The Comeback — Privacy Policy

Version 1.4 · Effective September 9, 2026

This Privacy Policy describes how Vallecito Labs LLC ("we," "us"), the operator of The Comeback (the "App"), handles information when you use the App, and the one thing our website, vallecitolabs.com, collects: an email address you choose to give us for the launch waitlist (Section 6).

The short version: the App is built so your recovery record stays on your device. There is no account. We do not ask for your name, email address, or phone number. Nothing you enter about your surgery is transmitted to us. We do not receive or store your photos or your recovery data. They stay on your device. The one place any data leaves your device is purchase processing, described in Section 3. On the website, the only information we collect is the email address you choose to enter to be told when the App is released, described in Section 6.

1. What we do not collect

• No account and no identity. The App never asks for your name, email address, phone number, or any government identifier, and we cannot look up who you are.
• No advertising trackers and no third-party analytics. The App contains no advertising SDK, no social-media SDK, and no third-party analytics SDK. We do not sell personal information, and we do not share it for advertising. The App requests no cross-app tracking permission because it does no cross-app tracking.
• No content servers. All educational content ships inside the App. The App works fully offline; it never fetches content about you or for you from a server.

2. What stays on your device

The App stores your information in its private on-device storage:

• Your surgery details — surgery date, procedure, graft type, meniscus work, and the optional "getting back to" answer. Used only on your device to choose which pre-written content to show.
• Your recovery record — progress photos, check-ins, and milestone dates. Photos and the record are encrypted at rest with iOS file protection. Progress photos are additionally excluded from device backups, so they never leave the phone at all — not even inside your own iCloud or computer backup.
• Settings and status — your chosen notification time, the version and date of the terms you accepted, and purchase status.

Apart from photos, this on-device data may be included in your own device backup (iCloud or computer). Device backups belong to you and are governed by Apple, not by us or this policy. Deleting the App deletes the data it stores on the device.

3. Purchases — the one place data leaves the device

The App offers a single one-time purchase. Payment is processed by Apple through your App Store account under Apple's terms and privacy policy; we never see your payment details.

To recognize the purchase, the App uses RevenueCat, a purchase-infrastructure provider that processes data on our behalf. When the App launches, shows a price, makes a purchase, or restores one, RevenueCat receives:

• a random identifier created for your installation (not your name — we could not connect it to you if we tried);
• your App Store purchase and receipt information for this App;
• basic device information (device model, OS version, locale, app version), and the IP address incidental to any internet request;
• after a completed purchase, which recovery program the App is set to (for example, ACL) — attached to the purchase record so we can understand purchases per program. It says nothing else about you, and your surgery details, dates, photos, and record are never included.

We use this data only to make your purchase work (including restoring it on a new device) and to understand purchases in aggregate. It is never used for advertising. Once, on a new installation, the App silently checks with the App Store for a previous purchase so a paying customer is recognized without creating an account.

4. Notifications

The one daily notification is scheduled and composed entirely on your device from bundled content — no server sends it and no data leaves the device to deliver it. It exists only if you grant notification permission, and you can revoke that permission in iOS Settings at any time.

5. Camera and photo library

The camera opens only when you choose to take a progress photo, and iOS asks your permission first. Choosing a photo from your library uses Apple's picker, which runs outside the App — the App receives only the photo you select. Photos are stored as described in Section 2 and are never uploaded. Any future cloud photo backup would be a separate, explicitly opt-in feature and would come with an update to this policy first.

6. When you email us, and the launch waitlist

If you email us — a question, or feedback such as why a reimbursement claim was denied — that is your choice, and we receive what you send. We use it to respond and to improve the App and its documents, keep it only as long as needed for that, and do not add it to the launch waitlist or any other list.

Launch waitlist. Our website has a form to be told when the App is released. If you enter your email address there, we store the address, the date and time you submitted it, and — if you arrived through a link that a clinic or other partner shared — a short tag naming that link. That is all: no cookie is set, and no IP address or device information is recorded with it. The list is stored by our hosting provider, Vercel, in the United States, and we keep it only until the App is released. We use it to send one email saying the App is available, and then we delete it. We do not add your address to anything else, share it, or send other mail to it. To be removed sooner, email support@vallecitolabs.com from that address.

7. Children

The App is not directed to children under 13, and we do not knowingly collect personal information from anyone — child or adult. Neither is the website's waitlist; if we learn that an address on it came from a child under 13, we delete it. Use by anyone under 18 requires a parent or legal guardian per the Terms of Service.

8. Your choices and rights

• Delete everything local: delete the App; iOS removes its on-device data.
• Permissions: notifications, camera — grant or revoke any time in iOS Settings.
• Purchase records held by Apple are managed through your App Store account.
• Purchase-infrastructure records (Section 3): email support@vallecitolabs.com and we will work with RevenueCat to delete them. Because there is no account, we may need information from your device to locate the random purchase identifier.
• Waitlist address (Section 6): email support@vallecitolabs.com from that address and we delete it.
• Depending on where you live, you may have legal rights to access, correct, or delete personal information. Contact us and we will honor them; note that for almost everything, the honest answer is that we hold nothing that identifies you.

9. Changes to this policy

We may update this policy. The version and effective date appear at the top. If we make a material change — for example, adding an opt-in cloud backup — the App will tell you before the change applies to you. Changes are not retroactive.

10. Contact

Questions about privacy: support@vallecitolabs.com.