Privacy Policy

1. Who we are

Umber is made and published by Ahmet Can Güven, an independent developer based in Istanbul, Türkiye. For anything about this policy or your data, write to [email protected]. We are the data controller for the small amount of data that reaches our server, described in section 3.

2. What Umber stores, and where

Your diary. Attacks, symptoms, medication doses, food, check-ins, notes, custom trackables, your medication list and your settings are stored in a database on your iPhone. If iCloud is on for Umber, this database is mirrored to the private part of your own iCloud account, protected by Apple's encryption, so it follows you to a new phone. We have no access to your iCloud and no copy of your diary.

Data from Apple Health. With your permission, Umber reads sleep and, if you enable it, menstrual cycle data from Apple Health. This is kept only on the device it was read on, is never uploaded to iCloud or to us, and is re-read from Health on each device. Umber never writes anything to Apple Health.

Pressure and weather. Barometric readings come from the sensor in your iPhone and stay on the device. Forecasts come from Apple's WeatherKit; the request goes from your device to Apple using your approximate location, or a city you type. We do not receive your location and do not store it anywhere.

Apple Watch. Logs made on your Watch are stored on the Watch and transferred to your iPhone by Apple's Watch connectivity. Nothing goes through our servers.

3. What leaves your device

Purchases. Apple processes every payment; we never see your card. To check what you bought and keep your Premium status in step across devices, we use RevenueCat, a subscription service. It receives your Apple transaction records and a random identifier that Umber creates on first launch. It receives no health data and no contact details.

The AI companion (Premium, optional). The companion is off until you read the consent screen in the app and turn it on. When you send a message, your phone builds a compact, anonymised summary of the part of your log that is relevant to your question: counts, dates, medication names, pressure values and, when relevant, short excerpts of your own notes. It contains no name, no contact details and no location. This summary and your question travel to our server, which forwards them to OpenAI's API with storage turned off. Under OpenAI's API terms this content is not used to train its models. Our server does not store your message or the reply. It records that a request happened, using your random identifier, the time and the credits used, and deletes those records after 90 days. Your credit balance is kept for as long as you have credits or a subscription. You can turn the companion off at any time in Settings.

Proof that it is really Umber. To keep the companion from being abused, our server only accepts requests from a genuine copy of the app, verified with Apple's App Attest. This involves a one-time registration with Apple and a signature on each request. It does not identify you.

4. What we never do

• Sell, rent or share your data with data brokers.
• Use health data for advertising or marketing, ours or anyone else's.
• Show advertisements or embed analytics or ad networks in the app.
• Write to Apple Health.
• Keep a copy of your diary on our servers.

5. Permissions, all optional

Umber works with every permission declined. Location (while using the app) fetches a local forecast; you can type a city instead. Health (read only) provides sleep and, if you choose, cycle data. Notifications deliver pressure alerts and reminders you set. Motion and fitness lets the app read the barometer. You can change any of these in iOS Settings at any time.

6. How long things are kept

On your device: until you delete an entry or the app. In your iCloud: until you delete it, under Settings › your name › iCloud. On our server: request metadata for 90 days; your credit balance and purchase state for as long as you hold credits or a subscription, then for as long as tax and accounting rules require purchase records to be kept.

7. Your rights

You can export everything Umber holds about you at any time, free, from Settings › Export, as CSV or PDF. To delete your diary, delete the app and remove Umber's data from iCloud. To have the metadata on our server deleted before the 90 days are up, or to ask what we hold, email us with the identifier shown in Settings › Privacy in the app; it is the only way we can find your records, because we know nothing else about you. Depending on where you live, you may also have rights under the GDPR, the UK GDPR or Türkiye's KVKK: access, correction, deletion, restriction, portability, objection, and the right to complain to your local data-protection authority. We answer within 30 days.

8. Processors and transfers

Companies that process data for us, each under a contract limiting what they may do with it: Apple (App Store, iCloud, WeatherKit, App Attest), RevenueCat (purchase verification), OpenAI (AI companion replies, storage off), Cloudflare (network protection and encryption in front of our server and this website), and Contabo GmbH (the server itself, hosted in France, in the European Union). Some of these are in the United States; transfers rely on standard contractual clauses or an equivalent lawful mechanism.

9. Children

Umber is rated 12+ on the App Store and is not directed at children under 13. We knowingly hold no data about them; since we hold no personal data at all, there is nothing to remove, but write to us if you have a concern.

10. Changes

If this policy changes in a way that matters, the app will show you the new version and a summary of what changed before it applies. Old versions stay available on request.

11. Contact

[email protected]
Ahmet Can Güven
Istanbul, Türkiye