Privacy Policy
The short version. Daily Health Tracker is a small, invite-only health diary. What you log is health data, so it gets the strictest treatment: it is stored in a database file of its own, used only to show your diary back to you, never sold, never used for advertising, and never shared with anyone except the few service providers listed below that are needed to run the app. You can export everything, and you can delete everything yourself, at any time, from the menu.
1. Who is responsible
Daily Health Tracker (dailyhealthtracker.app) is run by Maarten Wiersma, an individual, not a company. For anything about your data, write to [email protected].
2. What data the app holds
Your account. Your email address, the account ID that Google sends when you sign in, when the account was created and when you last signed in. The app never sees or stores a password.
Everything you log. This is health data. Depending on what you choose to use, it includes:
- meals, foods, dishes, drinks and portions, and how you felt after eating
- supplements and medication-like products, with doses and times
- symptoms, digestion ratings and bowel movements (including stool form)
- sleep, energy, mood, mental clarity and stress ratings
- exercise and movement, relaxation and breathing practices
- illness and injury episodes, and menstrual cycle data if you turn it on
- body measurements and vitals such as weight, waist, blood pressure, heart rate, heart-rate variability and temperature
- lab results that you choose to add
- progress photos you upload
- free-text comments, and settings such as height, sex and time zone
Data from a connected wearable. If you connect an Oura Ring, the app reads the data types you approve on Oura's consent screen (for example sleep, readiness, heart rate, heart-rate variability, blood oxygen and stress) and writes them into your own diary. Nothing is sent back to Oura. You can disconnect at any time in your Oura account.
Technical data. Like any website, the server logs each request: your IP address, the time, and the page or action requested. One cookie keeps you signed in (see section 9).
3. Why, and on what legal basis
- Running your diary: storing what you log and showing it back to you, with charts and summaries. Legal basis: the agreement between us (Art. 6(1)(b) GDPR). Because this is health data, it is processed only with your explicit consent (Art. 9(2)(a) GDPR), which you give when you start logging. You can withdraw it at any time by deleting your data.
- Keeping it safe: backups, security and fixing errors. Legal basis: legitimate interest in not losing your data and keeping the service secure (Art. 6(1)(f) GDPR).
Your data is not used for advertising, not sold, not used to train AI models, and not combined with data about you from anywhere else.
4. Where it is stored
The app runs on a server in Frankfurt, Germany, rented from Fly.io. Each person's diary is a separate database file, with their photos in a folder next to it, so one account's data cannot show up in another account. All traffic to and from the app is encrypted (HTTPS).
The operator has technical access to the server, as anyone running a server does. Your data is only looked at to fix a problem you report, or when you ask for it.
5. Who else is involved
Nobody receives your data to use for their own purposes. These providers handle it only so the app can run:
| Provider | What for | What they get |
|---|---|---|
| Fly.io, Inc. | Hosting the app and its data (Frankfurt region) | Everything stored in the app, and the server logs |
| Cloudflare, Inc. | Domain, HTTPS and network protection: all traffic to the app passes through Cloudflare | Requests and responses while they travel, including your IP address |
| Cloudflare R2 (Cloudflare, Inc.) | Offsite copy of the nightly backups, on separate hardware | Backup copies of the databases and progress photos |
| Sign-in with your Google account | The fact that you signed in to this app. Google already holds your account; the app receives your email and account ID | |
| Google Fonts | The typeface used inside the app | Your IP address and browser details when a page loads the font |
| Oura (only if you connect it) | Reading your ring's data into your diary | Oura already holds that data; the app only reads it with your permission |
Fly.io, Cloudflare and Google are US companies. Your stored data stays in the EU (Frankfurt), but these providers may access it from elsewhere. Such transfers rely on the EU–US Data Privacy Framework or on the EU's standard contractual clauses.
6. How long it is kept
Your diary is kept for as long as you have an account. Nothing expires on its own.
Backups. Every night at 02:00 UTC the server makes a backup copy of each database. Copies are kept on a rolling schedule: every copy from the last 30 days, one per week for 12 weeks, and one per month for 6 months. Older copies are deleted automatically. The backups and your progress photos are mirrored to offsite storage (Cloudflare R2), and anything removed on the server is removed offsite in the next nightly run.
When you delete your data (section 8), your diary, your photos and all backup copies of your diary are deleted on the server straight away, and the offsite copies are deleted in the next nightly run, so within about 24 hours. One thing remains for a limited time: the separate list of accounts (email address, Google account ID, sign-up and last sign-in dates, no health data) is itself backed up, and older backups of that list keep your entry until they roll out under the schedule above, which takes at most about 6 months. Those copies are never restored to bring an account back.
Server logs are kept by the hosting provider for a short period.
7. Your rights
You have the right to access your data, to have it corrected, to have it deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent at any time. In practice:
- See and correct: everything is visible and editable in the app.
- Take it with you: menu → 📦 Export data gives you the whole database, as a SQLite file, an SQL dump, or a set of CSV files for Excel.
- Delete it: menu → 🗑 Delete all my data (see below).
- Anything else: email [email protected]. You will get an answer within one month.
You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work.
8. Deleting your account
Menu → 🗑 Delete all my data. You confirm by typing DELETE. This removes, immediately and permanently: every diary entry, your progress photos, your lab results, any wearable connection stored in your account, all backup copies of your diary on the server, and your account itself. You are then signed out. The offsite backup copies follow within about 24 hours (section 6). This cannot be undone, so export your data first if you want to keep it.
9. Cookies and storage on your device
The app sets one cookie, which keeps you signed in for up to 30 days. It is strictly necessary, so no cookie banner is needed. There are no advertising or analytics cookies, and no tracking of any kind.
Your browser also keeps a few display preferences on your own device (for example which sections you have collapsed), plus a cached copy of the app's design files so pages load faster. Your diary entries are not stored on your device.
10. Security
Accounts are invite-only and sign in through Google, so there are no passwords to steal. Each person's data lives in a separate database file. All traffic is encrypted, and backups are checked for integrity every night. No system is perfectly secure; if a breach ever affected your data, you would be told without undue delay.
11. Not a medical service
Daily Health Tracker is a diary. It does not diagnose, treat or give medical advice. See the Terms of Service.
12. Age
The app is not intended for anyone under 16.
13. Changes to this policy
If this policy changes in a way that matters, you will be told in the app or by email before the change takes effect. The date at the top always shows the current version.