Privacy policy

What VialMath is

VialMath is a calculator and tracker that runs in your browser or as an installed web app (PWA). It performs arithmetic and schedule logic on the numbers you enter. It does not collect, transmit, or store your protocol data on any server we operate, except as described below for the one-time license check.

The network calls VialMath makes

1. The license check, once, at activation. That check transmits your license key — not your protocol data, not your compounds, doses, schedules, vial history, gate checks, or metric log. With it go our product's public ID and an instruction not to count the check as a use. Your browser sends it directly to Gumroad's license server (api.gumroad.com); it does not pass through any system VialMath operates, so we never receive the request or its network details, such as your IP address. Gumroad necessarily receives those, as any server does; what Gumroad logs or keeps is governed by Gumroad's privacy policy, not by us.

2. The update check, when the app opens or returns to the foreground. VialMath fetches its own version.json from the same address it was loaded from, and compares the build number with its own. If a newer build exists it shows you a banner. The request carries no license key, no identifier, no cookie and no protocol data — it is the app asking what version it should be. It exists because VialMath installs as a PWA, and a stale cached copy is otherwise invisible: you would go on using an old build believing it was current, which for a calculator is the worst failure available.

Disclosed 2 September 2026, on this page's own terms. The section below committed us to disclosing "any future release [that] adds a recurring call of any kind (a re-validation check, an update check…)". The update check had shipped and this page had not caught up. An independent audit of our own claims found it, and this is the correction. We have not removed the check — it protects you from running stale arithmetic — but the earlier wording, "the only network call", was wrong, and any page of ours that still says "only" is wrong until fixed.

What we do not do

• No accounts. There is no sign-up, login, or user profile anywhere in VialMath.
• No sync. Your data is not copied to, or backed up on, any server we operate.
• No analytics or tracking in the app. VialMath does not run analytics scripts, session recording, or third-party trackers of any kind inside the app itself, and it puts nothing you entered into any request except your license key at activation. That is a deliberate line. The app does have a few buttons that open our website; how those visits are counted is described in the next two items.
• A page counter on our public web pages, and nothing more. Our marketing pages (the home page, the free calculator, the comparison page and similar) keep daily totals: how many times each page was viewed, and how visitors arrived — the site that linked to us (if it is on a short list we chose; any other site is counted only as "other"), a campaign tag in the link, or the fixed tag of a link tapped in the app, described in the next item. They also count four named actions the same way — that a calculator was used, that a purchase link was clicked, that the app was opened, that a tool was used. Each total is a single number per day, kept separately and never joined to another, and the daily totals are kept with no set expiry. That is the whole record: no cookies, no IP address, no user agent, no device or browser fingerprint, no identifier of any kind, and no third-party analytics service. We cannot tell one visitor from another, cannot follow anyone between pages, and cannot connect a page view or an action to a person, a purchase or an email address — which is why the counts above tell us how many, and can never tell us who. We use this only to learn which pages people reach and what brought them there.
• Links from the app to our website. A few buttons in the app open a page of our website in a new browser tab when you tap them: the "See what's in Power" buttons, the Buy links, and "Set up reminders" in Data. Each of those links carries a short fixed tag naming the part of the app it sits in — for example app-cycle-windows, app-settings or app-data. When the page opens, our page counter adds one to that tag's daily total, exactly as it does for any other way of arriving. The tag is written into the app's code: it never contains anything you entered, and nothing about your protocol, your device or you is added to it. Nothing is sent unless you tap.
• One counter that stays on your phone. When you reach a feature that is part of Power, VialMath keeps a tally on your own device of how many times that has happened and what you did about it. It records the name of OUR feature — nothing you typed, nothing about your protocol — and the tally itself is never transmitted anywhere; if you tap through to our website from one of those features, only that link's fixed tag goes with you, as described above. It exists so the app can be honest with itself about which limits people actually reach; you can read the whole of it under Data inside the app, and clearing the app's data erases it.
• No selling, sharing, or aggregating your protocol data. Your protocol data never reaches our servers in the first place, so there is nothing there to sell or share. What we can hold — an email address, only if you type it into one of the optional signup forms on our website, and the purchase and support records described below — is never sold, shared, or passed to anyone selling anything. See "The optional mailing list" below.

The optional mailing list

The only places on this site where we can receive something about you are the optional signup forms on the free calculator, on the two free tools and on the email-reminders page. None of them is part of the app, none is ever required for anything, and no feature is gated behind them.

If you use one, we store your email address, which page you signed up from (on the reminders page, which reminders you chose), and the date. Nothing else is kept with your address — no IP address, no device information, no cookies, no profile. It is kept on Cloudflare Workers KV. To stop one connection flooding the list, each new signup also adds one to a short-lived counter labelled with a code derived from your connection's IP address; that counter is stored separately from your address and expires after one hour.

We do not sell, rent, share, or broker this list, to anyone, for any price — and specifically never to anyone selling anything. This is not a preference we may revise for a good offer; addresses collected under this promise stay under it permanently, and a future change to this page would not release them.

We use it only for what you signed up for: news of a new free tool or an app update, and — if you asked for it on the reminders page — a monthly reminder to back up. Every message has a one-click unsubscribe and we honour it immediately. Ask us to delete your address at any time — write to [email protected] and it is removed.

Your protocol data has nothing to do with this. It stays on your device, is never linked to your email address, and is never transmitted to us — signing up changes none of that.

When you buy Power, or write to us

Power is sold through Gumroad, which runs the checkout. As it does for every seller, Gumroad shares the record of your purchase with us — including the email address you gave it and the license key it issued. We use that record only to deliver and support your purchase, to handle refunds, and to meet our own legal and compliance obligations, and we never sell it or share it with anyone. If you email us — from the app's Feedback screen or directly — we receive your email address and whatever you write, and we use it only to answer you and to fix what you report. None of this is linked to the data in your app, and we never see that data unless you choose to send it to us.

Where your data actually lives

Everything you enter — compounds, phases, cycles, vial events, dose logs, gate checks and decisions, blends, metric entries — is stored locally on your device, using your browser's own local storage. It stays there until you delete it, clear your browser's site data, or export it yourself.

You can export a full backup (JSON) or a calendar file (.ics) at any time from the app's Data view, and with Power a spreadsheet-ready CSV of your dose log. Your data is never locked in.

What we deliberately do not claim

We do not claim VialMath is "fully offline," makes "no network calls," or involves "zero telemetry" — the license check and the update check are real network calls, and this page discloses both plainly rather than rounding them away. If that changes — if any future release adds another recurring call of any kind (a re-validation check, crash reporting, anything that carries an identifier) — this policy will be updated in the same release, not after.

The site itself

The marketing site (this page, the calculator, the comparison page) and the app are served by our hosting provider, Cloudflare, which — like the host of any website — necessarily receives each request's IP address and standard headers in order to deliver it; what Cloudflare records is governed by Cloudflare's own policies. We also run our own page counter on these pages, described under “What we do not do” above: it keeps the daily totals described there, and nothing else. Most of our pages load their typefaces from Google Fonts, so your browser also requests those files from Google when such a page opens; the app does not — it carries its own. The demo video on the home page is served with the rest of this site by our hosting provider. Opening or playing it does not contact YouTube or another video platform. We do not use advertising pixels, third-party trackers, or any third-party analytics service anywhere on this site.

Purchase and referral links go through Gumroad, which runs the checkout: a referral link sets Gumroad’s own cookie, on gumroad.com, for up to 30 days so Gumroad can credit the person who sent you; that cookie is Gumroad’s, is governed by Gumroad’s privacy policy, and never touches this site or the app.

Children's privacy

VialMath is not directed at, and is not intended for use by, children.

Changes to this policy

24 September 2026 · later — Updated “The site itself” for the new demo video on the home page. It no longer loads from YouTube: it is now a file on this site, served by our hosting provider with the rest of our pages, so opening or playing it does not contact YouTube or another video platform. Nothing we collect changed, and nothing about your protocol data changed: it still never leaves your device. The prior version is kept at /privacy/versions/privacy-superseded-2026-09-24-youtube-demo.html.

24 September 2026 — Corrected and completed this policy. It said the app is left out of our page counter and that nothing inside VialMath is counted. Since 1 September, the buttons in the app that open our website have carried a fixed tag naming the button, and our counter keeps a daily total of each tag; this page now says so and explains it. We also corrected where our signup forms are and what they store; described the one-hour counter that limits repeated signups, the fonts and demo video our pages load from Google, and the purchase and support records we hold; said exactly what the license check carries and that it never reaches us; and noted that the dose-log CSV export is part of Power. Nothing about your protocol data changed: it still never leaves your device. The prior version is kept at /privacy/versions/privacy-2026-09-24.html.

13 September 2026 — Added one sentence under “The site itself” disclosing that purchase and referral links go through Gumroad and that a referral link sets Gumroad’s own 30-day cookie on gumroad.com. Nothing we collect changed; the sentence describes a cookie set by Gumroad, on Gumroad, that never reaches this site or the app. The prior version is kept at /privacy/versions/privacy-2026-09-13.html.

1 September 2026 — Corrected an inconsistency in this policy. The section “The site itself” said we add no analytics to the site, while the section above it described the first-party page counter we have run on our marketing pages since 29 August 2026. The counter and its limits were disclosed here before it recorded anything; the conflicting sentence has been corrected to match. No data practice changed, and nothing we collect has ever included a cookie, IP address, user agent, fingerprint, or identifier of any kind.

If this policy changes, we will update the date at the top of this page. We will not narrow a privacy commitment retroactively without saying so plainly here.

Contact

Questions about this policy: [email protected].