Privacy Policy

1. Personal Information We Do Not Collect

In accordance with Apple App Store Review Guideline 5.1.1 (Data Collection and Storage), apps must minimize data collection. Cephala is engineered from the ground up so that you never have to trust our servers with your personal health history:

• No User Account Credentials: You do not need to register, log in, create a profile or provide an email address, username or password.
• No Cloud Symptom Database: We do not operate remote databases storing your headache attacks, pain intensity logs, acute medication names, relief timings or personal notes.
• No Advertising SDKs or Trackers: Cephala contains no advertising networks, cross-app advertising tracking scripts or social media trackers (such as Google Analytics, Meta Pixel, Firebase Analytics, AppsFlyer or Adjust).
• No Data Monetization: We do not sell, rent, monetize or share health records with health insurance companies, pharmaceutical manufacturers, clinical trial brokers or advertising exchanges.

2. Local Storage and Optional iCloud Backup

Diary entries are stored in the app’s local container on your iPhone by default. Cephala does not operate a remote database of your health entries.

If you enable iCloud backup, Cephala writes diary snapshot files to your Apple iCloud storage. This is file backup, not live CloudKit database synchronization. Apple manages iCloud storage and its security. You can also export files yourself or enable export of headache entries to Apple Health.

3. Optional Permissions and Exports

• Barometric sensor: Supported iPhones can measure local pressure with Core Motion permission. These readings provide diary context, not migraine predictions.
• Notifications: Optional Pro pressure-drop notifications are scheduled locally and need notification permission. Cephala does not send medication-overuse, streak or scheduled check-in notifications.
• Apple Health: When you enable the connection and grant permission, headache entries are exported to Apple Health. Apple manages that data under your Health settings.
• Siri, Shortcuts and sharing: App shortcuts use Apple’s services and settings. Voice processing depends on Apple’s configuration. PDF reports and backup files are generated locally; sharing them sends a copy to the destination you choose.

4. Payments, Subscriptions and In-App Purchase Privacy

Cephala offers optional premium upgrades ("Cephala Pro"). Payment processing and transaction settlement are executed exclusively by Apple Inc. through StoreKit. We do not collect, process, or have access to your credit card numbers, billing addresses, or financial payment details.

RevenueCat manages Pro access and purchase restoration. It processes purchase and subscription records, product identifiers and a pseudonymous app user/support identifier. The SDK can connect when the app starts, not only when you purchase. Paywall interaction data is used to review subscription performance.

The app does not send diary entries, medication records or notes to RevenueCat. A pseudonymous identifier is not the same as anonymous data. See Apple’s and RevenueCat’s privacy policies for their handling of purchase data.

5. Analytics Data Not Linked to You

Cephala uses Aptabase’s hosted service in the European Union for app usage analytics. We use this data to understand how Cephala is used and improve the app. Aptabase receives Product Interaction data, such as event names for app startup, onboarding, screen views, logging, reports, backups and purchase or restore flows. It also receives Coarse Location: country and region inferred from the connection’s IP address.

This analytics data is not linked to your identity or account. Aptabase uses a daily rotating pseudonymous hash rather than a persistent identifier, and does not store the IP address. Analytics do not include diary entries, symptoms, pain severity, medication details, notes, patient names or support IDs. We use this data for analytics, not advertising tracking. Aptabase’s privacy policy states that analytics data is retained for up to five years. Deleting the app does not erase analytics already sent. Because these records are not linked to your identity, we cannot identify your individual analytics records to retrieve or delete them. See Aptabase’s privacy policy for details.

6. User Data Portability and Right to Deletion

You can export your diary from Settings as a JSON backup file. You can also create PDF summaries for sharing.

Deleting local records or uninstalling Cephala removes the app’s local diary. This does not delete copies already exported, saved in iCloud, sent to Apple Health or shared elsewhere. Manage those copies in the relevant service or destination. Turning off iCloud backup stops new backups; it does not erase existing backup files.

7. Children's Privacy

Cephala complies with the Children's Online Privacy Protection Act (COPPA) and Article 8 of the General Data Protection Regulation (GDPR-K). The App is intended for individuals aged 13 and older (or aged 16 and older in the European Economic Area). Cephala does not knowingly collect, request or solicit personal information from children under these ages.

8. Compliance with GDPR, UK GDPR and CCPA/CPRA

You can contact us with privacy questions and requests. Applicable data protection rights include access to your records and deletion of local data; copies held in other services need to be managed separately.

• Right to Know & Access: All your data is accessible immediately inside the app interface and via the export feature.
• Right to Opt-Out of Sale or Sharing: Cephala does not sell or share personal information for cross-context behavioral advertising.
• Non-Discrimination: We provide identical core tracking functionality regardless of how you exercise your privacy rights.

9. Website Privacy (cephala.buraksahin.net)

The Cephala marketing website (cephala.buraksahin.net) is hosted statically via Cloudflare Pages. Cloudflare processes standard technical transmission data (such as IP addresses, browser types and request timestamps) strictly for security defenses, DDoS mitigation and global content delivery.

We do not use advertising cookies, pixel trackers or cross-site behavioral telemetry scripts on our website.

10. Changes to this Policy

We may update this Privacy Policy to reflect architectural improvements or regulatory requirements. Any modifications will be posted directly to this web page. Your continued use of Cephala following any revisions signifies your acceptance of the updated policy.

11. Contact Us

If you have questions, feedback or data protection inquiries regarding this Privacy Policy, please contact our team directly: