Privacy policy
Last updated 10 September 2026
This policy describes what Valerdi collects, what it deliberately never collects, and what you can do about any of it. It is written to be checked rather than skimmed.
Who we are
Valerdi is operated by Lazar Stanković PR Računarsko programiranje DevLazar Vranje (trading as DevLazar), registration number 67875451, tax number 114816542, of Veljka Vlahovića 17, 17500 Vranje, Serbia. We are the data controller. You can reach us at devlazarbusiness@gmail.com.
What we collect
Three things, and nothing else.
- Your account. When you sign in with Apple or Google we receive an identifier for you and, if the provider chooses to share it, an email address. We never receive or store a password, because there isn't one. If you use Apple's Hide My Email, we only ever see the relay address.
- Your training. Sets, reps, loads, RPE, the programmes you build and the adjustments the app makes. This lives on your phone. It reaches our server only if you turn on sync, which is a paid feature and off until you choose it.
- How the app is used. Which screens are opened and which features are used — for example that a session was started, or that the plate calculator was opened. This carries no numbers you entered and no names of exercises.
- Your email, only if you ask us to tell you when the app is out. The waiting list on our home page stores the address you type, the date, and the exact sentence you agreed to — nothing else. No name, no IP address, no tracking of whether you opened anything. We use it for one message, at launch. Ask us at devlazarbusiness@gmail.com and we delete it the same way we delete an account: completely, and without asking why.
What we never collect
This section is the important one, and it is enforced by the software rather than by our good intentions.
- Sleep, heart-rate variability and resting heart rate never leave your device. They are read from Apple Health or Health Connect on the phone, turned into a single recovery figure on the phone, and used to shape that day's session on the phone. Our server's database is built so that the tables holding them cannot exist on it: a check in our schema fails the build if anyone ever tries to add them. They are excluded from sync and from backups.
- We never write anything back to Apple Health or Health Connect. The permission we ask for is read-only.
- No precise location, ever. We do not ask for it and we have no use for it. Your unit preference is taken from your phone's locale.
- No advertising identifiers, no ad networks, no attribution SDKs.
- We do not sell your data, and we do not share it for advertising. There is no version of Valerdi in which that changes.
Analytics, described exactly
We use PostHog, hosted in the European Union, to understand which parts of the app get used. We want this so the app gets better in the places people actually go, and we have deliberately made it incapable of carrying anything about your body.
The events it can send are a fixed, published list. There is no general-purpose way to attach data to them, and an automated test in our codebase fails the build if anyone adds a field that could hold a weight, a rep count, an RPE, a body weight or a recovery figure. The event recorded when you log a set carries no properties at all— we learn that a set was logged, never what it was.
Session recording and automatic click capture are both switched off. Automatic capture would collect the text of whatever you tapped, which in this app would mean the numbers you had just entered; that is precisely why it is off. Session recording is not merely disabled: the package that performs it is not installed in our codebase at all.
It does not know who you are, and it is not trying to find out. No account identifier, no device identifier and no advertising identifier is ever attached to an event. Nothing is stored on your phone or in your browser to recognise you again — no cookie, no local storage entry — which is also why this website has no cookie banner. Your IP address is discarded rather than recorded. In practical terms this means we can see that the plan screen was opened four times as often as history; we cannot see that you opened either, and we cannot follow you from one day to the next.
We are telling you what that costs us, because it is the honest way to describe a choice: counting this way means we cannot measure whether people come back, so what our analytics calls a “user” is really a visit. We decided that a number we cannot connect to a person is worth more than a number we can.
None of this runs during development. The analytics code is loaded only by the published app and the published website, so working on Valerdi never adds anything to what is counted.
Where your data is stored
Our server and its backups are in Germany, with Hetzner Online GmbH. Analytics is in the European Union with PostHog. We are established in Serbia, so our own access to the server is from outside the European Economic Area.
Who else touches it
| Who | What for | What they get |
|---|---|---|
| Hetzner Online GmbH (Germany) | Hosting and backups | Whatever you sync, encrypted at rest in backups. No recovery data. Also the waiting-list address, if you gave one. |
| PostHog (EU region) | Product analytics | Screen and feature events from the fixed list. No training data, no recovery data, no email, no identifier, no IP address. |
| Cloudflare (Turnstile) | Stopping bots on the waiting-list form | Loaded only if you use that form, never on any other page. It sees your IP address and browser in order to tell a person from a script. We do not send it your email, and it is not used to identify or follow you. |
| Apple and Google | Sign-in, subscriptions, app distribution | They act as their own controllers here. We receive an identifier and sometimes an email; they never receive your training from us. |
Your rights
You can get your data, correct it, delete it, restrict or object to what we do with it, and complain to a supervisory authority. Two of these are buttons rather than requests, because a right you have to write an email to exercise is a right most people never use:
- Export everything — Settings → Your data → Export. It produces a complete JSON file of every table on your phone, including the recovery figures that never reach us, because it is your copy and it should be whole.
- Delete everything on this phone — Settings → Your data. This drops the database file rather than deleting rows, so nothing is left behind.
- Delete your account and everything we hold — in the app under Settings → Account, or at this page if you no longer have the app installed.
How long we keep it
Training you have synced is kept until you delete it or your account. Backups are kept for 30 days and then overwritten, so a deletion is fully gone from backups within 30 days. Analytics events are kept for 12 months.
Children
Valerdi is for adults. It is rated 18+ in both stores and is not directed at children, and we do not knowingly collect data from anyone under 18.
Not medical advice
Valerdi is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. Talk to a healthcare professional before starting a new training programme.
Changes
If we change this policy in a way that affects what we collect or who receives it, we will say so in the app before the change takes effect, rather than quietly re-dating this page.
Contact
devlazarbusiness@gmail.com, or Veljka Vlahovića 17, 17500 Vranje, Serbia.