VIGDIS – VISUAL GUIDE FOR DAILY ACTIVITIES
Last updated: 12 May 2026 (rev. 2)
This Privacy Policy applies to the Vigdis – Visual Guide for Daily Activities mobile application (“App”) and to the website at vigdisapp.is. It does not cover third-party services that the App or website may link to; those services have their own privacy policies.
The App is operated by:
Vigdís ehf.
Álfaskeið 57, 221 Hafnarfjörður
Iceland
Email: support@vigdisapp.is
VAT / ID No.: 6702260850
For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Company acts as data controller in respect of the personal data described below. We have not appointed a Data Protection Officer; for questions, write to the email above.
The App is designed as a local-first application. By default, all user-generated content is stored exclusively on the user’s device.
Local user-generated content includes, but is not limited to:
Users with an active premium subscription may optionally enable Cloud Sync to back up and synchronize content across devices and to share selected profiles with other family members. Cloud Sync is opt-in: it is activated only when the user creates an account and signs in within the App.
When Cloud Sync is not enabled, the Company:
When Cloud Sync is enabled, user-generated content is uploaded to and synchronized through our cloud sync sub-processor (see Sections 3.3 and 6). Each owner’s data is technically segregated using row-level security and is accessible only to (a) that owner’s authenticated account and (b) any other accounts the owner has explicitly invited to access a specific profile (see Section 3.5 – Profile Sharing). The Company does not access or read this content beyond what is necessary to operate the service; personnel access is limited, logged, and audited.
Users are responsible for device security and, when not using Cloud Sync, for their own backups.
The Company processes the following categories of personal data.
If you purchase a subscription:
We receive limited confirmation data (subscription status, transaction identifier issued by the platform) directly from Apple App Store or Google Play via the platform’s standard in-app purchase APIs. This data is used solely to provide access to paid features and is not shared with any other party.
Legal basis: Article 6(1)(b) GDPR – performance of contract.
If you contact us by email, we may process:
Legal basis:
Article 6(1)(b) GDPR – responding to your request
Article 6(1)(f) GDPR – legitimate interest in providing support
Article 6(1)(c) GDPR – compliance with legal obligations (if applicable)
Email communications are not used for marketing unless you explicitly consent.
If you choose to enable Cloud Sync, the Company processes:
Sign-in methods. Cloud Sync supports two sign-in methods, each with different data handling. No password is ever stored on the Company’s infrastructure — both methods rely on identity tokens issued by the platform provider.
@privaterelay.appleid.com) that forwards mail to your real address. We use whichever address Apple provides as your account identifier. We do not receive your Apple ID password.This data is uploaded only after you successfully sign in. You may at any time:
Legal basis: Article 6(1)(b) GDPR – performance of the contract under which we provide Cloud Sync.
The App uses Apple’s MetricKit framework to receive aggregated crash and performance reports generated by the device operating system. These reports do not contain content you create within the App and are anonymized by Apple before being made available to us. We use them solely to identify and fix stability and performance issues.
Legal basis: Article 6(1)(f) GDPR – legitimate interest in maintaining App stability.
Cloud Sync includes an optional Profile Sharing feature. As the owner of a profile, you may invite another person — typically a co-parent, grandparent, or other family member — to access that profile from their own Vigdis account. To send an invitation, you provide:
The invitee’s email address is stored on our cloud sync sub-processor’s infrastructure as part of the pending invitation record. Invitations expire automatically after a defined period if not accepted, after which the email address is removed.
When you send a profile-share invitation, the email address associated with your Cloud Sync account is shared with the invitee so they can recognize who is inviting them. Reciprocally, if you receive an invitation, you will see the email address of the person who invited you. By using the Profile Sharing feature, you accept this mutual disclosure of email addresses between inviter and invitee.
When an invitee accepts an invitation, an entry is created in our membership table linking their account to the relevant profile. From that moment until the share is revoked or the invitee leaves, that account can read (and, depending on role, edit) the synced content of that profile.
You may revoke a share at any time. When a share is revoked or an invitee leaves a profile:
You are responsible for choosing which profiles to share, with whom, and at what role. Invited users gain access to the profile’s synced content as it then exists, and to subsequent changes for as long as their access remains.
Legal basis: Article 6(1)(b) GDPR – performance of the Cloud Sync contract.
Our cloud sync sub-processor maintains short-lived operational logs of requests it receives, which can include the IP address from which a request originates, request timestamps, the type of request, and the authenticated account identifier (where applicable). These logs are used solely to operate, secure, and debug the service (for example, to diagnose sync failures, detect abuse, and respond to security incidents). The Company does not use these logs to build a profile of you or your behavior.
Legal basis: Article 6(1)(f) GDPR – legitimate interest in operating and securing the service.
To understand which features of the App are used and to prioritize improvements, the App may send limited product-telemetry events (for example, “app launched”, “task completed”, “paywall viewed”). Each event consists of:
If you are signed in to Cloud Sync, events are additionally tagged with your account identifier. This means individual events can in principle be associated with your account while you remain opted in.
The App does not include the content you create — task names, profile names, photographs, notes, or any free-text input — in telemetry events. Events are sent over TLS to our cloud sync sub-processor and stored append-only.
You may opt out at any time at Settings → Legal → Help improve Vigdís. When you opt out, future events stop being sent and any events queued on the device are discarded before they leave the device.
Legal basis: Article 6(1)(f) GDPR – legitimate interest in maintaining and improving the App, with an opt-out provided as a balancing measure.
We do not use third-party advertising trackers, behavioral analytics tools, or user profiling technologies within the App. We do not collect in-app usage analytics for marketing, advertising, or behavioral-profiling purposes. The only product-related telemetry we collect is the limited feature-usage data described in Section 3.7, used solely to prioritize improvements to the App. The App does not implement Apple’s App Tracking Transparency tracking, because it does not engage in cross-app or cross-site tracking.
The crash and performance diagnostics described in Section 3.4, the operational logs described in Section 3.6, and the product telemetry described in Section 3.7 are used solely to maintain, secure, and improve the service and are not combined with personal data for profiling purposes.
If we introduce additional analytics or third-party tracking tools in the future, we will update this Privacy Policy before such tools are used, including details about the provider and categories of data processed.
The App:
The Company is established in Iceland. To operate the App, we engage a small number of carefully selected sub-processors:
Where a sub-processor processes personal data outside the European Economic Area (EEA), we rely on lawful safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms.
You may request a current sub-processor list at any time via support@vigdisapp.is.
For users who do not enable Cloud Sync, no user content is retained by the Company.
For users who enable Cloud Sync:
Personal data processed by the Company outside Cloud Sync (e.g., support emails, subscription confirmation data) is retained only as long as necessary to:
Thereafter, data is securely deleted or anonymized where appropriate.
We implement appropriate technical and organizational measures to protect personal data processed by the Company, including encryption in transit (TLS) for all communication between the App and our cloud sync sub-processor, encryption at rest provided by the sub-processor, row-level access controls on synced data, identity-provider authentication via Apple and Google (no password is ever stored on our infrastructure), and limited and logged personnel access to production systems.
However:
The Company is not responsible for device theft, compromise, malfunction, or user negligence.
The App is intended for use by parents or legal guardians and is offered to adults aged 18 or older. The Company does not knowingly collect personal data directly from children, and children do not create accounts in the App.
The App allows a parent or guardian to create one or more “profiles” representing the children in their household. These profiles may contain a child’s first name, an avatar image, schedules, tasks, photographs the parent or guardian attaches, and similar activity content. The App does not request, encourage, or store sensitive identifiers about children (such as government identifiers, school identifiers, precise location, or contact information).
When Cloud Sync is not enabled, all profile content relating to minors remains stored locally on the user’s device and is not accessible to the Company.
When Cloud Sync is enabled by the parent or guardian, this profile content is uploaded to the Company’s sub-processors as described in Sections 3.3 and 6, under the legal authority of the parent or guardian who created it. The data remains technically segregated to the owning parent or guardian’s account and any accounts they have explicitly invited via Profile Sharing.
The Company:
Parents and guardians are solely responsible for the lawful handling of children’s personal data within the App, including obtaining any required consent under applicable law (such as COPPA in the United States or equivalent provisions of Persónuverndarlög and the GDPR in the EEA). A parent or guardian may delete a child’s profile at any time within the App, which removes the associated content from synced storage as part of the standard deletion process described in Section 7.
If you are located in the EEA, UK, or Switzerland, you have the right to:
In Iceland, complaints may be submitted to:
Persónuvernd (Icelandic Data Protection Authority)
www.personuvernd.is
Requests may be submitted to: support@vigdisapp.is
We process personal data only where legally permitted, including:
For users reviewing the App’s Apple App Privacy disclosure, the categories of personal data the App handles correspond to:
The App does not collect Browsing History, Search History, Health & Fitness data, Financial Information, Precise Location, Coarse Location, Sensitive Info, or Contacts.
Device permissions. The App may request access to your Camera (to take photographs for profiles, tasks, or rewards and to scan QR codes for profile-share invitations) and to your Photo Library (to select existing photographs to attach). These permissions are requested by the operating system at the moment of use, may be revoked at any time in iOS Settings, and the live camera preview is processed only on your device and is never transmitted to the Company. The App may also request permission to send local notifications (daily reminders, streak warnings, reward and achievement alerts, timer-end notifications, and incoming-invite notifications); these notifications are scheduled and delivered entirely on your device and the App does not use Apple’s remote push-notification service to send notifications from a server.
We may update this Privacy Policy from time to time.
If changes are material, we may notify you through the App or by other appropriate means.
Continued use of the App after updates constitutes acceptance of the revised Privacy Policy.
For questions regarding this Privacy Policy:
Vigdís ehf.
Álfaskeið 57, 221 Hafnarfjörður
Iceland
support@vigdisapp.is