Privacy Policy for Cluster Headache Tracker

Last updated: October 17, 2026

1. Introduction

Cluster Headache Tracker is a free diary for people with cluster headaches. This policy explains what data we collect, why, where it's kept, and how you can export or delete it, whether you use the website, the installed web app, or the iOS and Android apps. The apps show the same service as the website, so everything here applies to them too.

2. Who is responsible

Carmine Paolino, Brunnenstr. 169, 10119 Berlin, Germany, is responsible for your data (the "controller" under the GDPR). You can reach him at the address below.

3. What we collect

3.1 What you give us

  • A username and a password. We don't ask for an email address, your name, a phone number or your location. Your password is only stored as a one-way hash.
  • Your headache logs: when attacks start and end, their intensity, medications and doses you take, triggers, notes, and barometric pressure if you enter it. This is health data.
  • The medications you add, with their doses, units and schedules.
  • Photos you choose to attach to a log. Location and other metadata are removed before they're shown.
  • Your answers if you fill in the feedback survey, together with your browser or app version.
  • Your language and time format, and which notices you've already seen.

3.2 What is collected automatically

  • Technical data every device sends with a request, such as your IP address and browser or app version. We use it to deliver pages and to block abuse (for example repeated failed sign-ins).
  • Page views, counted by Plausible Analytics on our own server, without cookies and without storing your IP address. It tells us which pages are used, not who uses them.
  • Error reports when the server hits a problem, sent to our own error tracker on our server in Germany. A report contains the request that failed: the page address, what was sent with it, your browser or app version, the steps the server took just before, and your account's number and username. If you were saving a log, it can include health data such as the attack's times, intensity and doses. What you write (medications, triggers and notes), passwords, cookies and IP addresses are left out. Only the maintainer can read error reports.

4. The iOS and Android apps

  • The apps keep a short summary of your attack status on your phone (whether an attack is ongoing, when it started, days attack-free and attacks today) to show widgets, shortcuts and, on iPhone, the Live Activity. It never leaves your phone and is removed when you sign out or delete your account. On Android it's left out of device backups.
  • The apps use the camera only when you choose to take a photo for a log.
  • The apps contain no advertising, no third-party analytics or tracking, and no push notifications.
  • If you allow it in your phone's settings, Apple or Google may share anonymous crash reports with us.

5. How we use your data

We use your data only to:

  • Provide the service, including your logs, charts, reports and share links
  • Show you patterns in your attacks
  • Understand which features are used and fix problems
  • Keep the service secure

We never use your data for advertising, never sell it, and never use it to train AI models.

6. Legal basis

  • We process your health data only with your explicit consent (Art. 9(2)(a) GDPR), which you give by ticking a box when you create your account. Accounts created before October 2026 are asked once, the next time they're used. You can withdraw your consent at any time by deleting the data or your account.
  • We process your account to provide the service you signed up for (Art. 6(1)(b) GDPR).
  • We process technical data, page counts and error reports for our legitimate interest in running a secure, working service (Art. 6(1)(f) GDPR).
  • When an error report contains health data, we process it under the same explicit consent, only to find and fix the problem.

7. Sharing

  • We do not sell, trade, or rent your data to anyone.
  • You decide what to share. A share link you create lets anyone who has it see your logs and charts, read-only and without photos, until you revoke it or it expires after 30 days.
  • When someone signs up or sends feedback, we're notified by email through our email provider, Forward Email. Sign-up notices contain the username; feedback notices also contain the survey answers.
  • We may disclose information if required by law or to protect our rights, property, or safety.

8. Where and how it's stored

  • Your account, logs and photos are stored on servers in Germany.
  • Everything travels encrypted (HTTPS) between your device and our servers.
  • Photos are encrypted on disk.
  • What you write about your attacks (medications, triggers and notes), the names and schedule notes of your medications, and your feedback answers are also encrypted in the database, each value separately. This protects them if a copy of the database ever gets out, but not from someone who controls the server, because the keys are kept there too. Attack times, intensities, doses, ratings and pressure readings aren't encrypted this way, so the app can sort and chart them.
  • Backups are encrypted, and the values encrypted in the database stay encrypted inside them.
  • Only the maintainer can access the servers.

9. How long we keep it, and how to delete it

Your data stays until you delete it. You can edit or delete any log at any time; deleting a log deletes its photos too.

To delete your account and all of its data, open Account in the app or Account Settings on the website, choose Delete account and confirm with your password. How to delete your account

This immediately deletes your account, logs, photos, medications, doses, share links and feedback from our database. Encrypted backups made before then may still contain your data until those backups are deleted. Error reports stay in our error tracker and aren't deleted with your account; email us with your username and we'll delete them.

If you can't sign in, email us with your username and we'll delete the account once we can confirm it's yours.

10. Your rights

Under the GDPR you have the right to:

  • Access your data, and export it as a CSV file from Account Settings on the website
  • Correct it, by editing your logs and settings
  • Delete it, by deleting logs or your whole account
  • Withdraw your consent at any time, by deleting the data
  • Object to processing based on our legitimate interests
  • Complain to a data protection authority, such as the Berlin Commissioner for Data Protection and Freedom of Information

11. Cookies

We only use cookies the service needs, to keep you signed in and to protect forms. We don't use tracking or advertising cookies.

12. Children

Cluster Headache Tracker is not meant for children under 16, and we don't knowingly collect their data.

13. Changes to this policy

We may update this policy from time to time. We will post the new policy on this page and update the "Last updated" date.

14. Contact

If you have any questions about this policy or your data, please contact us at:

hello@clusterheadachetracker.com

15. Open source

The code of the website and the apps is public, so anyone can check what it does with your data: