Migraine Pilot Privacy Policy

Last updated: November 10, 2026

Migraine Pilot (called Enxaqueca Pilot in Portuguese) is a personal migraine and headache diary. This policy explains, in plain language, what the app stores, why, who helps us run it, and how you stay in control. It applies to the app (bundle ID com.jumaappsllc.migrainepilot) on the App Store and Google Play, and to the website https://migrainepilot.jumaapps.com.

Leia em português: Política de Privacidade.

Summary

Your diary is saved on your phone first and backed up to our own server, private to your account. It is never stored in iCloud.
Apple Health and Health Connect are read-only and off by default. The app never writes to them.
No ads, no data selling, no tracking. Analytics events say only that something happened (for example, "logged an attack"), never what you logged.
You can export everything as a spreadsheet (free) and delete your account inside the app: More → Account → Delete account.

Who is responsible for your data

The controller is Juma Apps LLC, a limited liability company organized in Wyoming, United States, 30 North Gould Street, STE N, Sheridan, WY 82801, United States.

Support and privacy: [email protected]
Data protection officer ("encarregado", Article 41 of the Brazilian LGPD): name of the DPO or "Juma Apps LLC privacy team" — [email protected]

What Migraine Pilot is — and what it is not

Migraine Pilot stores and counts what you write down or choose to import: your attacks, the routine around them and the medications you use. It is not a medical device. It does not diagnose, treat, cure or prevent any condition, never suggests a medication or a dose, and does not replace your doctor. The "Patterns (beta)" screen only counts how often something you logged appeared before attacks and on pain-free days; it does not identify causes.

Data you enter in the app

Everything below is optional except the attack intensity when you log an attack, and only exists if you enter it:

Profile: display name, year of birth, sex (including "prefer not to say"), how often you usually get headaches, whether you want menstruation in the daily check-in, and app preferences (language, time zone, dark screen during an attack). We also record when you accepted the health notice and how far you got in onboarding.
Attacks: start and end time, type you chose (migraine / other headache / not sure), intensity (0–10) at the start, maximum and in each update, the head regions you tap on the pain map, pain quality, whether it gets worse with activity, aura, symptoms, things you suspect came before it, how it ended, and notes.
Medications: your personal list (name or catalog item, class, whether you use it for attacks or as a preventive, how you usually take it — in your own words), the preventive schedule (days, time, start and end dates, notes), each time you mark a preventive as taken, and the medications you took during an attack (name, class, dose as you typed it, time, whether and when it helped). The app never pre-fills or suggests a dose.
Routine: meals (time, type of meal, food categories, a short description, favorites), water, sleep (duration and quality), steps, activity (type, start, duration, notes) and your goals.
Daily check-in: mood, energy, stress, sleep quality, menstruation (only if you turned it on) and notes; and "pain-free day" confirmations.
Reminders: which reminders are on and at what time.

Most of this is health data. See "Health data and your consent".

Data you choose to import (Apple Health and Health Connect)

The integration is off by default and starts only when you turn it on (More → Apple Health / Health Connect, or during onboarding). Migraine Pilot only reads; it never writes anything to Apple Health or Health Connect.

With your permission, the app reads sleep, steps, workouts (exercise sessions) and water from the last 30 days, only while the app is open. Nothing is read in the background.
Apple Health (iPhone): sleep (asleep, core, deep and REM), steps, workouts and water.
Health Connect (Android): the exact permissions requested are Exercise, Hydration, Steps and Sleep — all read-only. The app does not request Distance or Total calories burned; from each exercise session it keeps only the type, start time and duration.
What is kept from an import: the day's sleep time, steps and water, and each workout's type, start and duration. They appear in your diary with their source and can be edited or deleted like any other entry; a deleted import is not imported again.

You can turn the integration off at any time in the app, and you can also revoke access in the Health app (iPhone) or in Health Connect settings (Android).

Limited Use. Migraine Pilot's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. Data from Apple Health and Health Connect is used only to fill in your own diary and show it to you. It is never used for advertising or marketing, never sold, never used to build profiles, never sent to analytics or crash reporting, never shared with third parties except to store your own diary on our server, and never used to train artificial-intelligence models.

Account data

There is no password: we never ask for or store one. You can use the app in four ways:

Google: we receive your name, email address and a Google account identifier.
Apple: we receive your name and email address (or Apple's private relay address) and an Apple account identifier.
Email: we receive the address you type and send it a one-time 6-digit code, valid for 10 minutes. Only a cryptographic hash of the code is kept until it is used or expires.
Without an account ("Continue without an account"): the app creates an anonymous account with a random identifier. You can link it to Google, Apple or email later (More → Profile → Link account).

Data collected automatically

Migraine Pilot contains no advertising SDK, does not use the device's advertising identifier and does not show ads.

Usage events (Google Firebase Analytics and Mixpanel): which screens you open and which actions you take, for example "attack started", "meal logged", "report exported" or "paywall shown". Events never carry health data — no intensity, head region, symptom, medication, dose, meal, amount, check-in answer or name. They are linked to the random identifier of your account and include basic device information (model, operating system, app version, language and country setting). You can turn usage events off at any time in More → Preferences → "Share anonymous usage data" (on by default). When it is off, the app stops sending events and properties to Firebase Analytics and Mixpanel from that moment on; crash reports continue.
Crash reports (Google Firebase Crashlytics): technical data about a crash or internal error (device model, system, app version, the error), linked to the same random identifier. They never include your diary entries.
Subscription data: RevenueCat and Superwall receive the same random identifier, basic device information, paywall events and, if you subscribe, the store's transaction details. Payment is processed by Apple or Google; nobody in this chain sees your card number.
IP address: every request to our server and to the providers above carries your device's IP address, which they use to deliver the service and keep it secure. The "Sign in with Google" button downloads its typeface from Google Fonts, so Google also receives your IP address when that button is shown.

How we use your data

To show your diary, calendar, progress, patterns, reports and reminders
To back up your diary on our server and bring it back when you sign in on another device
To import the data you allowed from Apple Health or Health Connect
To manage your account and subscription
To answer you when you contact support
To keep the service secure and prevent abuse
To understand, with events that carry no health data, which parts of the app are used and fix problems
To comply with legal obligations

We do not sell your data, use it for advertising, build marketing profiles, or track you across other companies' apps or websites. That is why the App Tracking Transparency prompt never appears.

Attacks, pain regions, symptoms, medications, meals, sleep, activity, check-ins and menstruation reveal information about your health. Under the Brazilian LGPD (Art. 5, II and Art. 11) they are sensitive personal data; under the GDPR and UK GDPR (Art. 9) they are special category data; in several US states they are consumer health data.

We process them only with your specific and explicit consent (LGPD Art. 11, I; GDPR Art. 9(2)(a)): you give it when you accept the health notice at the start and each time you enter an item, and, for imports, when you turn on the integration and grant the system permission. The app never collects health data on its own or from sensors.

You can withdraw consent at any time by deleting entries, turning off the integration or deleting your account. Withdrawal does not affect processing that already happened, but without this data the diary cannot work. We never share health data with advertisers, insurers, employers or data brokers.

Legal bases

Consent (LGPD Art. 11, I; GDPR Art. 9(2)(a)): all health data, including imported data.
Performance of a contract (LGPD Art. 7, V; GDPR Art. 6(1)(b)): your account, sign-in, sync of your diary to your devices and your subscription.
Legitimate interests (LGPD Art. 7, IX; GDPR Art. 6(1)(f)): security, abuse prevention and usage analytics without health data. Never used for health data.
Legal obligation (LGPD Art. 7, II; GDPR Art. 6(1)(c)): tax and accounting records, and requests from authorities.

Who helps us run the app

Each provider receives only what it needs and acts on our instructions (as an "operador" under the LGPD, a processor under the GDPR, a service provider under US laws):

Hetzner Online GmbH — hosts our server and database in Helsinki, Finland (European Union). Stores your synchronized diary and account data.
Google — Sign in with Google; Google Play billing; Firebase Analytics and Crashlytics (events and crash reports without health data); Google Fonts (IP address, sign-in button only).
Apple — Sign in with Apple; App Store billing.
Mixpanel, Inc. — product analytics (events without health data, name or email).
RevenueCat, Inc. — validates App Store and Google Play subscriptions and tells the app whether Premium is active. No health data.
Superwall, Inc. — shows the subscription screen and measures how it performs. No health data.
Resend — sends the one-time sign-in code to your email. Receives only the address and the code.

Apple Health and Health Connect run on your device; what the app reads from them goes into your diary, not to Apple or Google.

We may also disclose data when the law requires it, or in a merger or sale of the company, in which case you will be told beforehand. Under the CCPA/CPRA (California) we do not "sell" or "share" personal information.

Where your data is stored

Migraine Pilot is offline-first: everything is saved to a database on your device before anything else. Every account, including anonymous ones, then sends the diary listed above to our own server, where row-level security keeps each account's data separate from every other account. When you sign in to the same account on another device, the diary comes back. An anonymous account can be recovered on another device only if you linked it to Google, Apple or email first.

Health data is never stored in iCloud or in any other cloud backup of the app. The Juma Apps people who operate the service can technically access the database and do so only to provide support you ask for, to keep the service secure, or when the law requires it.

Some things stay only on your device: what came from Apple Health or Health Connect on each day (to show the source), the integration on/off setting, the order of your suspected factors, per-medication reminder switches, theme and the onboarding draft. Reminders are scheduled locally on the device; we use no push-notification service.

PDF reports and CSV spreadsheets are generated on the device and leave it only when you choose to share them.

International transfers

Our server is in Finland (European Union). If you live elsewhere — for example in Brazil or the United States — your data is transferred there, and some providers above process data in the United States. For transfers from Brazil we rely on the mechanisms of Article 33 of the LGPD (including standard contractual clauses approved by the ANPD, or your specific consent when no other mechanism applies); for the EU and UK, on Standard Contractual Clauses, the UK addendum or adequacy decisions.

How long we keep it

While your account exists, your diary is kept. Entries you delete are marked as deleted (so your other devices delete them too) and are erased for good when the account is deleted.
When you delete your account in the app, the account and all synchronized data are deleted from our database right away.
Server backups are kept for 14 days, so a deleted account disappears from them within 14 days.
Sign-in codes expire after 10 minutes.
Purchase records may be kept as long as tax and accounting law requires; they contain no health data.
Analytics and crash data are kept by Google and Mixpanel for their configured retention period retention set in Firebase and Mixpanel, e.g. 14 months.
Data on your device is erased when you delete the account or uninstall the app.

Device permissions

Notifications: daily review, attack follow-up and preventive reminders, scheduled locally.
Apple Health / Health Connect: read-only, only if you turn the integration on.
Run at startup (Android): to re-schedule reminders after the phone restarts.

The app does not request location, contacts, camera, image gallery or microphone.

Subscription

Logging attacks, the pain map, the routine diary, this month's calendar, reminders, the medication-day counter, Apple Health / Health Connect and the full CSV export are free. Premium adds unlimited history, the PDF report, the CSV export by section and Patterns (beta). Prices are shown in the store before you buy; billing and renewals are handled by the App Store or Google Play.

Security

Data in transit uses TLS (HTTPS). The database has no public port and enforces row-level security per account; server secrets stay on the server. encryption at rest of the server disk/volume and of the backups. On the phone, the diary lives in the app's private storage protected by the operating system. No method is 100% secure; if an incident puts your data at risk, we will notify you and the competent authority as the law requires (LGPD Art. 48; GDPR Art. 33–34).

Your rights

Under the LGPD (Art. 18) and similar laws, you can at any time:

Confirm and access what we hold about you — most of it is visible in the app;
Correct incomplete or wrong data — directly in the app;
Portability — More → Account → Download my data exports everything as a spreadsheet (CSV), free;
Delete entries one by one, or your whole account in More → Account → Delete account;
Withdraw consent — delete entries, turn off the integration or delete the account;
Get information about who we share data with (see above) and about the consequences of not consenting (the diary cannot work without the data you enter);
Object to processing based on legitimate interests, and ask for anonymization, blocking or deletion of unnecessary data;
Complain to the ANPD (Brazil), your EU data protection authority, the ICO (UK) or your state attorney general (US).

To exercise a right we cannot meet inside the app, email [email protected] from the address you sign in with. We may ask you to confirm your identity. We answer within 15 days (LGPD) or 30 days (GDPR, UK GDPR) — 45 days where US state law allows.

For users in the United States, the EU and the UK

US: we do not sell or share personal information for targeted advertising, and we do not use health data for anything other than your diary. Residents of California, Washington, Nevada, Colorado, Connecticut, Virginia and other states with privacy laws may request access, correction, deletion and portability as described above, and will not be discriminated against for doing so. Migraine Pilot is not a HIPAA-covered entity; your diary is protected by this policy and by the state laws that apply to you.
EU/UK (GDPR): controller and contact as above; legal bases as above; you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time.

Children

Migraine Pilot is intended for people aged 18 or over. We do not knowingly collect data from minors; if we learn that we have, we will delete it. Parents or guardians can write to [email protected].

Website

The website uses no cookies, no analytics and no third-party scripts or fonts. The hosting provider keeps standard access logs (IP address, page, time) for security.

Changes to this policy

When we change something material, we will tell you in the app and update the date at the top. Changes that need new consent take effect only after you accept them.