Legal

Privacy Policy

Effective date: September 2, 2026 · Replaces the version dated November 12, 2025

1. Who we are and what this policy covers

This policy explains how Numentio, LLC ("Numentio," "we," "us," or "our") handles personal information when you use:

• the Get Visionary app for iPhone and iPad, listed on the App Store as "Visionary: Vision Training" (the "App");
• the website at getvisionary.app (the "Website"); and
• our support and Vision Access Pledge email inboxes.

Numentio is the data controller for this information. We are based in the United States. Where this policy uses "personal information," it means information that identifies, relates to, or could reasonably be linked with you. This policy does not cover Apple, Google, or other companies' own practices; their policies are linked in Section 4.

2. What we collect

2.1 Information you give us

• Account details. When you first open the App we create a guest account with a random identifier; no name or email is required. If you choose to add an email address and password, we store the email address and a securely hashed password (we never see the password itself). You may also add an optional display name.
• Onboarding answers. During setup the App asks a few questions about what is getting harder to read, your reading and screen habits, and how quickly your eyes tire, and runs a short interactive check. We use these to set your starting levels and plan. They are kept on your device and, once you have an account, in your account's training state.
• Preferences. Reminder times, daily goal, sound and difficulty settings, focus area, and language.
• Support and pledge messages. If you email support or request the Vision Access Pledge, we receive your email address, the contents of your message, and, for pledge requests sent from the App, your account identifier so we can activate the grant. If you respond to an in-app question about how training is going, we record that response.

2.2 Training and check data the App generates

Every time you train, the App creates a session record. These records are saved on your device first and then synced to your account so your history survives a new phone. A session record includes:

• the exercise, its version, and the phase of your plan;
• the stimulus settings shown to you (for example contrast, size, orientation, spacing, or duration) and how difficulty adapted during the session;
• your responses, accuracy, response times, and the difficulty estimate or model summary produced from them;
• the display context needed to interpret the result, such as device model, screen size, text size, and the viewing setup you confirmed;
• results of the optional Near Vision Check and Reading Check, such as the App's in-task near-detail estimate or words per minute; and
• streaks, points, milestone stars, plan position, and free-session use.

These records may reveal something about how well you see and read. In some jurisdictions that makes them health-related or sensitive information. We treat them as sensitive: we use them only to provide and improve the App as described in Section 3, we never sell them, and we never share them with advertisers. Exact responses, thresholds, and check results stay inside your account record. They are not sent to our analytics or attribution partners.

2.3 Device, app, and technical information

• Device and app details: device model, iOS version, app version, language, region, and screen dimensions.
• Identifiers: your account identifier, a Firebase installation identifier, an app-instance analytics identifier, the Apple identifier-for-vendors (IDFV), and your RevenueCat customer identifier (which is the same as your account identifier). The advertising identifier (IDFA) is collected only with your permission; see Section 5.
• Notification details: a push-notification token, whether notifications are enabled, your time zone and current UTC offset (so reminders are never sent at night), and your reminder schedule.
• Usage events: screens viewed, onboarding steps completed, exercises started and completed, paywall views, purchases, and similar product-interaction events, each with low-detail parameters (for example the exercise name, not your answers).
• Diagnostics: crash reports and performance traces, which include device state at the time of a crash.
• IP address: received transiently by our service providers when the App or Website connects to them; we do not store IP addresses in your account.

2.4 Purchase information

Apple processes every payment. We never receive your card number or bank details. Through Apple and RevenueCat we receive the product you bought, its price and currency, the purchase, renewal, trial, and expiration dates, transaction identifiers, and whether the subscription will renew. If your account has an email address, it is also attached to your RevenueCat customer profile so support can find your purchase.

2.5 Camera (optional gaze exercises)

A few exercises, such as smooth pursuit and peripheral awareness, can use the front camera and Apple's ARKit face tracking on supported devices to estimate where you are looking. This is optional and requires your explicit camera permission. All processing happens on your device. We do not record, store, or transmit camera images, face geometry, or gaze coordinates. Only the exercise's ordinary performance metrics (for example accuracy and completion) are saved, the same as for any other exercise. You can revoke camera access at any time in iOS Settings.

2.6 What we do not collect

We do not collect precise location, contacts, photos, microphone audio, Apple Health data, government identifiers, payment card numbers, or biometric templates. We do not read your prescription or medical records.

3. How we use information and our legal bases

Aggregated and de-identified data. We may create statistics that do not identify anyone, for example the share of users who complete a first session or average accuracy trends across an exercise, and use them to improve the App and describe it publicly. We do not attempt to re-identify such data.

Research. We do not currently use customer data for scientific studies or publications. If we ever propose to, we will ask for your separate, specific consent first and describe the study, and you will be free to say no without losing any feature.

No automated decisions with legal effect. The App adapts exercise difficulty automatically, but we make no decisions about you that have legal or similarly significant effects.

4. Who we share information with

We share personal information only as described here.

4.1 Service providers

These companies process data on our behalf under contracts that limit what they may do with it:

4.2 Apple

Apple distributes the App and processes purchases under its own privacy policy. Apple provides us purchase and subscription information, delivers push notifications, and, through its SKAdNetwork and AdAttributionKit systems, sends privacy-preserving install postbacks that do not identify you. Apple privacy

4.3 Advertising networks

If you allow tracking (Section 5), AppsFlyer shares your advertising identifier and conversion events with the ad network that showed you an ad, currently Meta and Google, so that network can measure and optimize its campaigns. We also send purchase and trial-start conversion events to Google Ads through Google Analytics for Firebase. We never share training results, check results, or onboarding answers with any advertising network.

4.4 Legal and safety

We may disclose information if we believe in good faith that it is required by law, subpoena, or legal process; to protect the rights, property, or safety of our users, the public, or Numentio; or to detect and prevent fraud or abuse.

4.5 Business transfers

If Numentio is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will require the recipient to honor this policy or give you notice and choices before it applies different practices.

4.6 With your direction

We share information with others when you ask us to, for example if you email us a screenshot to share with a clinician.

We do not sell personal information, and we do not share it with data brokers.

5. Advertising measurement and the iOS tracking prompt

We run ads so people who might benefit from Get Visionary can find it. To learn which ads work, and to keep the App affordable, we use AppsFlyer to attribute installs and subscriptions to campaigns.

• If you tap "Allow" on the iOS tracking prompt, the App reads your advertising identifier (IDFA) and AppsFlyer uses it to match your install to an ad you may have seen on another app or website. AppsFlyer then shares the identifier and conversion events, such as install, onboarding completed, first session completed, trial started, and purchase, with the ad network involved. This is "tracking" as Apple defines it and "sharing" for cross-context behavioral advertising as some U.S. state laws define it.
• If you tap "Ask App Not to Track," the App does not read your advertising identifier. Attribution falls back to Apple's SKAdNetwork and AdAttributionKit, which report campaign results in aggregate without identifying you. The App works identically either way.
• You can change your mind at any time in iOS Settings under Privacy & Security > Tracking, or by turning off "Allow Apps to Request to Track."

We do not show third-party ads inside the App, and we do not build advertising profiles of you.

6. Your choices and controls

• Delete your account and data. Settings > Delete Account in the App. See Section 7.
• Add or change an email address. Profile settings in the App.
• Notifications. Turn reminders on or off in the App's settings or in iOS Settings > Notifications. The trial-ending reminder is sent only if notifications are on.
• Camera. iOS Settings > Privacy & Security > Camera. Gaze exercises simply become unavailable if you decline.
• Ad tracking. iOS Settings > Privacy & Security > Tracking (Section 5).
• Analytics and diagnostics. The App does not currently include an in-app switch for analytics or crash reporting. If you object to this processing, email privacy@getvisionary.app and we will act on your objection as described in Section 12, including deleting analytics data linked to your identifiers where our providers support it.
• Website analytics. If you visit from the EEA, the UK, or Switzerland, the Website asks before loading Google Analytics and remembers your answer. You can change it at any time from Section 13. The Website also honors the Global Privacy Control browser signal.
• Access and export. Email us for a copy of the data in your account.

7. Deleting your account

When you use Delete Account, the App asks our server to delete, in order, your scheduled notifications, your entire user record including all training and check data, and your sign-in identity. Only after the server confirms does the App clear your local history, preferences, notification token, and device identifiers. If deletion cannot be completed, your account is left intact so you can try again or contact us.

What deletion does not remove:

• Apple's purchase records. Apple keeps your transaction history under its own policy. Deleting your account does not cancel an active subscription; cancel it in your Apple ID settings.
• RevenueCat's subscription records, which we may need to keep for a limited period to honor refunds, prevent double-granting of offers, and meet accounting obligations.
• A hashed deletion marker. We keep a one-way hash of your former account identifier so our systems never send a notification to a deleted account. It cannot be turned back into your identifier.
• Analytics and crash data already collected, which our providers retain for the limited periods in Section 8. On request we will also ask our analytics provider to delete data linked to your identifiers.
• Support emails you sent us, which we keep as described in Section 8.
• Information we must keep by law or to resolve a dispute.

8. How long we keep information

We may keep information longer where the law requires it or where it is reasonably necessary to resolve disputes or enforce our terms.

9. Security

We protect your information with measures appropriate to its sensitivity, including encryption in transit (TLS) for all connections, encryption at rest by our cloud providers, database rules that allow each account to read and write only its own data, a deletion service that verifies your sign-in before acting, local storage inside the App's protected container, and limiting the details sent to analytics partners to low-detail event names. No system is perfectly secure, so we cannot guarantee absolute security. If you believe your account has been compromised or you have found a security issue, please tell us at privacy@getvisionary.app.

10. International transfers

We are based in the United States, and our service providers store and process data primarily in the United States. If you use the Service from the European Economic Area, the United Kingdom, Switzerland, or another country with data-transfer rules, your information will be transferred to the United States. Our providers rely on approved safeguards for these transfers, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and, where the provider is certified, the EU-U.S. Data Privacy Framework. You can ask us for more information about these safeguards.

11. Children

The Service is for adults and is not directed to anyone under 18. We do not knowingly collect personal information from children under 13 (or under 16 where that is the applicable age). If you believe a child has provided us information, contact us and we will delete it.

12. Your privacy rights

12.1 Rights available to everyone

You can ask us to:

• tell you what personal information we hold about you and give you a copy in a portable format;
• correct information that is inaccurate;
• delete your information (fastest through the in-app Delete Account feature);
• stop or restrict particular uses, such as analytics or attribution; or
• withdraw a consent you gave, which does not affect processing that happened before you withdrew it.

Email privacy@getvisionary.app from the address on your account, or include your account identifier from the App's settings, so we can verify the request belongs to you. We may ask for more information if we cannot match you to an account. We respond within 30 days, or within the shorter period your local law requires, and we will tell you if we need longer. You may use an authorized agent where the law allows; we will ask for proof of authorization. If we decline a request, we will explain why, and you may appeal by replying to our decision.

12.2 European Economic Area, United Kingdom, and Switzerland

The legal bases we rely on are listed in Section 3. Where we rely on legitimate interests, you have the right to object, and we will stop unless we have compelling grounds to continue. Where we rely on consent, including for health-related training data and notifications, you may withdraw it at any time. You also have the right to lodge a complaint with your national data-protection authority; a list is available at edpb.europa.eu. UK users may contact the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to address your concern first.

12.3 United States state privacy laws

Residents of California, Colorado, Connecticut, Delaware, Montana, Oregon, Texas, Utah, Virginia, and other states with comprehensive privacy laws have rights to know, access, correct, delete, and obtain a portable copy of their personal information; to opt out of the sale of personal information, of sharing or processing for targeted advertising, and of certain profiling; and not to be discriminated against for exercising those rights. Sensitive personal information, which may include the health-related training data described in Section 2.2, is used only for the purposes permitted by those laws and described in Section 3, and you may limit its use by contacting us.

Notice at collection (California). In the preceding 12 months we collected the following categories of personal information for the purposes in Section 3 and retained them as described in Section 8: identifiers (account, device, and installation identifiers, email if provided, IP address transiently); commercial information (subscription and purchase records); internet or electronic activity (usage events, crash data, Website analytics); sensitive personal information (health-related training and check data); inferences (training difficulty estimates and plan recommendations); and, with your permission, the advertising identifier.

Sale and sharing. We have not sold personal information in the preceding 12 months and do not sell it. With your permission through the iOS tracking prompt, we have shared identifiers and product-interaction data with advertising networks for cross-context behavioral advertising measurement, as described in Section 5. To opt out, tap "Ask App Not to Track" or change your choice in iOS Settings > Privacy & Security > Tracking; on the Website, enable the Global Privacy Control signal in your browser; or email privacy@getvisionary.app with the subject "Do not sell or share." We do not knowingly sell or share the personal information of anyone under 16.

12.4 Other regions

If you live in Canada, Brazil, Australia, Japan, or another country with privacy laws, you have the rights those laws provide, and you may exercise them by contacting us as described above. Where required, we will identify the local law under which we respond.

13. The Website and cookies

The Website uses Google Analytics 4 to see which pages are read, which buttons lead to the App Store, and how far people scroll. When it runs, it sets the following cookies on getvisionary.app:

Consent in the EEA, the UK, and Switzerland

If your browser's time zone places you in the European Economic Area, the United Kingdom, or Switzerland, the Website shows a banner before any analytics runs. Google Analytics loads, and its cookies are set, only if you choose "Accept." If you choose "Decline," nothing is loaded and no analytics data is collected. Either way your choice is saved in your browser's local storage for 12 months, after which we ask again. Declining does not change anything else about the Website. Time-zone detection is a best-effort signal; if we cannot tell where you are, we ask.

To change your choice, use the button below or open any page of the Website with #cookie-settings added to its address. Clearing your browser's site data for getvisionary.app also resets it.

Change my analytics choice

Outside those regions

Elsewhere, Google Analytics runs by default on the basis described in Section 3. You can still stop it: enable the Global Privacy Control signal in your browser (the Website then never loads Google Analytics), block or delete cookies in your browser settings, or install Google's opt-out browser add-on. The Website works without cookies.

What analytics does and does not see

Analytics records pages viewed, approximate location derived from your IP address by Google, browser and device details, and which calls to action were shown and clicked. The Website's interactive tools, such as the free eye test, calculators, and quizzes, run entirely in your browser. We deliberately strip answers, scores, ages, symptoms, and other health-related inputs from analytics events, so we learn that a tool was used, not what you entered. The Website loads fonts from Google Fonts and a stylesheet library from a content delivery network; those providers receive your IP address and browser details when the files are fetched, whether or not you accept analytics.

Do Not Track. We honor the Global Privacy Control signal as described above. We do not respond to the older "Do Not Track" setting, which has no agreed meaning.

Links. The Website links to the App Store, research publications, and other third-party sites. Their privacy practices are their own.

14. Changes to this policy

We will update this policy when our practices, the App, or the law change. The effective date at the top tells you when the current version took effect. For material changes, such as collecting a new category of data or using data for a new purpose, we will give notice in the App or by email before the change takes effect and, where the law requires it, ask for your consent. Earlier versions are available on request.

15. Contact