The data kept

Your account: email address, hashed password (never readable), date and version of your consent.
Your journal: for each episode, the date, the start time and duration if you note them, the type of pain, the aura, the intensity, nausea, the medications taken (dose, time, effect), the triggers ticked and your notes.
Your medications (name, type, usual dose) and the periods of your preventive treatments (start, end, dose, reason for stopping).
Your daily check-ins (sleep, stress, skipped meal, caffeine) and, if you turn on cycle tracking, your period days.
Without an account: an attack noted from the home page stays in an encrypted cookie in your browser. It only reaches the server if you create an account or sign in, and disappears if you choose "Don't keep it" or close the browser.

Cookies and technical data

A session cookie, needed to stay signed in; if you tick "Remember me" (ticked by default), a second cookie that lasts three months and is renewed each time you come back. No analytics or advertising cookie.
Your theme choice (Auto, Paper, Night) stays in your browser.
Installed on a phone or a computer, the app keeps its technical files (styles, icons) on the device, plus two public pages, "No connection" and "When to seek urgent care". Never a page of your journal.
If you turn on notifications (daily check-in reminder, "Still going?"): your choices, the reminder time, your time zone and, for each device that accepts them, the address its browser gives for notifications. They go, encrypted, through the browser's notification service (Google for Chrome, Apple for Safari, Mozilla for Firefox), which does not see their content. Turning everything off erases these addresses.
An attack noted without network stays in the device's browser until the network is back, then it is sent and erased from the device.
To block attacks on passwords, the IP address and email address of sign-in attempts are counted for one hour at most.
The server's technical logs record the pages requested and the IP address; your health data is filtered out of them.

To keep your journal, compute your statistics and produce the PDF report for your doctor.
To let you export and import your data.
To email you only to reset your password, or to answer your message: no newsletter, no advertising.
To receive your opinion if you give one (Account › Give feedback): it arrives by e-mail in the contact mailbox and is not kept in the app. It carries your address only if you tick "You can reply to me".
Legal basis: your explicit consent when creating the account, required for health data (GDPR, article 9(2)(a)). You can withdraw it at any time by deleting your account.

Your data stays as long as your account exists; deleting it erases them from the database at once.
A backup copy of the database is made every night and kept for 30 days, encrypted, in a backup repository outside the server (BorgBase, in the European Union). A deleted account therefore leaves the backups after 30 days too.
Export files are sent straight to you and not kept on the server.
Anti-abuse counters disappear after one hour at most.

Your data is not sold, shared or used for advertising.
The service runs on a server rented from Hetzner Online, in the European Union. The host stores the data on our behalf; no other service has access to it. Mail (password reset, your messages to the contact address) goes through Infomaniak, in Switzerland, which sees only the address and the message, never your journal.
Data travels encrypted (HTTPS). In the database it is protected by access to the server; it is not yet encrypted field by field.

Access and portability: Account › Data management › "Export all data", a complete JSON file, at any time.
Rectification: edit any episode, medication, period or check-in in the app.
Erasure and withdrawal of consent: Account › Data management › "Delete my account" erases everything, permanently.
For any other request (objection, restriction, question): write to the address below.
Complaint: the Data Protection Authority in Belgium (dataprotectionauthority.be), or the authority of your country.