Privacy Policy

Last updated: November 9, 2026

The Short Version

We know nobody reads long privacy policies, so here's the essential summary:

• ✅ Your migraine data stays on your device by default — only the optional notification and weather features you turn on send anything, as detailed below
• ✅ We don't collect personal health information
• ✅ We don't sell, share, or monetize your data
• ✅ No account required, no login, no tracking
• ✅ Works offline for logging and viewing your data (first install, app updates, charts/PDF libraries, and notifications need a connection)
• ✅ You can delete everything anytime

That's it. If you want more details, keep reading.

What We Collect

Notification Preferences (Minimal Server Data)

If you enable notifications, we store:

• Push subscription token: Anonymous identifier needed to send notifications
• Notification time: Your preferred time for daily check-ins (e.g., "8:00 PM")
• Timezone: Your timezone (e.g., "America/New_York") to deliver notifications at the correct local time
• Enabled status: Whether notifications are on or off
• Attack timing (follow-ups only): If you enable post-attack follow-ups or active-attack check-ins, the server also receives an attack identifier and the scheduled reminder times. The identifier is derived from when the attack started; no pain levels, notes, symptoms, or medications are ever sent

Important: This data is stored on our notification server and is necessary for the notification system to function. Notification preferences are stored on that server, so if notifications stop working (for example after a server restart), toggle notifications off and on again in Settings to re-register. However:

• The subscription token is generated by your browser/device, not by us
• It's anonymous - not linked to your name, email, or identity
• It cannot be used to identify you personally
• You can delete it anytime by disabling notifications

Weather Tracking (Optional, Local Storage Only)

If you enable weather tracking, we store on your device:

• Location query: The ZIP code or city name you entered (e.g., "10001" or "New York, NY")
• Coordinates: Latitude and longitude for your location (for fetching weather data)
• Weather data: 30 days of barometric pressure history

Important: All weather data is stored exclusively on your device. Your location is:

• ✅ Never sent to our servers
• ✅ Only sent to two services that make the feature work: Open-Meteo (fetches the weather for your coordinates) and Nominatim/OpenStreetMap (turns your city/ZIP into coordinates, or coordinates into a city name if you use the optional GPS button)
• ✅ Never shared with anyone else
• ✅ Deleted when you disable weather tracking

At-Rest Encryption (Optional)

Off by default. When you enable "Encrypt my data" in Settings, your health data on this device is encrypted:

• ✅ AES-256-GCM encryption of your episodes, cycle data, assessments, and medications
• ✅ The key is derived from your passphrase (PBKDF2-SHA256) and is held only in memory while the app is unlocked — it is never written to disk or sent anywhere
• ✅ Zero-knowledge: no one, including us, can decrypt your data without your passphrase
• ⚠️ There is no recovery if you forget your passphrase — keep an unencrypted JSON backup somewhere safe before enabling

Menstrual Cycle Tracking (Optional, Local Storage Only)

Cycle tracking is off by default. If you turn it on, the app stores on your device:

• Period start dates: only the dates you log — nothing else

This is sensitive reproductive-health data, and it never leaves your device. Your period dates are:

• ✅ Never sent to our servers or any third party
• ✅ Used only to calculate your cycle day and menstrual-migraine pattern locally, in your browser
• ✅ Included only in backups and the doctor report you export yourself
• ✅ Removable anytime (remove individual dates or turn the feature off)

Migraine Data (Local Storage Only)

All your migraine tracking data is stored exclusively on your device:

• Migraine entries (dates, times, severity, duration)
• Calendar data
• Analytics calculations
• App settings and preferences
• Weather correlation analysis (if weather tracking enabled)

This data never leaves your device. It's stored in your browser's local storage and is not transmitted to our servers, cloud services, or third parties.

What We Don't Collect

Just as important as what we collect is what we don't collect:

• ❌ No personal identifying information (name, email, phone number)
• ❌ No migraine symptoms or health data (we never see your entries)
• ❌ No server-side location tracking (weather location stored locally only, timezone for notifications)
• ❌ No GPS access unless you ask for it (you can type your location manually; the optional "use my location" button asks the browser for GPS one time to fill it in)
• ❌ No analytics or usage tracking (we don't use Google Analytics, Facebook Pixel, etc.)
• ❌ No advertising IDs or tracking cookies
• ❌ No browsing history or behavioral data
• ❌ No device fingerprinting

Your Rights

Right to Access

Your data is stored on your device, accessible anytime. You can view all your migraine entries in the calendar and analytics pages.

Right to Export

Go to Settings → "Export PDF Report" to generate a comprehensive report of your migraine history. This is your data - export it whenever you want.

Right to Delete

Delete your data anytime:

• Individual entries: Tap any date on the calendar and delete the entry
• All data: Settings → "Clear All Data" (permanent - cannot be undone)
• Notification data: Disable notifications in Settings to remove server-side data

Right to Opt-Out

Don't want notifications? Simply don't enable them, or disable them in Settings at any time. The app works perfectly fine without notifications.

No Account Needed

We don't require account creation, so there's no profile to manage or account to delete. Just use the app.

Data Storage

Local Storage (On Your Device)

What's stored: All migraine tracking data
How long: Until you delete it or clear your browser data
Who has access: Only you (via your device)

Notification Server (Our Servers)

What's stored: Push subscription token, notification time, timezone
How long: Until you disable notifications or the token expires
Who has access: Only our notification service (not shared with third parties)
Location: Hosted on Render.com servers

Third-Party Services

Aiding Migraine uses minimal third-party services:

Push notifications in Chrome are delivered via Google's Firebase Cloud Messaging endpoint — this is the browser's standard Web Push transport, not the Firebase server SDK, and the app sends nothing to Firebase directly.

We do NOT use:

• Google Analytics or similar tracking
• Social media pixels (Facebook, Twitter, etc.)
• Advertising networks
• Data brokers or third-party data sharing

Security

We take security seriously:

• HTTPS encryption: All communication between the app and our servers is encrypted
• No passwords: No account = no password to leak
• Local storage: Your migraine data is stored locally and is not sent to our servers; only the optional notification and weather features described above send anything, and only when you turn them on
• Open source: Our code is publicly available for security review

Your responsibility:

• Keep your device locked with a passcode/biometric
• Don't share your device with untrusted people
• Keep your operating system and browser updated

Children's Privacy

Aiding Migraine is designed for adults with migraines. We do not knowingly collect personal information from children under 13. If a parent or guardian becomes aware that their child has used Aiding Migraine, please contact us.

However, since we don't collect personal identifying information and data is stored locally, there's minimal privacy risk even if a minor uses the app with parental consent.

Data Sharing

We do not sell, rent, or share your data. Ever.

The only "sharing" that happens is when YOU choose to export a PDF and share it with your doctor - which is entirely under your control.

We will never:

• Sell your data to advertisers, data brokers, or third parties
• Share your migraine information with insurance companies
• Provide your data to researchers without explicit consent
• Use your data for marketing purposes

Legal Requirements

Because we don't collect personal health information, there's essentially nothing to provide even if legally compelled. The only data on our servers is anonymous notification preferences, which cannot identify you.

International Users

Aiding Migraine can be used anywhere in the world. Since migraine data is stored locally on your device:

• No international data transfer of health information
• Compliant with GDPR (EU), CCPA (California), and other privacy regulations
• Notification server hosted in the United States (via Render.com)

If you're in the EU: You have all GDPR rights (access, deletion, portability) as described in the "Your Rights" section above.

Changes to This Policy

If we make changes to this privacy policy, we will:

1. Update the "Last updated" date at the top
2. Show a notice in the app for 30 days
3. Post the updated policy to this page

Significant changes (like adding data collection) would require explicit opt-in consent.

Open Source

Aiding Migraine is open source, meaning:

• You can review the code to verify our privacy claims
• Security researchers can audit the app
• The community can contribute improvements
• You can even run your own instance if you want full control

View the code on GitHub.

Questions or Concerns?

If you have questions about this privacy policy or how we handle data:

• Email: support@aidingmigraine.com
• GitHub: Open an issue

We're committed to transparency and will respond to privacy questions promptly.

Summary Table