Privacy policy

This policy explains how the AuraTrace app for iOS, iPadOS and Android (the "app") and the website at auratrace.app (the "website") handle information. AuraTrace is made by xyzlab.dev, an independent developer based in Ontario, Canada ("we", "us"). If anything here is unclear, write to support@auratrace.app.

What stays on your device

AuraTrace is built to work without an internet connection. Everything you enter is saved in the app's private database on your phone or tablet (SwiftData on iPhone and iPad, Room on Android) and is never sent to us. That includes:

• Episodes: when a migraine started and ended, its severity, whether an aura came first, possible triggers, symptoms, relief taken and your notes.
• Your triggers: the built in trigger list and any triggers you add.
• Your name, if you choose to enter one, used only for the greeting on Today.
• Report options: the patient name for the PDF and which sections to include.
• Trial and Plus status: the date of your first entry, which starts the free week, and a copy of your Plus status so the app works offline. On iPhone and iPad the trial start date is also kept in the device's Keychain, so reinstalling the app does not restart the trial.

We cannot see, access or recover any of it. AuraTrace does not read from or write to Apple Health or Health Connect, and it does not use your location, camera, contacts or microphone.

Data Not Collected

We do not collect, store, sell or share personal data of any kind, including health data, usage data, identifiers or diagnostics. This is why the App Store privacy label for AuraTrace says Data Not Collected, and why the app declares no tracking.

No accounts, no servers

You do not create an account, and we do not ask for your email address or phone number. There is no AuraTrace server for the app to talk to, and our own code makes no network requests. The only part of the app that goes online is the store purchase system described below.

No analytics, no ads, no tracking

The app contains no analytics, advertising, crash reporting or tracking software, from us or from anyone else. We do not build profiles, and we do not track you across apps or websites.

Third party software

On iPhone and iPad, AuraTrace uses only Apple's own frameworks. Purchases use Apple's StoreKit.

On Android, the only third party software development kit (SDK) in the app is the Google Play Billing Library, provided by Google to handle purchases. It communicates with the Google Play Store app and Google's servers to show prices, process purchases and confirm whether you have Plus. Because of this library, the Android app includes the internet and network state permissions. Our own code does not use them. Google may receive information about these purchase interactions, such as diagnostic data about the billing service, and handles it under the Google privacy policy.

Your PDF report

The doctor report is created on your device. To share it, AuraTrace saves the PDF in the app's private storage and hands it to the system share sheet. It goes only where you choose, for example an email, a message, your files or a printer. Once you share it, the copy you sent is handled by the app or service you picked and by the person who receives it, not by us.

The report contains health information. You decide whether it includes your name, your notes and the relief you took. Please share it with care.

Purchases

AuraTrace Plus is sold as an auto renewing subscription (monthly or yearly) or a one time lifetime purchase through the Apple App Store or Google Play. Apple or Google processes the payment and handles your payment details under their own privacy policies (Apple, Google). The app only receives a confirmation from the store that Plus is active on your account, and keeps a copy of that status on your device so Plus keeps working offline. We do not receive your name, email address, payment card or billing address.

Device backups

Your device's own backup may include AuraTrace's data, under your own account:

• iPhone and iPad: iCloud Backup, or a backup to your computer, can include the app's data and restore it to a new device.
• Android: AuraTrace allows Android Auto Backup, so your journal and settings can be backed up to your Google account and restored when you set up a new device, or copied during a device to device transfer.

These backups are created and stored by Apple or Google under your account and their privacy policies. We cannot access them. You can turn backups off in your device settings.

This website

auratrace.app is a set of static pages. It sets no cookies, uses no local storage, runs no analytics and loads nothing from other websites: fonts and images are served from this site.

The website is hosted on Cloudflare Pages. Like any web host, Cloudflare processes technical data such as your IP address, browser type and the pages requested in order to deliver the site and protect it against abuse. Cloudflare acts as our service provider for this purpose. We do not use this data to identify or track visitors. See the Cloudflare privacy policy for details.

If you email us

If you write to support@auratrace.app, we receive your email address and whatever you choose to include. We use it only to reply to you, and we delete support emails when they are no longer needed. Please do not send health details or other personal information we do not need to help you.

Children

AuraTrace is not directed at children under 13. The app does not collect personal information from anyone, including children, because nothing you enter leaves the device.

Deleting your data

You are always in control:

• To delete one entry, open it in the Journal and tap Delete.
• To delete everything, open Settings and tap Delete all data. Every episode is removed and your trigger list goes back to the 12 built in triggers. Your name, your report options and the trial start date are kept.
• Uninstalling the app removes its data from the device. On iPhone and iPad, the trial start date in the Keychain may remain on the device.

Device backups made earlier may still contain your data until they are replaced or deleted in your iCloud or Google account settings. Because we never receive your data, there is nothing to delete on our side. If you have Plus, your purchase stays with your Apple or Google account and can be restored later.

Security

Your journal is stored in the app's private storage, which other apps cannot read, and it benefits from the encryption and security built into iOS, iPadOS and Android. Keep your device protected with a passcode and up to date. A PDF report you export is a regular file, so treat it like any other private document.

Not a medical device

AuraTrace is a personal journal. It is not a medical device, and it does not diagnose, treat or prevent any condition. Patterns and insights in the app are simple summaries of what you logged, not medical advice. If you have a sudden, severe or unusual headache, or symptoms that worry you, contact a doctor or emergency services.

International users

AuraTrace can be used anywhere the App Store and Google Play offer it. Because the app keeps your data on your device, your information is not transferred to Canada or any other country by us. Website requests are served by Cloudflare's global network.

Canadian law

We are based in Ontario, Canada, and handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to ask what personal information we hold about you and to ask us to correct or delete it. In practice, the only personal information we may hold is an email you sent us. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Changes to this policy

If we change how AuraTrace handles information, we will update this page and the effective date at the top. If a change is significant, for example if the app ever started sending data off the device, we will say so clearly in the app before it happens.

Contact

Questions or requests about privacy: support@auratrace.app. AuraTrace, xyzlab.dev, Ontario, Canada.