Privacy Policy
Last updated: 2 November 2026
In short. Without an account, your medicines go nowhere: they stay on your phone. An account is optional and only needed for sync and backup; then the data is stored on a server in the EU. There are no ads, analytics or trackers, and we do not sell data.
1. Who we are
The Moi Liki app is developed by Artem Shelepun (individual), who is the controller of your personal data. Questions about your data: privacy@moiliki.app.
2. Data on your phone
The app works without an account. In that case everything you enter is stored only on your phone and is not sent anywhere:
- medicines: name, strength, expiry date, batch, registration number, manufacturer, notes, stock;
- cabinets, dosing schedules and dose history;
- photos of packages.
The package scanner reads text from the photo on the phone itself (using iOS). The photo is never sent to our server, even with an account.
Face ID / Touch ID is checked by iOS; we receive no biometric data.
To suggest names, check batches and show leaflets, the app downloads public reference data from our server: the medicine catalogue, the list of banned batches and patient leaflets. These requests do not carry the contents of your cabinet, and matching your batches against banned ones happens on the phone. But if you are signed in, the requests carry your session token, so the server can see which account asked, for example, for a leaflet or what was searched in the catalogue. We keep no history of such requests beyond the technical logs.
3. Account and sync
An account is only needed if you want to sync data between devices or keep a backup. You sign in with Apple, Google or a one-time code sent by email. There are no passwords.
When you sign in, we store:
- your email address;
- for Apple or Google sign-in, your account identifier at that provider and the email it shares (Apple may share a private relay address
@privaterelay.appleid.com); - for Apple sign-in, an Apple token used to revoke access when you delete your account;
- for email sign-in, a hash of the one-time code (never the code itself), valid for 10 minutes;
- session tokens that keep you signed in on this device.
Synced to the server: medicines (without photos), cabinets, dosing schedules and dose history.
The server also keeps technical logs (IP address, time and path of the request, and for the sign-in email, the email address) to protect against abuse and investigate errors. These logs are kept for a short time and are not linked to the contents of your cabinet.
4. Health data
The medicines you keep or take and your dosing schedule may reveal information about your health. Ukrainian data protection law (Article 7 of the Law on Personal Data Protection) and the GDPR (Article 9) treat such data as a special category. We handle it accordingly: we process it only to make the app work for you, never share it for advertising or analytics, and use it for no other purpose.
5. Purposes and legal basis
- The app on your phone: this data never reaches us.
- Sync and backup: to provide the service you turned on by signing in (performance of a contract, GDPR Art. 6(1)(b)). Sync starts only after you sign in.
- Sign-in code email: so that you can sign in (performance of a contract, GDPR Art. 6(1)(b)).
- Technical logs: protecting the service from abuse (legitimate interest, GDPR Art. 6(1)(f)).
6. Who else processes data
We use these providers (processors) to run the service:
| Provider | Purpose | Data |
|---|---|---|
| Railway | server and database (EU, the Netherlands) | everything synced with an account |
| Resend | sending the sign-in code email | email address and the email itself |
| Apple, Google | sign-in with your Apple or Google account | identifier and email shared by the provider |
| GitHub (Microsoft) | database backups | account data and synced data |
The app contains no analytics, advertising, trackers or crash-reporting tools. We do not sell your data.
We currently do not share your data with third parties other than the processors listed above. If this changes, we will tell you in advance and ask for consent where it is required.
We may disclose data where the law requires it, for example under a court order.
7. Where data is stored
The main database is on a server in the EU (Amsterdam, the Netherlands). Resend, GitHub, Apple and Google are US companies, so some data may be processed outside the EU; such transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses, depending on the provider.
8. Phone permissions
- Notifications: dose and expiry reminders. They are scheduled on the phone itself; we do not send push notifications from our server.
- Camera and photos: to take or pick a photo of a package.
- Face ID / Touch ID: if you turn on the app lock.
Each permission can be turned off in iOS Settings; the app keeps working without the related feature.
9. How long we keep data
- On your phone: until you delete it, sign out or delete the app. Signing out erases the data from the phone; synced data comes back when you sign in again, package photos do not, because they are stored only on the phone.
- On the server: as long as your account exists.
- Sign-in codes: valid for 10 minutes; used and expired codes are removed from the database from time to time.
- Backups: 30 days; after you delete your account, your data disappears from them within 30 days.
10. Deletion
You can delete your account in the app: Profile → Delete account (Профіль → Видалити акаунт). The server immediately deletes your email, linked Apple and Google sign-ins, and all synced medicines, cabinets, schedules and dose history; we also ask Apple to revoke the app’s access to your Apple ID. The data on that phone is erased too. To delete your account without the app, see Delete your account.
Without an account, all data is on the phone only, and deleting the app removes it.
11. Your rights
You have the right to know what data about you we process, get a copy, correct it, delete it, restrict its processing or object to it. Write to privacy@moiliki.app from your account’s email address; we reply within 30 days.
If you believe we are breaching your rights, you can complain to the Ukrainian Parliament Commissioner for Human Rights or to the data protection authority in your EU country.
12. Children
The app is not intended for children, and we do not knowingly collect data from children under 16. If you believe a child has created an account, write to us and we will delete it.
13. Security
- All connections to the server are encrypted (HTTPS).
- Sign-in codes are stored only as a hash.
- Session tokens are kept in the phone’s secure storage (Keychain).
- Only the developer has access to the database and backups; Railway and GitHub store them.
14. This website
moiliki.app sets no cookies, has no analytics and loads nothing from other servers; even the fonts are hosted here. The site is hosted on GitHub Pages; GitHub may process visitors’ IP addresses for security and to run the service. The link to the Telegram channel leads to Telegram, where Telegram’s own terms apply.
15. Changes to this policy
If we change this policy, we will update the date at the top of this page. We will tell you in advance about significant changes, such as a new provider that would receive your data.
16. Contact
Artem Shelepun, developer of the Moi Liki app
Data questions: privacy@moiliki.app
Support: support@moiliki.app