishandled your data, please tell us first so we can put it right. You can also complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in Ukraine, the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).

Security

Data on your phone is encrypted. Data travelling to our servers is encrypted in transit (TLS). On the server, each account can only ever reach its own records, enforced by the database itself.

Age

Kroky is for adults (18+). We don't knowingly collect data from children.

Changes

If we change this policy, we'll update the date at the top. If a change affects how we use your health data, we'll tell you in the app and ask again before it applies.