Privacy Policy

Last updated: October 26, 2026

MyGrain ("the app") is developed by Alfonso Matos. This policy explains what data the app collects, why, the legal basis for processing it, and what rights you have over it.

Data we collect

  • Account data (optional): if you create an account, the email address you sign in with.
  • Anonymous use: you can use MyGrain without creating an account. In that case the app opens an anonymous session (via Firebase Authentication) so your entries can be stored securely on our servers. If you later create an account, or sign in to an existing one from an anonymous session, the data recorded anonymously is merged into that account through a secure process, with nothing lost or duplicated.
  • Health data you enter: your migraine episodes — type, intensity, symptoms, pre-symptoms, triggers, treatments, places and notes — plus the daily habits you choose to track and the medical appointments you add (date, place, doctor, specialty, your questions for the visit and your notes afterwards). This is health data under Article 9 of the GDPR and is only stored after you give explicit consent, requested via a dedicated consent screen before you can use the relevant features.
  • Approximate location: if you set a city in your profile, MyGrain looks up the weather for that city (not your device's precise location) and stores the weather of each day — pressure, temperature, sunshine, rain and humidity — in your cloud diary, to compare it with your episodes. The city stays on your phone: it is not stored on our servers. We do not request location permissions or store GPS coordinates. The lookup goes to the Open-Meteo weather service, which receives the city name and the coordinates of its centre, with no account or device identifier.
  • Notifications (optional): MyGrain only sends notifications you switch on in Profile → Notifications, one switch per type, all off by default. To deliver them, Google Firebase Cloud Messaging assigns your phone an installation token, which we use only to subscribe it to topics: one per type you enabled, plus, for the barometric pressure alert, a ~50 km weather area derived from your city, and the app language. Our servers store only that weather area (a rounded grid cell, not your city or exact coordinates) and the language, with no account, device identifier or health data attached; your city stays on your phone. The standard alert (free) is computed on our servers from public weather forecasts and does not use your episodes. With Premium you can also switch on a personalised pressure alert: it is calculated on your phone from your diary and the public forecast for your weather area (requested from Open-Meteo for the coordinates of that area, with no account or device identifier) and shown as a notification created on the phone itself. Your diary is not sent to any server, and while the personalised alert is on it replaces the standard one. You can switch any notification off at any time in the app or in your phone settings, and the topics are then removed.
  • Migraine news: the news section downloads its articles from mygrain.app, like any web page request. No personal data is sent with it beyond what any web request carries (such as your IP address): nothing from your diary or your account.
  • Website statistics: mygrain.app counts page visits with Cloudflare Web Analytics, which uses no cookies, does not store your IP address and does not identify or follow you across sites. We use it only to know how many people reach the site and from which link (for example, our social media profiles).
  • Sleep and activity from your watch (optional): with your explicit permission, MyGrain reads sleep, steps and exercise sessions from Apple Health (HealthKit) on iPhone or from Health Connect on Android. It only reads, never writes. The values for the night and the day before each episode (hours of sleep, bedtime and wake-up time, steps) are stored with that episode, under the same consent as the rest of your diary, and are used for one thing: showing them to you and comparing them with your own history. They are never shared with third parties except the processors described below (Google Firebase stores them for us), never sold, never sent to analytics and never used for advertising. You can revoke access at any time in Health or Health Connect settings, and deleting your account deletes them with everything else. To compare your sleep schedule with your episodes, MyGrain also reads your nights of the last few months, but only on your phone: those nights are not stored.
  • Feedback: if you send feedback from Profile → Send feedback, we receive the message you write together with technical context about your app session — app version, operating system, device model, screen size, language and whether you were signed in — to help us diagnose issues.
  • Diagnostics: MyGrain uses Firebase Crashlytics for crash reports and Firebase Analytics for usage statistics. Both start only after you accept this policy, stop if you decline or withdraw consent, and never receive health data (no episode types, symptoms, sleep or steps) nor anything for advertising.

Legal basis for processing

Storing the health data described above (episodes, treatments, habits) relies on your explicit consent under Article 9(2)(a) GDPR, requested inside the app before this data is first stored. Diagnostics (crash reports and anonymous analytics) rely on our legitimate interest in keeping the app secure, stable and functional. You may withdraw your consent at any time by deleting your data as described below.

Using the app without an account

MyGrain works without registering: your entries are kept in an anonymous session tied to your device. This lets you try the app fully before deciding to create an account. If you create an account afterwards, or sign in to an existing one, all data recorded during the anonymous session is merged into it automatically, with nothing lost or duplicated.

How we use your data

Your data is used for one purpose: showing you your own history and statistics. MyGrain stores your migraine data securely in the cloud so your history is kept over time and comes back on a new device. Your data is never sold, and is never shared with third parties except the processors described below.

Where it is stored

Data is stored using Google Firebase (Google Cloud Platform), protected by authentication and transferred over encrypted connections. Where data is processed outside the European Economic Area, Google's Standard Contractual Clauses apply as the transfer safeguard. Payments for Premium are processed entirely by Apple (iPhone) or Google (Android) under their own privacy policies; we never see your payment details.

How long we keep it and how to delete it

We keep your data for as long as you use MyGrain. You can permanently delete your account and all associated data at any time from Profile → Delete account. This triggers a cascade deletion of your episodes, treatments, habits, medical appointments, feedback messages and preferences from our servers. Deletion is immediate and irreversible.

Your rights (GDPR)

  • Access: your full history is always visible in the app and exportable as a PDF report (Premium) and as a CSV file (free).
  • Rectification: you can edit or correct any entry directly in the app at any time.
  • Deletion: delete all your data at any time from Profile → Delete account, as described above.
  • Portability: export your whole diary as a CSV file from Reports (free); for anything else, contact us.
  • Objection and withdrawal of consent: you may object to processing or withdraw consent at any time by deleting your data or contacting us.

To exercise any of these rights, contact us at support@mygrain.app.

Medical disclaimer

MyGrain is a personal health diary, not a medical device. It is not a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of your physician or other qualified health provider with any questions you may have regarding a medical condition.

Our social media accounts: publishing to YouTube and TikTok

MyGrain uses YouTube API Services and the TikTok Content Posting API only to publish our own videos to our own official accounts (@mygrainapp). Publishing is done by the developer from https://mygrain.app/studio, a restricted-access tool limited to an allowlist of accounts. No data from the users of the app is sent to YouTube or TikTok, and app users are not affected by this feature.

When we connect one of our own accounts, we store only the OAuth access token, the channel or account name and its avatar. This data is kept on Google Cloud / Firebase servers in the European Union, is used solely to publish our videos and is never shared with third parties except Google Cloud, which stores it for us. It is deleted when the account is disconnected or access is revoked, and the tokens are deleted within 30 days at most.

This feature uses YouTube API Services. By using it, the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy) apply. You can revoke MyGrain's access to a Google account at https://myaccount.google.com/permissions. For TikTok, see the TikTok Privacy Policy (https://www.tiktok.com/legal/privacy-policy).

Changes to this policy

If this policy changes, the new version will be published on this page with an updated date at the top.