Headrest Privacy Policy
This policy explains what information Evolui AB ("Evolui", "we", "us") collects when you use the Headrest app, how we use it, and the choices you have.
The data controller is Evolui AB, corporate identity number 559345-8705, Pildammsvägen 95F, 215 34 Malmö, Sweden. You can reach us at support@evolui.io.
The short version
Your migraine history stays on your iPhone. We never see it, never sell it, and never use it for ads.
- What you enter in Headrest stays on your device unless you choose to export or share it.
- We do not sell your data and we do not show ads.
- We collect limited, pseudonymous usage analytics to see which features work and to fix crashes. They never include the content of your entries.
- Purchases go through Apple. We never see your card details.
What Headrest stores and sends
Your migraine data
The attacks, symptoms, head zones, triggers, medications and notes you log are health information. They are stored only on your iPhone. We cannot see them and they are not uploaded to us. Deleting the app, or using Reset in Settings, deletes them.
Onboarding answers
During setup you answer questions about your migraines, such as how often they happen, your diagnosis and medications. These answers are stored on your device to personalise the app. They are not sent to analytics.
Location and weather
If you allow it, Headrest reads your approximate location on your device and sends those coordinates to the Norwegian Meteorological Institute (MET Norway) to fetch the barometric pressure forecast used in your migraine risk forecast. MET Norway receives no identifier for you, and your location is never sent to us or stored on a server. You can decline location access and choose a city instead; a typed city is resolved to coordinates by Apple’s built-in location service on your device.
Apple Health
If you connect Apple Health, Headrest reads sleep and menstrual cycle data to improve your risk forecast. This data is used only on your device, is never sent to us or any third party including analytics, and is never used for advertising or sold. You can revoke access at any time in the Health app under Sharing.
Reports
When you export a report for your doctor, it is generated on your device and shared through the iOS share sheet to the destination you choose.
Notifications
If you allow notifications, reminders are scheduled locally on your device. We do not run a push notification server.
Information we collect
Usage analytics
We use PostHog to understand how Headrest is used. This includes events such as which screens are opened and which features are used, along with device type, operating system version, app version, and a random identifier for the install. Analytics are pseudonymous: we have turned off PostHog's IP-based location lookup, and we do not send the content of your entries or any health values to analytics.
Purchases
Subscriptions and one-time purchases are processed by Apple through the App Store. We use RevenueCat to validate purchases and manage subscription status. RevenueCat receives a random app user identifier, the purchase receipt, and subscription status. Neither we nor RevenueCat receive your name, payment card, or Apple ID.
Support
If you email us, we keep the email and the information you include in it so we can help you and improve the app.
Crash reports
If the app crashes, a report containing technical details about the device and the state of the app may be sent to us or to Apple, depending on your device settings.
What we do not collect
- Headrest does not require an account, name, or email.
- We do not collect precise location or track you across other apps or websites.
- We do not read your contacts, photos, or other apps' data unless a specific feature asks you for permission.
- We do not use third-party advertising SDKs.
How we use information
We use the information above to operate the app, provide purchases you make, fix bugs, understand which features are useful, and respond to support requests. Where the GDPR applies, our legal bases are performance of a contract (providing the app and your purchases), our legitimate interest in improving and securing the app (analytics and crash reports), and your consent where we ask for it, for example for location or Apple Health access.
Sharing
We share information only with the service providers named in this policy, who process it on our behalf, and with authorities where the law requires it. We do not sell personal information. The providers for Headrest are:
- PostHog — usage analytics
- RevenueCat — purchase validation and subscription status
- Apple — App Store purchases and crash reports
- MET Norway — weather and barometric pressure forecasts
International transfers
We are based in Sweden. PostHog and RevenueCat process data in the United States under the EU-US Data Privacy Framework and standard contractual clauses. MET Norway is based in Norway (EEA).
Retention
Data on your device stays until you delete it. Pseudonymous analytics data is kept for a limited period and then deleted or aggregated. Purchase records are kept for as long as needed to provide your subscription and meet accounting obligations.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or export personal information we hold, and to object to or restrict its processing. Because your data lives on your device, the quickest way to delete it is to delete the app. For anything we hold, email support@evolui.io and we will respond within 30 days. If you are in the EU or UK you can also complain to your data protection authority. In Sweden this is the Integritetsskyddsmyndigheten (IMY).
Children
Headrest is not directed at children under 13 (or 16 where that is the applicable age) and we do not knowingly collect information from them.
Security
Data on your device is protected by your device's own encryption and passcode. Data sent to our service providers is encrypted in transit.
Changes
We will post any changes here and update the date at the top. If a change is significant we will tell you in the app.