Privacy policy

Last updated 9 October 2026

This policy is a draft: it has not been reviewed by a lawyer, and it will change before the app is released. It covers two separate things: this website, and the healthd iPhone app.

The website

This section describes the website as it is built today. The pages set no cookies. They load no scripts, so there is no analytics, no advertising pixel and no tracking of any kind. Every file a page loads, fonts and images included, comes from this website; nothing is requested from another server. There are no forms, and the site asks you for nothing.

The server that hosts a website usually keeps access logs, such as your IP address, the time and the page you asked for. Where this site will be hosted is not decided yet, so this policy cannot yet say what the host records or for how long. That will be added here before the site is published.

The app

What the app reads

The app reads only the Health data groups you turn on in the app. It asks Health for read access only, and it never writes to Health.

Each group you turn on lets the app read these types of Health data, and no others:

• Activity: steps, walking and running distance, flights climbed, active energy, resting energy, exercise minutes and stand time.
• Heart: heart rate, resting heart rate, walking heart rate average and heart rate variability.
• Body: weight, height, body mass index, body fat percentage and lean body mass.
• Sleep: sleep analysis, which holds your sleep stages and time asleep.
• Vitals: blood oxygen, respiratory rate, VO₂ max, body temperature, and systolic and diastolic blood pressure.
• Workouts: your recorded workouts, with their type, duration, distance and energy, but not the routes they followed. It contains no code that reads contacts, photos, location, calendars, the camera, the microphone or motion data.

Where your data goes

The app sends what it reads to one place: the receiver address you enter. Its only network code is the delivery to that address and the local-network check described below. The app contains no web address of its own, so there is no server of ours and no third party it could send data to. A plain http:// address is accepted only on your own local network; any other address must use https://. Each request carries the samples from the groups you turned on, with the method and headers you set, including your credential. The app never reads the body of your receiver’s response, only its status code, and it does not follow redirects. It sends with a network session that keeps no cookies and no cached responses on disk. If you point the app at a service that someone else runs, what happens to the data there is up to that service.

What the developer receives

Nothing: there is no server behind the app, and there is no account to create or sign in to. The app contains no analytics, advertising, tracking or crash-reporting code. It uses no third-party libraries, only Apple’s own frameworks. Its privacy manifest declares no tracking and no collected data types. The app has no iCloud capability and no iCloud code, so it stores nothing in iCloud itself. Separately from the app, iOS can share crash reports with app developers if you allow that in the iPhone’s settings, and TestFlight shares crash reports and feedback with the developer of an app you test; those are Apple’s features, under Apple’s settings.

What stays on your phone

The app keeps your settings on the phone: the receiver’s address, method and headers, the groups you turned on, and your export and alert settings. It keeps a delivery log of the last 100 runs: when each ran, what started it, how much was sent, the response status and the outcome. The log holds counts, not health data. Batches that have not been delivered yet stay on the phone, with the health data in them, until your receiver accepts them or for at most seven days. The same file records how far delivery has got, so the next export carries on from there. All of these are files inside the app, written through one place in the code. They are protected by iOS Data Protection and cannot be read until the phone has been unlocked once after it starts. Your credential is kept in the iOS Keychain, on this device only, and is not synced to iCloud Keychain. Once saved, it is shown masked and is never displayed again. The app’s only log lines are about background work and about a file it could not mark to be left out of backups, and they carry no credential and no health data.

Device backups

The file that holds batches not yet delivered is the only one the app marks to be left out of iCloud Backup and computer backups. The app sets that mark again every time it writes the file. If iOS refuses the mark, the app still saves the file and logs only the file’s name and an error code. Your settings, the groups you turned on and the delivery log are not marked, so they can be included in a backup of your iPhone made with iCloud Backup or a computer. If you restore your iPhone from a backup, the app no longer knows how far delivery had got, so it reads your Health data from the beginning again and sends your history once more. Your receiver is expected to drop the repeated samples by each sample’s identifier.

Local network access

If your receiver is on your own network, iOS asks whether the app may use the local network, because without that permission the app cannot reach it. The app explains why before iOS asks. To tell whether the permission is on, the app briefly announces a test service on your network and looks for it itself, for at most four seconds. Any connection made to that test service is closed at once. It runs this check when you test a receiver on your network, and once at the start of each export to one. A receiver on the internet needs no such permission, and the app does not ask for it then.

Notifications

Failure alerts are off until you turn them on, and only then does the app ask for permission to send notifications. They are local notifications created on the phone; the app uses no push service. An alert says how many deliveries in a row failed and what kind of failure it was, and shows no address, no status code and no health data.

Your choices, and deleting your data

You can turn any group off in the app, or revoke the app’s access in Settings → Privacy & Security → Health. Remove Credential, on the receiver screen, deletes the credential from the Keychain. Deleting the app deletes its files: your settings, the delivery log and any batches not yet delivered. iOS can keep a Keychain item after its app is deleted, so use Remove Credential first if you want the credential gone as well. If you install the app again, it deletes a credential it finds without settings. Data already delivered is on your receiver, which you run, so you delete it there; the app cannot delete it for you, and it never tells your receiver about deletions in Health.

Children

The app collects nothing from anyone, children included: nothing it reads reaches the developer.

Changes and contact

If this policy changes, the new version will be posted on this page with a new date. Questions about this policy go to healthd-support@proton.me.