Privacy Policy
Avela Meet and Create
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Avela Meet and Create stores your current meeting, stage edits, material checks, timer state, language and display preferences on your device. Notes and selected work photos are stored in the app’s local storage. Templates and completed meetings, including program titles, instructions, participant counts, material lists, dates and notes, are sent to our backend for this installation. Photos are never uploaded. The app creates a random installation secret in the device Keychain and sends it over HTTPS; the server stores a SHA-256 hash to authorize access. There is no account, registration, advertising identifier, location collection or analytics SDK. Cloudflare proxies public HTTPS requests to the Railway-hosted service. Cloudflare and Railway infrastructure necessarily receive connection information such as IP addresses, request paths, timestamps and technical request metadata when you use the API or this website.
How we use information
Local storage makes meeting preparation and facilitation work offline and restores your draft and timer after reopening. Server storage synchronizes templates and completed meeting records for the same installation and processes deletion requests. The installation secret protects access to those records; it does not provide cross-device sign-in or recovery. Selected photos document your creative work locally. Technical infrastructure information supports request delivery, security and service operation.
Service providers and sharing
The backend and public website are hosted on Railway. Cloudflare terminates public HTTPS for our API and website domains and proxies requests to the same Railway service. Cloudflare therefore processes request and connection metadata and handles the content of requests and responses in transit. Railway processes the stored records and infrastructure request information as our hosting provider. We do not add advertising, analytics, marketing, email delivery or social sign-in providers. Photos remain on your device. Apple provides the system photo picker and device storage services; only photos you explicitly select are shared with the app. We do not sell your meeting content. Infrastructure providers may retain operational logs according to their own service practices; we have not established a separate fixed log retention period.
Data retention
Drafts, notes, material checks and imported photos remain locally until you remove the relevant data or the app’s storage is removed. Server templates and completed meeting records have no automatic expiration and remain until deleted through the app or the service is discontinued. Offline deletion requests remain in a local queue until successfully delivered. The application server does not create its own backup copies. Device backups and any hosting-managed snapshots or Cloudflare and Railway infrastructure logs are governed by the relevant platform’s settings and retention practices; deleting an active record does not promise immediate removal from pre-existing platform backups or logs.
Deleting your information
You can delete an archived meeting or template from Archive after confirmation. Delete all my data in Settings removes local drafts, archive records, templates and imported photos and queues a request to delete all server records authorized by this installation secret. Keep the app installed and connect to the internet until synchronization completes so queued deletions reach the server. Deleting only the app does not send a server deletion request. The Keychain secret can persist separately from app documents; there is no account-based recovery if it is lost. Contact tavishiverley@icloud.com for privacy questions, including deletion questions, without sending the installation secret. We cannot reliably identify an installation from an email address alone.
Permissions and your choices
The app uses Apple’s system Photos picker only when you choose Add photos of the work. It does not request broad photo-library access, camera access, location, contacts or notification permission. You may cancel the picker or choose no photos and still use all meeting features. Remove an imported photo or delete its meeting to remove the app’s local copy; changing photo permissions does not by itself delete an already imported copy. Language, text size and timer sound can be changed in Settings.
Your privacy rights
You may inspect and edit your meeting content, remove individual records or use Delete all my data in Settings. Depending on your location, you may have additional rights to access, correct, delete or restrict processing of personal information and to complain to a local data protection authority. Send privacy requests to tavishiverley@icloud.com. This address is a privacy contact only; the app has no email-sending or support-ticket feature. We may need information sufficient to identify relevant data without requesting your installation secret.
Security
Production communication uses HTTPS. Public TLS is terminated by Cloudflare and requests are forwarded over HTTPS to the pinned Railway service origin. The app stores its random installation secret in the device Keychain with a this-device-only accessibility setting; the secret is not shared across installations. The server hashes the secret and scopes database reads, writes and deletions to that hash. Payload limits and validation protect the API, and the server rejects photo fields. Local app files use iOS file protection. The application does not log meeting payloads or secrets. These safeguards reduce risk but no storage or transmission system can guarantee absolute security.
Children’s privacy
This product is designed for adult organizers and facilitators of creative gatherings and is not directed at children. An organizer should avoid entering unnecessary personal information about participants and should obtain appropriate permission before importing photographs of other people. The app does not create participant accounts or require participant names.
Changes to this policy
We may update this policy when the app, backend processing or hosting practices change. The effective date on this page identifies the current version. The Privacy Policy link in app Settings opens this public page. Material processing changes will be reflected in the updated policy and, where appropriate, in the app.