Your notes stay on your devices. Varlig has no accounts and no servers of its own, and it never receives what you write. This policy explains exactly what personal data is involved when you use the Varlig apps for Mac, iPhone and iPad and visit varlig.com, who handles it, and what your rights are.
At a glance
- Your notes, attachments, tags and settings are stored on your devices and, if you turn on iCloud sync, in your own iCloud account. We never receive them.
- The app has no account, no advertising and no analytics. Crash and hang reports stay on your device unless you choose to send one.
- The app only goes online for the features listed below, such as exchange rates. Those requests never include your notes.
- The website sets no cookies and uses privacy-friendly analytics that don’t identify you.
- If you email us, we use your message only to reply.
Who is responsible
The controller responsible for processing personal data under the EU General Data Protection Regulation (GDPR) is:
Lea-Salome Adler
Obolonskyi Ave. 26, Apt. 128
04205 Kyiv
Ukraine
Email: [email protected]
The Varlig app
Your notes
On a Mac, your library is stored in ~/Library/Application Support/Varlig/, together with its attachments. On iPhone and iPad, it’s stored inside the app on the device, and included in the device’s own backups. We can’t see, access or recover it.
- Locked notes are encrypted on your Mac with AES-GCM, using a key derived from your password (PBKDF2-HMAC-SHA256). We never receive your password and can’t recover it.
- Touch ID and Face ID: if you allow unlocking a note with Touch ID, Face ID or your Mac password, a key derived from your password is kept in the keychain of that device only. It’s never synced.
- Backups you make with File › Back Up Library… are saved wherever you choose. Notes that aren’t locked are readable in a backup, so keep backups somewhere private.
- Spotlight: if you turn on Include unencrypted notes in Spotlight, macOS indexes the text of your unlocked notes on your Mac so you can search it from Spotlight. It’s off to begin with.
- Widgets and sharing: a widget you add shows the titles and open tasks of pinned, unlocked notes, or an answer from a note you choose. Content you share to Varlig from other apps is saved on your device until Varlig imports it.
- Reminders: reminders are stored in your library on the device where you set them. If you choose Also add to Apple Reminders, Varlig adds the reminder’s title, time and a link back to the note to Apple’s Reminders app on that device, never the note’s text. From then on, Apple’s Reminders app handles it, including any syncing it does, under Apple’s privacy policy.
When the app goes online
Most of Varlig works entirely offline. The features below connect to the internet. None of them send your notes, and none include an account, device or advertising identifier. Like any internet connection, each request reveals your IP address to the service it goes to, which handles it under its own privacy policy. We don’t receive these requests.
| Feature | When | Goes to | What it sends |
|---|---|---|---|
| Exchange rates | When a calculation first needs currency or crypto rates, then at most hourly while Varlig is open | European Central Bank (ecb.europa.eu), Coinbase (api.coinbase.com) | A standard request for the published rates |
| Rate history and inflation data | Soon after Varlig opens, then daily while it’s open | European Central Bank (ecb.europa.eu), U.S. Bureau of Labor Statistics (bls.gov) | A standard request for the published figures |
| Titles of pasted web links | When you paste a link | The website the link points to | The link’s address |
| Link cards | When you choose Show Preview for a link | The website the link points to, through Apple’s LinkPresentation framework | The link’s address |
| File › Clip Web Page… | When you use the command | The website you enter | The page’s address |
| Places | When a calculation names a place | Apple’s geocoding service | The place name |
| Weather | When a calculation asks for the weather in a place | Apple WeatherKit | The place’s coordinates and the day |
You can turn off automatic rate updates with Refresh currency and crypto rates hourly in Settings › Calculations, link titles with Auto-fill titles when pasting web links in Settings › General, and each lookup of places and weather in Settings › Calculations › Live data.
iCloud sync and shared notes
- iCloud sync: if you turn on Sync notes with iCloud on your Mac, and whenever you use Varlig on iPhone or iPad while signed in to iCloud, your notes and attachments are stored in the private iCloud database of your own Apple Account and synced to your other devices. Apple provides this service under its own privacy policy. We have no access to your iCloud data. Password-protected notes are uploaded only in encrypted form.
- Shared notes: if you share a note with other people, Apple’s iCloud sends it to the people you invite, identified by the email address or phone number you enter, and their changes back to you. The people you invite can read the note, and change it if you allow that, and they may keep a copy. Password-protected notes can’t be shared.
Connections you turn on
- AI assistants (MCP): if you turn on Allow local MCP connections in Settings › Advanced and connect an AI assistant, that assistant can read the notes you allow, and it may send them to its own service under its own terms. It’s off to begin with.
- Automation: if you use Varlig’s URL automation with another app, results are passed to the address that app provides.
Crash and hang reports
When Varlig crashes, stops responding or uses unusual amounts of power or storage, your Mac, iPhone or iPad gives the app a report through Apple’s MetricKit. Varlig keeps the most recent ones on the device, cut down to the Varlig and system versions, the device model, what happened, and where in Varlig’s own code it happened. They contain no note text, titles or file names, and the app never sends them by itself.
If you choose Send Report… (Settings › Advanced on the Mac, Settings › About Varlig on iPhone and iPad), you see everything the report contains before you email it to us or share it another way. We use a report you send only to find and fix the problem, and handle it like any other email (see Email). You can delete the kept reports there at any time.
Separately, if you’ve allowed your device to share analytics with app developers in its privacy settings, Apple may pass crash reports to us under Apple’s own privacy policy.
No tracking in the app
The app contains no analytics, advertising or third-party crash-reporting software, and it doesn’t check for updates over the internet. It learns whether you have a plan only from Apple’s App Store, as described below.
Buying and downloading Varlig
- App Store: Apple handles downloads, purchases, subscriptions and payment under its own privacy policy. To show the plans and their prices, and to know whether you have one, the app asks the App Store on your device through Apple’s StoreKit; this never includes your notes. We don’t receive your name, Apple Account or payment details. Apple gives us only sales reports that don’t identify you.
The website
Hosting
varlig.com is hosted and delivered by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). To deliver pages and protect the site against attacks, Cloudflare processes technical data for each request, such as your IP address, the page requested, your browser’s user agent and the time. Cloudflare may process this data in the United States; it is certified under the EU-U.S. Data Privacy Framework. The legal basis is our legitimate interest in a secure, reliable website (Art. 6(1)(f) GDPR).
Analytics
To understand which pages are useful, the website uses Plausible Analytics, loaded from plausible.crashatlas.com. Plausible doesn’t use cookies, doesn’t store your IP address and doesn’t follow you across websites. It counts page views using the page address, the referring website, your browser, operating system and device type, and the country derived from your IP address. Visits are counted with an identifier that is recalculated daily and can’t be traced back to you. The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR).
Cookies
The website sets no cookies. When you choose a website language, we save that preference in your browser’s local storage so it is remembered on your next visit. Automatic language selection uses the language and region in your browser’s locale settings, without an IP lookup or a location request. Fonts are served from varlig.com itself, and the site embeds no third-party content. Links to the App Store take you to Apple’s service, whose own privacy policy applies there.
When you email [email protected], we use your email address and message to answer you, and keep them only as long as needed for your request and any legal retention obligations. The legal basis is our legitimate interest in answering your inquiry, or taking steps toward a contract at your request (Art. 6(1)(f) and (b) GDPR).
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you
- have it corrected or deleted
- restrict or object to its processing, including processing based on legitimate interests
- receive it in a portable format
To use these rights, email [email protected]. Because the app keeps your data on your devices and in your own iCloud account, most of what we could hold about you is limited to emails you send us. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.
Children
Varlig isn’t directed at children under 16, and we don’t knowingly collect their personal data.
Changes
We update this policy when Varlig or the website changes how data is handled. The date at the top shows when it last changed.