Privacy Policy

Last updated: September 12, 2026

MyGrain ("the app") is developed by Alfonso Matos. This policy explains what data the app collects, why, the legal basis for processing it, and what rights you have over it.

Data we collect

  • Account data (optional): if you create an account, the email address you sign in with.
  • Anonymous use: you can use MyGrain without creating an account. In that case the app opens an anonymous session (via Firebase Authentication) so your entries can be stored securely on our servers. If you later create an account, or sign in to an existing one from an anonymous session, the data recorded anonymously is merged into that account through a secure process, with nothing lost or duplicated.
  • Health data you enter: your migraine episodes — type, intensity, symptoms, pre-symptoms, triggers, treatments, places and notes — and the daily habits you choose to track. This is health data under Article 9 of the GDPR and is only stored after you give explicit consent, requested via a dedicated consent screen before you can use the relevant features.
  • Approximate location: if you enable weather correlation, MyGrain looks up weather conditions for the city you set in your profile (not your device's precise location) so it can relate weather to your episodes. We do not request device location permissions or store GPS coordinates for this feature. The lookup goes to the Open-Meteo weather service, which receives only the city name — no account or device identifier.
  • Sleep and activity from your watch (optional): with your explicit permission, MyGrain reads sleep, steps and exercise sessions from Apple Health (HealthKit) on iPhone or from Health Connect on Android. It only reads, never writes. The values for the night and the day before each episode are stored with that episode, under the same consent as the rest of your diary, and are used for one thing: showing them to you and comparing them with your own history. They are never shared with third parties except the processors described below (Google Firebase stores them for us), never sold, never sent to analytics and never used for advertising. You can revoke access at any time in Health or Health Connect settings, and deleting your account deletes them with everything else.
  • Feedback: if you send feedback from Profile → Send feedback, we receive the message you write together with technical context about your app session — app version, operating system, device model, screen size, language and whether you were signed in — to help us diagnose issues.
  • Diagnostics: MyGrain uses Firebase Crashlytics for crash reports and Firebase Analytics for usage statistics. Both start only after you accept this policy, stop if you decline or withdraw consent, and never receive health data (no episode types, symptoms, sleep or steps) nor anything for advertising.

Legal basis for processing

Storing the health data described above (episodes, treatments, habits) relies on your explicit consent under Article 9(2)(a) GDPR, requested inside the app before this data is first stored. Diagnostics (crash reports and anonymous analytics) rely on our legitimate interest in keeping the app secure, stable and functional. You may withdraw your consent at any time by deleting your data as described below.

Using the app without an account

MyGrain works without registering: your entries are kept in an anonymous session tied to your device. This lets you try the app fully before deciding to create an account. If you create an account afterwards, or sign in to an existing one, all data recorded during the anonymous session is merged into it automatically, with nothing lost or duplicated.

How we use your data

Your data is used for one purpose: showing you your own history and statistics. MyGrain stores your migraine data securely in the cloud so your history is kept over time and comes back on a new device. Your data is never sold, and is never shared with third parties except the processors described below.

Where it is stored

Data is stored using Google Firebase (Google Cloud Platform), protected by authentication and transferred over encrypted connections. Where data is processed outside the European Economic Area, Google's Standard Contractual Clauses apply as the transfer safeguard. Payments for Premium are processed entirely by Apple under its own privacy policy; we never see your payment details.

How long we keep it and how to delete it

We keep your data for as long as you use MyGrain. You can permanently delete your account and all associated data at any time from Profile → Settings → Delete account. This triggers a cascade deletion of your episodes, treatments, habits, feedback messages and preferences from our servers. Deletion is immediate and irreversible.

Your rights (GDPR)

  • Access: your full history is always visible in the app and exportable as a PDF report.
  • Rectification: you can edit or correct any entry directly in the app at any time.
  • Deletion: delete all your data at any time from Profile → Settings, as described above.
  • Portability: request a machine-readable export of your data by contacting us.
  • Objection and withdrawal of consent: you may object to processing or withdraw consent at any time by deleting your data or contacting us.

To exercise any of these rights, contact us at support@mygrain.app.

Medical disclaimer

MyGrain is a personal health diary, not a medical device. It is not a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of your physician or other qualified health provider with any questions you may have regarding a medical condition.

Changes to this policy

If this policy changes, the new version will be published on this page with an updated date at the top.