Privacy policy

The short version

If you read nothing else on this page, these are the points that matter.

• There is no account and no sign-up.
• Your readings, notes and profile names stay on your phone and never reach us. They leave it only in a file you choose to share (a PDF report, a CSV or a backup), in a backup you save, or automatic backup writes, to a folder you pick, in the text you choose to share with an AI assistant, or through Android’s own backup to your Google account.
• The free version shows ads through Google AdMob, and they are never personalised. Where the law requires it, your consent is asked first, and Pro removes ads entirely.
• Google Firebase tells us which features are used and when the app crashes, without knowing who you are and without any reading or health data.
• A purchase is processed by your app store; we never see your payment details.
• We do not sell your data, and you can ask us to show, correct or delete what we hold.

Who is responsible for your data

The controller of the personal data described here is Codeur d'Ivoire, publisher of the app and of this website. To ask a question or exercise a right, write to support@codeurdivoire.com and say which device and which version of the app you use, so we can find the right records.

Your readings stay on your phone

Readings are health data, and the publisher never receives them: they are kept in the app’s private storage on your phone, and we run no server to send them to. They are not sent to Firebase, AdMob or RevenueCat either.

Readings you keep for someone else in a household profile are treated the same way: they stay on your phone, and sharing them is up to you. Nothing syncs between phones, so each phone holds only what was typed in on it.

The app keeps the following on your phone. We cannot read it, and it is all deleted when you uninstall the app or use Clear data for it in Android’s settings.

• Your readings: the date, time and time-zone offset of each, its values, and, where you give them, the context, arm, position, note, tags and the individual measurements of a blood-pressure series.
• Your profiles: their names and colours and, where you give them, a year of birth, a sex and a note for the doctor, which appear only in the reports you create. Your tags: their names.
• Your visit plans, one per profile at most: the first and last days, the visit date if you give one, the times, the vitals chosen and whether the plan reminds you.
• Your settings: the vitals you turned on and their order, your units, the hour your day ends, your reminder times, your language and theme, whether the app lock is on and after how long it locks, whether the app is hidden in the recent apps screen, and whether you completed the introduction.
• The date of the last backup you saved to a folder and of the last one you handed to the share sheet, and the folder you last saved one to.
• Your automatic backup settings: the folder you chose, whether it is on, when it last wrote a backup, the names of the backup files it keeps, and whether the folder stopped answering.
• Whether you have opened Share with an AI assistant once, so its “New” label shows only until then.
• Counters the app uses to pace itself: how many times you opened it, how many actions you completed, when it was installed, when an offer, a rating prompt or the backup reminder was last shown, and until when you dismissed the backup reminder.
• An encrypted copy of your Pro status and its expiry date, so Pro keeps working offline; the end of an ad-free period earned by watching a rewarded video; and the date of the last report a video unlocked.

Files and text you create and share

The PDF report, the CSV export and the JSON backup are made on your phone, in the app’s cache. Each one replaces the previous file of its kind, and Android may clear the cache whenever it likes, so a file is never the only copy of your log.

Save to device writes the JSON backup into the folder you pick in Android’s folder picker — on your phone, an SD card, or a cloud app that offers folders — and nowhere else. The app keeps access to that folder only to write its backups there, until you remove the access or delete the folder.

Automatic backup, when you turn it on, writes the same backup into the folder you chose — at most once a day and only when your log changed — and nowhere else: never to a server of ours. It keeps its 10 newest backups there and deletes its own older ones; it never opens, changes or deletes any other file in that folder.

A file leaves the app only through the share sheet, the print dialog or the folder picker that you open. From there, the receiving app or service’s own terms and privacy policy apply, not ours; these files hold your health data, so share them only with people and services you trust.

Share with an AI assistant writes the readings of the period you chose as text, on your phone: never with a profile name, and with your notes only if you turn them on. Health Log calls no AI service and sends this text nowhere itself: it leaves the app only through the share sheet, to the app you pick — an assistant, or Copy. That app’s own terms and privacy policy then apply, not ours, and an AI service may keep or use what you send it under them; the text holds your health data, so share it only with a service you trust.

Restoring a backup reads only the file you pick in Android’s file picker, and sends nothing anywhere. The app uses no storage permission.

Android backup

When your device’s backup is on, Android copies the app’s data, your log included, to your Google account, within Android’s 25 MB quota, and a device-to-device transfer copies it to your new phone. Google keeps that copy under its own terms, and you set it in Android’s backup settings.

The app’s encrypted store — your Pro status, the end of an ad-free period and the date of the last report a video unlocked — is excluded from both, so on a new phone the store confirms Pro again.

What the app collects automatically

The following is collected when you use the app, without you entering anything, through software development kits from Google and RevenueCat embedded in it. It is described in the names and the order Google uses, so you can match it against the data safety section of the app’s Google Play listing. None of it contains a reading, a value, a note or a profile name.

• Approximate location: inferred from your IP address, by Google AdMob to select ads and by Firebase Analytics for aggregate reports. The app holds no location permission and never learns your precise location.
• Purchase history: if you buy Pro, the product bought, its price and the receipt issued by the store, received by RevenueCat, and the purchase event, received by Firebase Analytics.
• App interactions: the screens you open, named by their kind and never by what they show, the features you use, the offers shown to you and the plan you buy with its price, collected by Firebase Analytics. An event says what was done — a report’s period and format, the period of a text shared with an AI assistant and how it was summed up, how a backup was restored, the answer to a notification prompt — with counts in ranges, and never carries a reading, a value, the vital concerned, a note or a profile name.
• Crash logs: collected by Firebase Crashlytics, with your app language and theme, and never with a reading or the content of a file.
• Diagnostics: device model, operating system and app version, system language, and the state of the app when something failed.
• Device or other IDs: the advertising identifier of your device, which Google AdMob reads to limit how often an ad repeats, to measure ads and to prevent fraud, and never to personalise them; a Firebase installation identifier that groups events and crash reports by installation; and an anonymous identifier generated on your device for RevenueCat. Firebase Analytics collects neither the advertising identifier nor the Android ID. None of these identifiers is your name or your e-mail address, and the advertising identifier can be reset or deleted.

Advertising through Google AdMob

The free version of the app shows ads supplied by Google AdMob; that is how it stays free. This website shows none.

Banners appear on History, Trends and Settings, never on Home, the reading form, the report builder or the onboarding. An occasional full-screen ad can appear when you leave the report after sharing it, or when you come back to History, Trends or Settings after at least five minutes away — never when you come back to Home, the reading form or the report, nor from a reminder — and the app makes at most one automatic interruption — an ad, an offer or a rating request — per session. Two videos are optional: one, from Settings, suspends ads for a limited time; the other unlocks one 90-day report, at most once every 30 days.

The app asks Google AdMob for non-personalised ads only, whatever answer you give in the consent form. An ad is chosen from the app it appears in and your approximate location, never from a profile of your interests or your health. Nothing you log — no reading, value or health condition — is sent with an ad request.

Even a non-personalised ad relies on identifiers stored on your device, and in the European Economic Area, the United Kingdom and Switzerland the law requires consent before an app reads or stores them. There, the app presents Google’s consent form, and no ad is requested before you have answered it. Where your region requires the choice to stay open, it can be changed later from the app’s settings.

To serve and measure ads, the AdMob SDK reads your advertising identifier — to limit how often an ad repeats, to count views and clicks, and to prevent fraud — and the approximate location and diagnostic information listed above. Google acts as an independent controller for the ads it serves, under its own privacy policy (policies.google.com/privacy). We do not sell or share your data with advertisers ourselves.

• Reset or delete your advertising identifier in your device settings (Settings, then Google, then Ads, on most Android phones).
• Watch an optional rewarded video to suspend ads for a limited time.
• Upgrade to Pro, which removes every ad from the app for as long as it is active.

Analytics and crash reports

Firebase Analytics tells us, in aggregate, which features are used and where people stop, so development goes where it matters. Firebase Crashlytics reports crashes so we can fix them. Neither is given your name, your e-mail address or an account identifier: the app never sets one. Neither receives a reading, a note or a profile name.

Firebase Analytics collects no advertising identifier and no Android ID, and its data is not used to personalise ads or to build advertising audiences.

The Pro upgrade and payments

Pro is sold through your app store, which collects the payment and holds your payment method. We never see your card number, bank details or billing address.

RevenueCat records that a purchase happened and tells the app whether Pro is active. It receives the anonymous identifier generated on your device, the store receipt, the product bought and basic device information, and processes them on our behalf under its own privacy policy (revenuecat.com/privacy).

Notifications

Reminders are scheduled on your phone by the app itself: nothing is sent to a server to deliver them, and a reminder holds only a time (and, for a visit plan, its date). The app asks for the permission when you save your first reminder or accept the onboarding’s reminder step, never at launch, and you can withdraw it at any time in your device’s settings.

Every notification reads “Health Log” and “Time to log your readings”: no value, vital or condition ever appears on your lock screen.

Its “Snooze 15 min” button schedules one more of the same notification on your phone, 15 minutes later; nothing is sent anywhere.

App lock and the recent apps screen

When you turn on the app lock, Android’s own prompt checks your fingerprint, your face or your phone’s PIN, pattern or password, and tells the app only whether it matched. The app never receives, stores or sends any of them, and there is no app password to keep.

Hide content in Recents asks Android to show a blank page for the app in the recent apps screen and to refuse screenshots of it. It works on your phone alone, and the app holds no permission to read your screenshots.

This website

This website sets no cookies, uses no web font, runs no analytics, loads no third-party scripts and shows no ads. As with any website, the hosting provider keeps short-lived technical logs, which may include your IP address, for security and troubleshooting.

Why we process this data, and on what legal basis

For users in the European Economic Area, the United Kingdom and Switzerland, the law requires a legal basis for each purpose. Ours are the following.

• Your readings: none, since the publisher never processes them; they stay on your phone.
• Consent: reading and storing, on your device, the identifiers ads rely on, where the law requires consent; and notifications, which the system only allows once you grant the permission. You can withdraw either at any time, without affecting what happened before.
• Performance of a contract: unlocking the Pro features you paid for.
• Legitimate interest: aggregate analytics and crash reports, to improve and fix the app, kept free of direct identifiers.
• Legal obligation: keeping the records accounting and tax rules require in connection with a purchase.

Who else receives data

We do not sell your personal data. The providers below receive data because a feature cannot work without them, each under its own published terms.

• Google (AdMob): selecting and measuring non-personalised ads in the free version.
• Google (Firebase Analytics and Crashlytics): usage statistics and crash reports.
• Your app store (Google Play or the App Store): payment, refunds and subscription changes.
• RevenueCat: validating purchases and keeping the Pro status in step with them, on our behalf.
• Public authorities: only when a valid legal request obliges us to, and only to the extent required.

Where your data is processed

Google and RevenueCat operate in several countries, including the United States, so some of this data is processed outside the European Economic Area. Those transfers rely on the safeguards these providers document, such as the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework where the provider is certified under it.

How long data is kept

We keep data only as long as the purpose that justified it lasts.

• Analytics events: 14 months.
• Crash reports: 90 days.
• Purchase records: as long as accounting and tax rules require.
• Data on your phone: until you clear it or uninstall the app.
• Messages you send us: as long as needed to answer them, and at most 12 months after the last exchange.

Children

The app is for adults: its target audience is 18 and over. It is not directed at children, and we do not knowingly collect personal data from anyone below the age at which consent is valid in their country. If you believe a child has given us personal data, write to us and we will delete what we hold.

Your rights

You can ask us for access to your personal data, its correction or deletion, a copy in a portable format, or a restriction of its use; you can object to processing based on our legitimate interest, and withdraw a consent at any time. Write to support@codeurdivoire.com: we answer within one month. The app holds no account, so we may ask for details that identify your installation.

Your readings are in your own hands, because we hold none: the app lets you export them (a CSV or a backup) and delete them (a reading, a profile, or everything by clearing the app’s data or uninstalling it). For the data processed by Google and RevenueCat, you can also use the tools those providers offer, and your device’s advertising and privacy settings.

You also have the right to lodge a complaint with a data protection authority — in Côte d’Ivoire, the ARTCI, under law no. 2013-450 of 19 June 2013 on the protection of personal data — or with the authority of the country where you live.

Changes to this policy

When this policy changes, the date at the top of the page changes with it. A change that materially affects how your data is handled is announced in the app before it takes effect, and where the law requires new consent, we ask for it.