Privacy Policy

1. Who we are

Umber is made and published by Ahmet Can Güven, an independent developer based in Istanbul, Türkiye. For anything about this policy or your data, write to [email protected]. We are the data controller for the small amount of data that reaches our server, described in section 3.

2. What Umber stores, and where

Your diary. Attacks, symptoms, medication doses, food, check-ins, notes, custom trackables, your medication list and your settings are stored in a database on your iPhone. If iCloud is on for Umber, this database is mirrored to the private part of your own iCloud account, protected by Apple's encryption, so it follows you to a new phone. We have no access to your iCloud and no copy of your diary.

Data from Apple Health. With your permission, Umber reads sleep and, if you enable it, menstrual cycle data from Apple Health. Raw Health records stay only on the device where they were read and are not uploaded to iCloud or our service. They are re-read from Health on each device. If you enable the AI companion, an aggregate share of attacks within your cycle window can be included in the summary you choose to share; sleep data is not sent to the companion. Umber never writes anything to Apple Health.

Pressure and weather. Barometric readings come from the sensor in your iPhone and stay on the device. Forecasts come from Apple's WeatherKit; the request goes from your device to Apple using your approximate location, or a city you type. We do not receive your location and do not store it anywhere.

Apple Watch. Logs made on your Watch are stored on the Watch and transferred to your iPhone by Apple's Watch connectivity. Nothing goes through our servers.

3. What leaves your device

Purchases. Apple processes every payment; we never see your card. To check what you bought and keep your Premium status in step across devices, we use RevenueCat, a subscription service. It receives your Apple transaction records and a random identifier that Umber creates on first launch. It receives no health data and no contact details.

The AI companion (optional). The companion is off until you read the consent screen in the app and turn it on; every install starts with a small free credit balance and Premium adds a monthly allowance. When you send a message, your phone builds a compact summary of your log: attack counts and dates, severity and duration bands, medication and preventive names, the names of the factors you track (including any you added yourself), impact days, if you connected Apple Health the share of attacks inside your cycle window, and, unless you turn notes off, short excerpts of your own notes. It contains no name, no contact details, no location and no raw Health data. This summary and your question travel to our server, which forwards them to OpenAI's API with storage turned off. Under OpenAI's API terms this content is not used to train its models. Our server does not keep chat messages or chat replies. Doctor-visit preparation responses are cached under your random account identifier for 24 hours to avoid charging twice for the same request; cleanup runs every six hours. Infrastructure backups can retain an older copy until the backup expires (currently 30 days). This means the information is pseudonymous, not anonymous. It records that a request happened, using your random identifier, the time and the credits used, and deletes those records after 90 days. Your credit balance is kept for as long as you have credits or a subscription. You can turn the companion off at any time in Settings.

Proof that it is really Umber. To keep the companion from being abused, our server only accepts requests from a genuine copy of the app, verified with Apple's App Attest. This involves a one-time registration with Apple and a signature on each request. The attestation key is associated with your random account identifier for fraud prevention; it does not contain your name or contact details.

Optional product usage. Share basic product usage is off by default. If you turn it on, Umber sends a limited set of feature-use events, the date, app version, offer identifier and an opt-in cohort date to our service. Events are linked to the same random identifier used for purchases and contain no diary entries, symptoms, medication values or notes. We use them to understand feature use and improve the app. They are removed from the active database after 90 days. Turning the option off queues a request to delete these events when the device can next connect; existing backups expire separately.

Purchase analytics and attribution. RevenueCat and our service keep purchase and subscription events associated with your random identifier, including product, transaction, price, currency and subscription status. These support purchase verification, credit delivery and revenue analysis. Apple Search Ads attribution and Apple's aggregate SKAdNetwork conversion reporting are limited to acquisition and purchase milestones, never health records. We do not use an advertising identifier or link your data with other companies' data for cross-app tracking.

4. What we never do

• Sell, rent or share your data with data brokers.
• Use health data for advertising or marketing, ours or anyone else's.
• Show advertisements, embed advertising networks, or send health records to advertising services.
• Write to Apple Health.
• Keep a copy of your diary on our servers.

5. Permissions, all optional

Umber works with every permission declined. Location (while using the app) fetches a local forecast; you can type a city instead. Health (read only) provides sleep and, if you choose, cycle data. Notifications deliver pressure alerts and reminders you set. Motion and fitness lets the app read the barometer. You can change any of these in iOS Settings at any time.

6. How long things are kept

On your device: until you delete an entry or the app. In your iCloud: until you delete it, under Settings › your name › iCloud. On our server: optional product events and request metadata for 90 days; cached doctor-visit preparation responses for 24 hours with cleanup every six hours; infrastructure backups for 30 days; your credit balance and purchase state for as long as you hold credits or a subscription, then for as long as tax and accounting rules require purchase records to be kept.

7. Your rights

You can export everything Umber holds about you at any time, free, from Settings › Export, as CSV or PDF. To delete your diary, use Settings › Privacy › Delete all data in the app (this also removes the synced iCloud copy), or delete the app and remove Umber's data from iCloud. To have the metadata on our server deleted before the 90 days are up, or to ask what we hold, email us with the identifier shown in Settings › Privacy in the app; it is the only way we can find your records, because we know nothing else about you. Depending on where you live, you may also have rights under the GDPR, the UK GDPR or Türkiye's KVKK: access, correction, deletion, restriction, portability, objection, and the right to complain to your local data-protection authority. We answer within 30 days.

8. Processors and transfers

Companies that process data for us, each under a contract limiting what they may do with it: Apple (App Store, iCloud, WeatherKit, App Attest), RevenueCat (purchase verification), OpenAI (AI companion replies, storage off), Cloudflare (network protection and encryption in front of our server and this website), and Contabo GmbH (the server itself, hosted in France, in the European Union). Some of these are in the United States; transfers rely on standard contractual clauses or an equivalent lawful mechanism.

9. Children

Umber is intended for people aged 13 and over; store age ratings can vary by country and operating-system version. It is not directed at children under 13. If you believe a child has supplied data to our service, contact us so we can investigate and handle a deletion request.

10. Changes

If this policy changes in a way that matters, the app will show you the new version and a summary of what changed before it applies. Old versions stay available on request.

11. Contact

[email protected]
Ahmet Can Güven
Istanbul, Türkiye