VIGDIS – VISUAL GUIDE FOR DAILY ACTIVITIES
Last updated: 19 August 2026 (rev. 3)
This Privacy Policy applies to the Vigdis – Visual Guide for Daily Activities mobile application (“App”) and to the website at vigdisapp.is. It does not cover third-party services that the App or website may link to; those services have their own privacy policies.
The App is operated by:
Vigdís ehf.
Álfaskeið 57, 220 Hafnarfjörður
Iceland
Email: support@vigdisapp.is
Company registration no. (kennitala): 670226-0850
For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Company acts as data controller in respect of the personal data described below. We have not appointed a Data Protection Officer; for questions, write to the email above.
The App is designed as a local-first application. By default, all user-generated content is stored exclusively on the user’s device.
Local user-generated content includes, but is not limited to:
Users with an active premium subscription may optionally enable Cloud Sync to back up and synchronize content across devices and to share selected profiles with other family members.
Uploading your own content to the cloud requires both of the following, and stops if either is withdrawn:
Turning “Sync my profiles” off stops your own content being uploaded. It does not delete content already synced; use the deletion routes described in Section 7 for that.
Receiving a profile that another household has shared with you works differently: if you are signed in, content shared with you is downloaded to your device regardless of the “Sync my profiles” switch or your subscription tier. That switch governs whether your data is uploaded, not whether data shared with you arrives. Without it, a profile someone shared with you could not appear on your device at all.
When Cloud Sync is not enabled, the Company:
When Cloud Sync is enabled, user-generated content is uploaded to and synchronized through our cloud sync sub-processor (see Sections 3.3 and 6). Each owner’s data is technically segregated using row-level security and is accessible only to (a) that owner’s authenticated account and (b) any other accounts the owner has explicitly invited to access a specific profile (see Section 3.5 – Profile Sharing). The Company does not access or read this content beyond what is necessary to operate the service; personnel access is limited, logged, and audited.
Users are responsible for device security and, when not using Cloud Sync, for their own backups.
The Company processes the following categories of personal data.
If you purchase a subscription:
We receive limited confirmation data (subscription status, transaction identifier issued by the platform) directly from Apple App Store or Google Play via the platform’s standard in-app purchase APIs. This data is used solely to provide access to paid features and is not shared with any other party.
Legal basis: Article 6(1)(b) GDPR – performance of contract.
If you contact us by email, we may process:
Legal basis:
Article 6(1)(b) GDPR – responding to your request
Article 6(1)(f) GDPR – legitimate interest in providing support
Article 6(1)(c) GDPR – compliance with legal obligations (if applicable)
Email communications are not used for marketing unless you explicitly consent.
If you choose to enable Cloud Sync, the Company processes:
Sign-in methods. Cloud Sync supports two sign-in methods, each with different data handling. No password is ever stored on the Company’s infrastructure — both methods rely on identity tokens issued by the platform provider.
@privaterelay.appleid.com) that forwards mail to your real address. We use whichever address Apple provides as your account identifier. We do not receive your Apple ID password.This data is uploaded only after you successfully sign in. You may at any time:
Legal basis: Article 6(1)(b) GDPR – performance of the contract under which we provide Cloud Sync.
The App uses Apple’s MetricKit framework to receive aggregated crash and performance reports generated by the device operating system. These reports do not contain content you create within the App and are anonymized by Apple before being made available to us. We use them solely to identify and fix stability and performance issues.
Legal basis: Article 6(1)(f) GDPR – legitimate interest in maintaining App stability.
Cloud Sync includes an optional Profile Sharing feature. As the owner of a profile, you may invite another person — typically a co-parent, grandparent, or other family member — to access that profile from their own Vigdis account. To send an invitation, you provide:
The invitee’s email address is stored on our cloud sync sub-processor’s infrastructure as part of the pending invitation record. Invitations expire automatically after a defined period if not accepted, after which the email address is removed.
When you send a profile-share invitation, the email address associated with your Cloud Sync account is shared with the invitee so they can recognize who is inviting them. Reciprocally, if you receive an invitation, you will see the email address of the person who invited you. By using the Profile Sharing feature, you accept this mutual disclosure of email addresses between inviter and invitee.
When an invitee accepts an invitation, an entry is created in our membership table linking their account to the relevant profile. From that moment until the share is revoked or the invitee leaves, that account can read (and, depending on role, edit) the synced content of that profile.
You may revoke a share at any time. When a share is revoked or an invitee leaves a profile:
You are responsible for choosing which profiles to share, with whom, and at what role. Invited users gain access to the profile’s synced content as it then exists, and to subsequent changes for as long as their access remains.
Legal basis: Article 6(1)(b) GDPR – performance of the Cloud Sync contract.
Our cloud sync sub-processor maintains short-lived operational logs of requests it receives, which can include the IP address from which a request originates, request timestamps, the type of request, and the authenticated account identifier (where applicable). These logs are used solely to operate, secure, and debug the service (for example, to diagnose sync failures, detect abuse, and respond to security incidents). The Company does not use these logs to build a profile of you or your behavior.
Legal basis: Article 6(1)(f) GDPR – legitimate interest in operating and securing the service.
To understand which features of the App are used and to prioritize improvements, the App may send limited product-telemetry events (for example, “app launched”, “task completed”, “paywall viewed”). Each event consists of:
If you are signed in to Cloud Sync, events are additionally tagged with your account identifier. This means individual events can in principle be associated with your account while you remain opted in.
The App does not include the content you create — task names, profile names, photographs, notes, or any free-text input — in telemetry events. Events are sent over TLS to our cloud sync sub-processor and stored append-only.
You may opt out at any time at Settings → Legal → Help improve Vigdís. When you opt out, future events stop being sent and any events queued on the device are discarded before they leave the device.
Legal basis: Article 6(1)(f) GDPR – legitimate interest in maintaining and improving the App, with an opt-out provided as a balancing measure.
The App offers a referral programme. Each signed-in account can generate a referral code and share it; when another person redeems it, both accounts receive a period of premium access.
To operate this we store, on redemption, a record linking the account identifier of the person who referred and the account identifier of the person who redeemed, together with the code used and a timestamp. This record is what prevents the same code being redeemed twice by one account, what allows us to grant the reward to both sides, and what lets the App show you how many people have used your code.
This means a referral creates a stored association between two accounts. We use that association only to operate and protect the programme — granting rewards and detecting abuse such as self-referral or bulk redemption. We do not use it to build a social graph, to infer relationships between users, or for marketing.
We do not publish your identity to the person who redeems your code, or theirs to you. The App shows only counts.
Legal basis: Article 6(1)(b) GDPR – performance of the contract, in respect of granting the reward you asked for; Article 6(1)(f) GDPR – legitimate interest in preventing abuse of the programme.
Retention: redemption records are kept for as long as the account exists, because they are the record of why premium access was granted. They are removed when the account is deleted, as described in Section 7.
Where an organisation has purchased a licence (see Section 9A), a member of staff redeems a code inside the App. On redemption we store a record containing the code, the account identifier of the person who redeemed it, and the date the granted access expires, together with an entitlement record for that account holding its subscription tier and profile limit.
These records exist to enforce the licence — to stop one code being redeemed more times than the organisation bought, to prevent a single account redeeming twice, and to establish what access that account has and until when. They contain no pupil data.
Legal basis: Article 6(1)(b) GDPR – performance of the contract; Article 6(1)(f) GDPR – legitimate interest in enforcing the terms of a purchased licence.
Retention: kept for the duration of the licence and of the account, and removed when the account is deleted, as described in Section 7.
We do not use third-party advertising trackers, behavioral analytics tools, or user profiling technologies within the App. We do not collect in-app usage analytics for marketing, advertising, or behavioral-profiling purposes. The only product-related telemetry we collect is the limited feature-usage data described in Section 3.7, used solely to prioritize improvements to the App. The App does not implement Apple’s App Tracking Transparency tracking, because it does not engage in cross-app or cross-site tracking.
The crash and performance diagnostics described in Section 3.4, the operational logs described in Section 3.6, and the product telemetry described in Section 3.7 are used solely to maintain, secure, and improve the service and are not combined with personal data for profiling purposes.
If we introduce additional analytics or third-party tracking tools in the future, we will update this Privacy Policy before such tools are used, including details about the provider and categories of data processed.
The App:
The Company is established in Iceland. To operate the App, we engage a small number of carefully selected sub-processors:
Where a sub-processor processes personal data outside the European Economic Area (EEA), we rely on lawful safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms.
You may request a current sub-processor list at any time via support@vigdisapp.is.
For users who do not enable Cloud Sync, no user content is retained by the Company.
For users who enable Cloud Sync:
Personal data processed by the Company outside Cloud Sync (e.g., support emails, subscription confirmation data) is retained only as long as necessary to:
Thereafter, data is securely deleted or anonymized where appropriate.
We implement appropriate technical and organizational measures to protect personal data processed by the Company, including encryption in transit (TLS) for all communication between the App and our cloud sync sub-processor, encryption at rest provided by the sub-processor, row-level access controls on synced data, identity-provider authentication via Apple and Google (no password is ever stored on our infrastructure), and limited and logged personnel access to production systems.
However:
The Company is not responsible for device theft, compromise, malfunction, or user negligence.
The App is intended for use by parents or legal guardians and is offered to adults aged 18 or older. The Company does not knowingly collect personal data directly from children, and children do not create accounts in the App.
The App allows a parent or guardian to create one or more “profiles” representing the children in their household. These profiles may contain a child’s first name, an avatar image, schedules, tasks, photographs the parent or guardian attaches, and similar activity content. The App does not request, encourage, or store sensitive identifiers about children (such as government identifiers, school identifiers, precise location, or contact information).
When Cloud Sync is not enabled, all profile content relating to minors remains stored locally on the user’s device and is not accessible to the Company.
When Cloud Sync is enabled by the parent or guardian, this profile content is uploaded to the Company’s sub-processors as described in Sections 3.3 and 6, under the legal authority of the parent or guardian who created it. The data remains technically segregated to the owning parent or guardian’s account and any accounts they have explicitly invited via Profile Sharing.
The Company:
Parents and guardians are solely responsible for the lawful handling of children’s personal data within the App, including obtaining any required consent under applicable law (such as COPPA in the United States or equivalent provisions of Persónuverndarlög and the GDPR in the EEA). A parent or guardian may delete a child’s profile at any time within the App, which removes the associated content from synced storage as part of the standard deletion process described in Section 7.
A school, kindergarten, municipality or similar organisation may purchase a licence and provide its staff with a code that they redeem inside the App. This section describes how data protection works in that arrangement; it does not apply to ordinary household use.
Roles under the GDPR. Where an organisation deploys the App for its own purposes, that organisation is the data controller for the profile content its staff create, and the Company acts as a data processor on its behalf. A written Data Processing Agreement under Article 28 GDPR is available to the organisation and governs that processing. For ordinary household use, the Company remains the controller as described in Section 1.
What a licence changes technically. Redeeming a licence code records the redemption against the redeeming staff account and grants that account premium access for the licence period. It may also raise the number of profiles that account can create. It does not give the Company, the organisation, or any other account access to data belonging to unrelated households.
What the organisation can see. Profile content remains scoped to the staff account that owns it and to any accounts that account has explicitly invited through Profile Sharing. The Company does not provide the purchasing organisation with a central console over its staff accounts’ content, and buying a licence does not by itself grant the organisation access to any profile.
Responsibilities. The organisation is responsible for establishing its own lawful basis for processing pupil data, for meeting its information obligations to parents and guardians, and for handling data subject requests it receives. The Company will assist the organisation with such requests to the extent required by Article 28(3) GDPR.
What is not collected. The App does not request or store pupil government identifiers, school identifiers, precise location, or contact details. The data minimisation, retention, security and international transfer terms in Sections 6, 7 and 8 apply to institutional use unchanged.
Organisations may request the Data Processing Agreement and a data processing overview at support@vigdisapp.is.
If you are located in the EEA, UK, or Switzerland, you have the right to:
In Iceland, complaints may be submitted to:
Persónuvernd (Icelandic Data Protection Authority)
www.personuvernd.is
Requests may be submitted to: support@vigdisapp.is
We process personal data only where legally permitted, including:
For users reviewing the App’s Apple App Privacy disclosure, the categories of personal data the App handles correspond to:
Linked to you. Apple’s disclosure separates data that is linked to your identity from data that is not. Because telemetry events carry your account identifier while you are signed in to Cloud Sync (Section 3.7), and because referral and licence redemption records are keyed to your account (Sections 3.8 and 3.9), the following categories are declared as linked to you: Contact Info, User Content, Identifiers, Usage Data and Purchases. Diagnostics is declared as not linked to you, because the crash and performance reports described in Section 3.4 are provided by Apple’s MetricKit and are not tied to your account.
None of these categories is used for tracking as Apple defines it, which is why the App does not present an App Tracking Transparency prompt.
The App does not collect Browsing History, Search History, Health & Fitness data, Financial Information, Precise Location, Coarse Location, Sensitive Info, or Contacts.
Device permissions. The App may request access to your Camera (to take photographs for profiles, tasks, or rewards and to scan QR codes for profile-share invitations) and to your Photo Library (to select existing photographs to attach). These permissions are requested by the operating system at the moment of use, may be revoked at any time in iOS Settings, and the live camera preview is processed only on your device and is never transmitted to the Company. The App may also request permission to send local notifications (daily reminders, streak warnings, reward and achievement alerts, timer-end notifications, and incoming-invite notifications); these notifications are scheduled and delivered entirely on your device and the App does not use Apple’s remote push-notification service to send notifications from a server.
We may update this Privacy Policy from time to time.
If changes are material, we may notify you through the App or by other appropriate means.
Continued use of the App after updates constitutes acceptance of the revised Privacy Policy.
For questions regarding this Privacy Policy:
Vigdís ehf.
Álfaskeið 57, 220 Hafnarfjörður
Iceland
support@vigdisapp.is