Privacy Policy for Migora
Migora ("Migora", "the app", "we", "us") is a migraine and headache diary for iPhone. This policy explains what happens to your information when you use the app.
The short version: Your migraine entries stay on your device. We cannot see them. We do not have servers that store your health data, we do not sell data, and we do not use your data for advertising. The one thing that leaves your device is an approximate location sent to Apple to look up local weather — and only if you turn that feature on.
1. Who is responsible for your data
Migora is built and published by an independent developer. There is no company behind the app — it is a solo project, and the developer is the data controller for the limited data described in Section 3.
Contact for privacy questions and requests: ergashev.apps@gmail.com
2. Health information you enter (stays on your device)
Migora lets you record information such as:
- headache and migraine attacks, their timing, duration and intensity
- symptoms and possible triggers
- medications taken, including doses
- notes you write yourself
If you enable the weather feature, weather values such as barometric pressure and temperature are attached to your entries (see Section 3.4).
This information is stored locally on your device. We have no access to it, no copy of it, and no ability to read it.
iCloud sync (optional, Pro feature)
If you enable sync, your entries are copied to your own private iCloud database (Apple CloudKit) so they are available on your other Apple devices. This data lives in your personal iCloud account under Apple's control and terms. We cannot access it. If you have Advanced Data Protection enabled in your Apple account, this data is end-to-end encrypted.
Apple's handling of iCloud data is described in Apple's Privacy Policy: apple.com/legal/privacy
PDF reports (optional, Pro feature)
PDF reports are generated on your device from your own entries. They are not uploaded to us. If you share a report with a doctor, by email, or to another app, that sharing is under your control and governed by the service you share it through.
Health app integration
Migora does not read from or write to Apple HealthKit.
3. Data that is processed by third-party services
To operate and maintain the app, we use a small number of established service providers. None of them receive your migraine entries, notes, medications or any other health content.
3.1 Crash and stability diagnostics — Firebase Crashlytics (Google)
When the app crashes or encounters a serious error, a diagnostic report is sent to Firebase Crashlytics so we can fix it. A report can include:
- device model and operating system version
- app version and build
- the technical state of the app at the moment of the crash (stack traces, logs)
- a randomly generated installation identifier (Crashlytics Installation UUID)
These reports do not include your diary content.
3.2 Subscriptions and purchases — Apple and RevenueCat
Migora Pro is sold as an auto-renewing subscription (monthly and yearly, with a free trial on the yearly plan). Payment is processed entirely by Apple. We never receive your payment card details, billing address or Apple ID.
We use RevenueCat to verify purchase receipts and determine whether your subscription is active. RevenueCat processes:
- an anonymous app user identifier generated by the app
- App Store receipt / transaction data (product purchased, purchase and expiry dates, renewal and cancellation status, country of the store)
- basic device and app metadata
Apple's own handling of your purchase is governed by Apple's Privacy Policy: apple.com/legal/privacy
3.3 Product analytics — PostHog
To understand how the app is used and where it can be improved, we collect anonymous product analytics through PostHog. This covers events such as which screens are opened, which features are used, and whether onboarding is completed, together with:
- a randomly generated, non-identifying analytics identifier
- device type, operating system version, app version, and approximate country derived from IP address
We do not send the content of your entries to analytics. No symptoms, triggers, medications, notes, dates of attacks or any other health information leaves your device through analytics. Analytics events record that a feature was used, never what you recorded in it.
3.4 Weather and location — Apple WeatherKit
Changes in weather, particularly barometric pressure, are a common migraine trigger. If you turn this feature on, Migora can record the weather conditions at the time of an attack.
To do this, the app needs to know roughly where you are:
- We request approximate location only ("reduced accuracy"). iOS gives the app a general area of several kilometres rather than your exact position. We do not request precise location.
- Location is requested only while you are using the app, at the moment you create or view an entry. The app does not track your location in the background and does not follow your movements over time.
- The approximate coordinates are sent to Apple WeatherKit solely to retrieve the weather for that area. Apple's handling of WeatherKit requests is described at developer.apple.com/weatherkit/data-source-attribution and in Apple's Privacy Policy.
- We never receive your location. The request goes from your device to Apple directly.
- Your location is not stored. Only the weather values returned (such as pressure, temperature and humidity) are saved with your entry on your device. The coordinates are discarded.
This feature is entirely optional. If you decline the location permission, the rest of the app works normally — you simply will not see weather data alongside your entries. You can change or revoke the permission at any time in iOS Settings → Privacy & Security → Location Services → Migora.
Weather data is provided by Apple Weather and other sources, as listed in Apple's data source attribution.
Legal basis (EEA/UK): your consent, given through the iOS location permission prompt (Art. 6(1)(a) GDPR).
3.5 What we do not do
- We do not sell or rent your personal information.
- We do not share your data with advertisers, data brokers or social networks.
- We do not use tracking across other companies' apps and websites (no App Tracking Transparency tracking).
- We do not build advertising or marketing profiles about you.
4. International transfers
Google, RevenueCat and PostHog process data in the United States and other countries. Where data from the EEA, UK or Switzerland is transferred, it is protected by the European Commission's Standard Contractual Clauses or an equivalent approved transfer mechanism, as set out in each provider's terms.
5. How long data is kept
| Data | Retention |
|---|---|
| Your diary entries | On your device until you delete them or uninstall the app. In iCloud until you delete them or disable sync. |
| Approximate location | Not retained. Used once to fetch weather, then discarded. Only the weather values are kept, on your device. |
| Crash reports | Retained by Firebase Crashlytics according to Google's retention schedule (up to 90 days for crash reports; up to 180 days for related analytics) |
| Subscription records | Kept by RevenueCat for the life of the subscription and as required for tax and accounting purposes |
| Analytics events | Retained by PostHog for up to [12] months |
6. Deleting your data
- Individual entries: delete them inside the app.
- All local data: delete the app from your device. Local data is removed with it.
- iCloud copy: disable sync in the app, and remove Migora data via iOS Settings → your Apple Account → iCloud → Manage Account Storage.
- Diagnostic and analytics data: write to ergashev.apps@gmail.com and we will ask our providers to delete data associated with your installation identifier, where we can identify it.
- Subscription: cancel in iOS Settings → your Apple Account → Subscriptions. Cancelling a subscription does not delete your diary.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to withdraw consent, and to receive your data in a portable format (GDPR/UK GDPR). California residents have rights of access, deletion, correction and opt-out under the CCPA/CPRA — note that we do not sell or share personal information as those terms are defined under the CCPA.
Because your health entries are held only on your device and in your own iCloud account, you exercise most of these rights directly: you can view, edit, export and delete your data at any time without contacting us.
For anything else, contact ergashev.apps@gmail.com. We respond within 30 days.
If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.
8. Security
Data on your device is protected by iOS file-level encryption and your device passcode or biometrics. iCloud data is encrypted in transit and at rest by Apple. Communication with our service providers uses TLS. No method of storage or transmission is completely secure, but because we hold no central database of your health information, there is no server of ours that could be breached to expose it.
9. Children
Migora is not directed at children under 13 (or under 16 in the EEA where local law requires). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at ergashev.apps@gmail.com.
10. Not medical advice
Migora is a personal diary, not a medical device. It does not diagnose, treat or prevent any condition, and it does not provide medical advice. Always consult a qualified healthcare professional about your symptoms and treatment.
11. Changes to this policy
We may update this policy as the app changes. The updated version will be posted at migora.app/privacy with a new "Last updated" date. For material changes we will notify you in the app before the change takes effect.
12. Contact
If you have any questions about this Privacy Policy, please contact us at ergashev.apps@gmail.com.