Privacy at Vireat

Last updated: 25 October 2026

Vireat helps flower shops manage their everyday work. This notice explains the information used by the iPhone and iPad app, optional Vireat accounts, and support.

Vireat is operated by Vladimir Smirnov. For privacy questions or requests, email smivv.ios@gmail.com.

You can use Offline or Demo without a Vireat account. Creating an account does not upload your local shop, start online shop synchronization, or change your device’s iCloud account.

Visiting vireat.com

The product website uses AWS CloudFront and security services to deliver and protect its pages; Cloudflare provides domain registration and DNS. Requests include connection information such as your IP address, requested page and browser headers. Website access logging and firewall request logging are disabled in the current configuration, but hosting and network providers still process technical information.

The product pages remember a language you choose in your browser’s local storage until you clear this website’s stored data. They can use your browser’s preferred language; they do not look up your country. This website sets no cookies, contains no advertising or analytics, and does not submit forms or call the account API. The privacy and support pages do not run browser scripts.

Your Vireat account

Available sign-in methods are shown in the app. Email sign-in uses Amazon Cognito to handle your email address, password, verification and password recovery. When Google or Sign in with Apple is offered and you choose it, that provider authenticates you and shares the account identifier and email information allowed by your choice. Apple may provide a private relay email address. Vireat does not receive your Google or Apple password.

We use your email address and stable account identity to provide and protect account access, process account deletion, and investigate service failures. Cognito stores authentication information; our account database stores identifiers and profile creation time without making a second copy of your email address. Matching email addresses do not automatically link accounts.

The app keeps issued account credentials and your profile in device-only Keychain storage. They do not synchronize through iCloud Keychain. The app does not save your account password. Cognito’s sign-in pages use cookies for security, page state, language and a sign-in session lasting up to one hour. Google or Apple may use their own browser sessions when selected.

Local shop information and iCloud

Your local Business File can contain shop and staff details, client and supplier contacts, orders, inventory, bouquet records, prices, payments and receipts, photos, and operational history. Staff PINs are stored as salted verification values, not readable PIN text. Ordinary Offline work stays on your device and is not sent to the Vireat account service.

Automatic backup uses your iCloud Drive for encrypted shop snapshots and iCloud Passwords & Keychain for recovery information. Apple also handles iCloud records used for device editing authority. The app checks uploaded archives before marking a backup verified. Availability depends on your Apple Account, settings, storage and connection; local key storage alone does not prove synchronization. This release does not support recovery on a new or replacement phone.

Local app data may also be included in Apple device backup or migration. Demo begins with fictional records and keeps your changes locally until you use Exit demo. Shared or exported copies remain with the recipient or storage service you choose.

If an existing installation uses a separately configured server workspace, its shop requests and selected attachments go to that server. Its operator controls that service’s storage and retention. It is separate from the Vireat account service described here; account registration does not transfer your Business File there.

Photos, permissions and tracking

This release does not upload your shop photos to the developer’s private flower-image collection or for AI training. Private collection uploads are not available to app users. Reference artwork included in the app is separate from your shop photos.

Camera access is used when you choose a supported camera feature. Images used only to scan codes are not saved. A system contact picker shares the person you select without giving the app ongoing access to Contacts. Device-owner checks may use Face ID, Touch ID or the device passcode; Vireat does not receive biometric templates. You control permissions in device Settings.

This version contains no advertising, third-party analytics or cross-app tracking SDK. These public information pages contain no analytics scripts, forms or advertising cookies. The hosting service processes connection and request information to deliver them.

Diagnostics and support

Vireat keeps local technical logs containing events, timestamps, random session identifiers, app and OS versions, selected error codes, timings and counts. Reports exclude Business File contents, customer details, PINs, recovery keys, authentication tokens and photos.

Nothing is sent to the developer automatically in this release. In Help & support, you can prepare a diagnostic file, choose a recipient and send it using the system sharing interface. That file is readable by you and the recipient. This release does not create new iCloud diagnostic copies; copies from earlier versions may remain in your iCloud storage.

If you contact us, we use your message, reply address and any report you choose to attach to understand and resolve your request. Do not include passwords, PINs or unnecessary customer information. Correspondence may remain in the support mailbox and the email services’ retained copies; this notice does not promise a fixed automatic deletion period for email. You can ask us to remove a message or attachment. Copies held by your chosen sharing service or other recipients follow their own controls.

Retention and account deletion

Open Vireat account in the app and choose Delete account. You must confirm the same account again. Signing out alone does not delete it. An accepted request blocks ordinary account operations. Cleanup has a minimum 30-minute wait so temporary upload permissions can expire; this is not a promise of completion within 30 minutes. The app keeps a private request receipt to recover the status after interruption and reports completion only when the service confirms it. A failed request can remain pending and may require signing in again or contacting support.

Completion removes the Vireat account profile, its original Cognito account, and any account-owned collection objects and metadata. It does not delete your Google or Apple account. If you used Sign in with Apple, the app also provides Apple’s instructions for removing Vireat’s authorization; Vireat account deletion does not itself revoke that Apple authorization.

Local diagnostic logs: At most 1 MiB per workspace. Files older than seven days are removed when logs are written or a report is prepared; no deletion timer runs while the app is closed.
Account service logs and recovery: Configured access and application log groups retain records for seven days. Access logs contain request identifiers, response status and response size. Failure queues retain work for up to 14 days, database change streams for 24 hours, and database point-in-time recovery for up to 35 days. Recovery copies can outlast deletion from active storage.
Deletion and Apple lifecycle records: Minimal hashed identifiers, request or event identifiers, receipt hashes, status and timestamps are retained to recover outcomes and stop delayed operations from recreating deleted data. Apple lifecycle records can also preserve consent or email-availability status. These technical records currently have no automatic expiry. Raw Apple notification tokens and emails are not stored in those lifecycle records.

Account details otherwise remain while your account exists. Apple sign-in notifications, when that method is available, can invalidate revoked access and trigger cleanup of app data. These notifications do not automatically delete your Cognito directory profile; use the in-app account deletion control or contact us for account removal.

Deleting a Vireat account does not erase your local shop, iCloud backups, separately operated server records or previously shared reports. Delete shop from this device removes the local shop and stops its automatic backup. Factory Reset removes operational records but retains shop, staff and device-authority records. Neither action removes existing iCloud archives, synchronized recovery information or ordinary Apple device backups; use the relevant Apple controls for those copies.

Service providers and your choices

The account service uses Amazon Web Services in EU (Frankfurt), Germany, for authentication, records and service operations. Apple provides iCloud and device services. Google or Apple handles its own sign-in when you choose an available provider. Email and sharing services handle messages you send. A configured AWS region does not mean that every provider operation or support access occurs only in Germany.

You can use Offline without registration, manage device permissions and iCloud storage, sign out, request account deletion and choose whether to share diagnostics. Contact us to request access, correction or deletion of information we hold. Where applicable law provides them, you may also have rights to restrict or object to processing, receive portable information, withdraw consent and complain to a supervisory authority. We may need proportionate information to verify a request.

We will update this notice when the service’s handling of information changes. Provider information is available in the privacy notices of AWS, Apple and Google.