Simple-SymptomsPrivacy Policy
Last updated: October 24, 2026
Simple-Symptoms (“the app”) is made by Eric Purtteman (“we,” “us”). Questions about this policy: csr@simplesymptoms.app.
The short version
- Your symptom log, period days and medication list are encrypted on your phone.
- If you don't create an account, that data never leaves your phone.
- If you turn on backup, we store an encrypted copy we cannot read. Only your password or recovery code can unlock it.
- We don't sell your data, show ads, or use analytics or tracking tools.
What we collect
Without an account
Nothing. Your log is stored only on your device, encrypted with a key kept in your phone's secure storage (iOS Keychain or Android Keystore). Your appearance settings and the female, male or unisex display setting are also stored only on your phone.
With an account (optional backup)
| Data | Why | Can we read it? |
|---|---|---|
| Email address | To sign in, and to send sign-in codes and password reset codes | Yes |
| Encrypted backup of your log | So you can restore it on a new phone | No. It's encrypted on your phone before upload |
| Encrypted copies of your backup key | So your password or recovery code can unlock the backup | No |
| Two-step sign-in settings | To protect your account (for example, that you use an authenticator app) | Yes, but not your codes |
| Account timestamps (created, last backup) | To run the service | Yes |
Your password is never sent to us. The app turns it into a separate value for signing in, and our service provider stores only a hash of that value.
Medication name lookup
Medication suggestions use a list built into the app, so nothing you type leaves your phone. If you tap Search the full drug list, pick a medication from those results, or tap Look up common uses and side effects, the app sends only that medication's name to public U.S. government services to get matching names, strengths, uses and label side effects: the National Library of Medicine (clinicaltables.nlm.nih.gov and rxnav.nlm.nih.gov) and the FDA (api.fda.gov). No account details or other data are sent with these lookups.
Who processes data for us
- Supabase: database and sign-in. Servers in the United States.
- Resend: sends sign-in and password reset emails.
They process data only to provide these services to us.
Exports you make
When you share a PDF, spreadsheet or text summary, it goes wherever you send it, for example your email app. That copy isn't encrypted by us. Treat it like any medical record.
Keeping and deleting your data
- On your phone: Backup → Erase my data deletes everything stored on the phone. Uninstalling the app does too.
- Your account and backup: Backup → Delete account permanently deletes your account and backup right away. You can also ask by email. See Delete your account.
- Your backup is kept while your account exists. Copies in our provider's routine system backups are overwritten within about 7 days, and they stay encrypted the whole time.
Security
We use AES-256-GCM encryption, keys derived with PBKDF2-SHA256 (600,000 rounds), two-step sign-in, and database rules that let only you reach your backup. No system is perfectly secure. If you lose both your password and your recovery code, we cannot recover your backup.
Children
The app is not intended for anyone under 18.
Not medical advice
Simple-Symptoms is a personal diary. It doesn't diagnose or treat any condition. Medication information in the app is general and not complete. Talk to a healthcare professional about your health.
Changes
If we change this policy, we'll update the date above and let you know in the app.
Contact
Eric Purtteman · csr@simplesymptoms.app