Data Flow & SDK Inventory

Every byte that leaves the app.

A complete, exact inventory of the services Veil contacts and what each receives. Last updated: July 24, 2026

TL;DR
  • No health data, no advertising identifiers, and no cross-app or cross-site activity are ever collected or transmitted.
  • Veil bundles exactly three network-capable SDKs. Two of them (analytics, subscriptions) only ever run after you opt in or subscribe.
  • Decline analytics at setup, skip Veil Plus, and turn off announcements, and nothing leaves your device at all.

This page is the technical companion to our privacy policy. It exists so anyone - a security researcher, a privacy reviewer, or you - can see the exact shape of every network request Veil can make. If anything here does not match what you observe on the wire, that is a bug and we want to hear about it: feedback@veiltrack.app.

The foundation: your health data never leaves the device

Period dates, flow, symptoms, mood, notes, measurements, contraception events, predictions - everything you track - is computed and stored only on your phone, encrypted at rest. None of it is transmitted to Veil or to any third party. The services below never receive any of it. That is an architectural fact, not a policy promise: there is no Veil server that health data could be sent to.

1. Network-capable SDK inventory

Veil bundles three SDKs that can make network requests. There are no advertising SDKs, no third-party trackers, no crash-reporting or session-replay tools, and no social SDKs.

Aptabase

European Union

Anonymous product analytics (counters only)

When it runs:
Only after you allow analytics during setup. Off by default; the SDK does not initialize until you opt in.
What it receives:
The counter events listed below, plus standard technical metadata attached by the SDK (app version, OS and OS version, device model, locale, SDK version, and a rotating session identifier). No account, no advertising ID, no persistent device ID, no health data, no event values.
Privacy policy:
https://aptabase.com/legal/privacy

RevenueCat

United States

Subscription validation (Veil Plus only)

When it runs:
Only if you open the paywall or purchase / restore Veil Plus. The free tier never contacts RevenueCat.
What it receives:
An anonymous, client-generated identifier ($RCAnonymousID:...), the store purchase receipt, your storefront country, and standard SDK technical metadata (app version, OS, device model, library version). Your IP address is visible to their servers at request time (transport level). Never your Apple ID, Google account, name, email, or any health data.
Privacy policy:
https://www.revenuecat.com/privacy

Apple / Google billing

Per Apple / Google

Payment processing (Veil Plus only)

When it runs:
Only if you purchase Veil Plus.
What it receives:
As merchant of record, Apple or Google see the buyer identity - this is unavoidable for in-app purchases and is handled entirely by the platform, not by Veil. Veil never receives that identity.
Privacy policy:
https://www.apple.com/legal/privacy/

2. Every outbound endpoint

Endpoint Purpose Frequency Opt out?
eu.aptabase.com Anonymous analytics events Only when analytics is allowed Yes - decline at setup or Settings -> Analytics
api.revenuecat.com Subscription validation Only on paywall / purchase / restore N/A - only if you use Veil Plus
veiltrack.app/announcements.json In-app release notes (a static file; anonymous GET, no identifiers) Once per day Yes - Settings -> Announcements
huggingface.co One-time download of the on-device AI model Only if you enable the AI Assistant and download a model N/A - only if you use the AI Assistant
Apple App Store / Google Play Opening subscription management or code redemption Only when you tap those links N/A

3. Consent: nothing before your choice

Analytics is off until you decide. On a fresh install the analytics setting is disabled, so the analytics SDK never even initializes. During the one-time setup flow you reach a dedicated screen that explains anonymous analytics and lets you turn it on or off; your choice is saved only when you continue past that screen. No analytics event is sent before that point. You can change it any time in Settings → Analytics; when off, no data is sent at all.

4. Complete analytics event catalog

When analytics is enabled, these are the only events Veil can send, and the "Properties" column is the complete set of values each may carry. Every event is a counter. We never send the content of anything you log, any dates, any predictions, any notes, any identifier of you, or your chat messages. In particular, symptom_logged records only the category (for example "mood"), never the specific value.

Event Properties (the complete set) Fires when
app_opened theme (light/dark/system), language (locale code) App launched
onboarding_step_completed step (number) Advanced a setup step (post-consent steps only)
onboarding_completed (none) Finished setup
period_logged (none) Logged a period day
symptom_logged category (e.g. mood, digestion) - never the value Logged a symptom category
insights_viewed (none) Opened Insights
education_opened (none) Opened a Learn article
calendar_viewed (none) Opened the Calendar
discreet_mode_toggled enabled (true/false) Toggled Discreet Mode
backup_created destination (storage target) Created a backup
assistant_tab_opened (none) Opened the AI Assistant tab
assistant_disclosure_acknowledged (none) Acknowledged the AI disclosure
assistant_model_download_started modelId (which model) Started an AI model download
assistant_model_download_completed modelId Finished a model download
assistant_model_download_failed modelId, reason (error class) A model download failed
assistant_model_deleted modelId Deleted a downloaded model
assistant_topic_refusal_triggered (none) Assistant declined an off-topic request
assistant_chat_persistence_toggled enabled (true/false) Toggled saving chat history
scheduler_screen_viewed (none) Opened the Scheduler
announcement_seen (none) Saw an in-app announcement
announcement_cta_tapped (none) Tapped an announcement button
announcements_toggled enabled (true/false) Toggled in-app announcements

5. Turn everything off

Every outbound connection is optional or tied to a feature you choose to use. To reduce Veil to zero network egress:

With those settings, Veil makes no network requests. The core tracker works fully offline, forever.

The SDK-attached technical metadata described in section 1 (app version, OS, device model, locale, session identifier) reflects the documented default behavior of the Aptabase and RevenueCat SDKs. We validate this page against a real network capture before each release; if you find any discrepancy, please report it to feedback@veiltrack.app.