Privacy Policy

You keep a private journal of your tinnitus. It belongs to you, it is tied to your account, and nobody else can read it.

Health content leaves the app in a few specific moments, and all of them are started by you:

• When a report is written the entries it covers are sent to an AI service to be read and summarised.
• When you email a report the finished PDF is delivered to the address you gave, and then it is out of our hands.
• When you download a report a copy is saved on your own device, ready to print or hand to a clinician.
• When you talk to Drummer your messages are processed by an AI service, and a short summary of a session can be kept on your account.

We never sell your data, never use it for advertising, and never share it with data brokers, employers, or insurers.

TinnitusTrack is a personal tinnitus journaling app. It is built and run by an individual, not a hospital or a health system, and it is not a healthcare provider.

This app is not a medical device and your journal is not a medical record. It is a tool for noticing your own patterns over time, and a way to bring that picture to a professional who can help you interpret it.

We collect what the app needs to work, and nothing more. In practice that means:

• Account details your email address, and your name if you give one. If you turn on reminders we also keep your reminder time, your timezone, and, if you opt in to text messages, your phone number.
• Your journal the entries you write: intensity, which ear, the sounds, how long it lasted, possible triggers, what helped on an easier day, sleep quality, mood, and any notes you type.
• Your preferences the language, appearance, and report settings you choose, so the app opens the way you left it.
• Reports you keep the PDF reports you choose to save to your account.
• Your conversations with Drummer the messages you exchange with the in-app assistant, kept so you can return to them.
• Files you import if you import an old spreadsheet or export of your entries, we read it to create the entries, and it is stored privately.
• Basic technical data which screens are used and roughly how often, if you allow analytics. This is aggregate and is not used to build a profile of you.

This is the section that matters most, so it is deliberately blunt. Your entries and notes are private to your account, but a few features necessarily involve sending health content somewhere else. Each of those moments is listed here, with what is sent and who receives it.

None of those requests carries anything that says who you are. An entry travels as the fields the feature needs and nothing else, taken from a fixed list, so your name, your email address, your phone number, and your account id are never included — not in the request, and not inside anything you typed into a note, a chat message, or a picture description. Contact details are stripped out of your own words before the request is made. What is sent is the health content itself, because that is what the feature is for: an AI cannot summarise a journal it has not read. If an identifier were ever to slip through, the request is refused rather than sent.

• The AI that writes your reports. When you create a report, the entries it covers are sent to a third-party AI service so it can read them and write the observations. That includes your notes, because notes are usually where the useful detail is. Only the entries in the report are sent, and only to produce the report.
• Reports you email. If you email a report instead of downloading it, the finished PDF is delivered through our email service to the address you gave. Once it arrives, it is in a mailbox we do not control: it can be forwarded, backed up, or read by anyone who can open that mailbox.
• Reports you download or hand over. A downloaded report is saved on your own device, usually in your Downloads folder. Anything you give to a doctor, clinic, or family member is then handled under their privacy practices, not this policy.
• Reports kept on your account. Reports you save are stored privately and opened only through a short-lived link created for you when you ask for them. They are never at a public address.
• Files you import. An import file is sent to the extraction service exactly as you uploaded it, because it has to be read to become entries. If an old export contains your name or other details, those travel with it; the entries it creates keep only your tinnitus fields.
• Your conversations with Drummer. Your messages are processed by an AI service so Drummer can answer. If a message reads as though you are in crisis, the app shows support and crisis contacts, and that check runs on your device first. A short summary of a session may be kept on your account so Drummer can remember it later; you can delete those conversations.
• Reminders. If you turn on reminders, our email service sends the email, and if you have opted in to text messages our messaging provider receives your phone number and the reminder text. Text messaging is off unless you deliberately turn it on.
• Pictures Drummer makes for you. If you ask Drummer for a drawing or a picture, the request text is sent to an image service to be created.
• The public demo. The demo runs on sample entries, and anything a visitor types there stays in their own browser. A sample report emailed from the demo contains only sample data, never a real person's entries.

What we never do: we do not sell your personal information or your health data, we do not use it for advertising, we do not share it with data brokers, employers, or insurers, and we do not use your entries to train AI models.

We rely on a small number of companies to run the app. They see only what their part of the job requires, and they may not use it for anything else:

• Hosting and database stores your account, your entries, and your kept reports, with access rules that tie every record to your account.
• Email delivery sends reminders, verification codes, and any report you ask us to email.
• Messaging delivers text-message reminders if, and only if, you have opted in.
• AI services read the entries in a report to write its observations, answer your messages to Drummer, and create any picture you ask for.
• Analytics counts visits in aggregate, and only when you have allowed analytics cookies.

We use two kinds of cookies. Essential cookies keep you signed in and keep the app secure; they cannot be switched off. Analytics cookies are optional, are used only in aggregate to understand which parts of the app are used, and are set only if you agree to them.

You can change your mind at any time by clearing this site's storage in your browser and revisiting, which brings the consent banner back.

Your entries are stored with access rules that scope every record to your account, so one person's journal is not readable by another. Reports you keep are held in private storage and opened only through a short-lived link created for you.

Nothing the app sends leaves any other way. There is no health content in a web address, a query string, a file name, or a log line, where whoever handles it in passing could read it: every request carrying health content goes as a direct server-side call to the service that needs it, and carries no identifier with it.

No system is perfect, and we cannot promise absolute security. What we can promise is that we collect as little as the app can work with, that we say plainly when something cannot be made anonymous, and that we do not spread it around.

Your entries, preferences, conversations, and kept reports stay for as long as your account exists, because that is what the app is for. You can delete any entry or any kept report yourself at any time, and you can delete the whole account in one step from your profile.

Rate-limiting counters, which exist only to stop abuse of email and messaging features, are cleared along with the account.

You are in charge of your data. In the app you can:

• See and correct it every entry you have written is visible and editable in the app.
• Take it with you generate a report at any time, or export your entries.
• Delete it delete single entries, kept reports, or your entire account.
• Refuse analytics accept or reject optional cookies, and change your mind later.
• Turn off reminders reminders are off by default and can be switched off whenever you like.

If you are a California resident, you have the rights to know what personal information we hold, to have it deleted, to opt out of its sale or sharing (we do neither), and to be treated the same whether or not you exercise those rights. If you are in the European Economic Area or the United Kingdom, you have equivalent rights of access, correction, erasure, restriction, portability, and objection. To exercise any of them, contact us through the in-app support feature.

Deleting your account from your profile permanently removes your entries, your notes, your conversations with Drummer, the reports you kept, and the account itself, and signs you out. After that the app no longer recognises you, and the address is free to sign up again later with an empty journal.

Two things are outside anyone's reach, and we would rather say so than pretend otherwise: a report already sitting in an email inbox or saved on a device, and any copy you gave to a doctor, clinic, or family member. Report files stored in your account become unreachable once the record that pointed to them is gone.

This app is not intended for children, and we do not knowingly collect information from anyone under 13 (or under 16 where local law sets that age). If you believe a child has created an account, contact us through in-app support and we will remove it.

We review this policy every six months. When something in it changes, we update the version and the date at the top of this page, and we tell you in the app: the next time you open TinnitusTrack you will see a short note explaining what changed and a link back here. Reminders like this arrive at most once every six months, so they stay noticeable rather than becoming background noise.

Continuing to use the app after a change means the updated policy applies to you. If you do not agree with a change, you can delete your account at any time.

Questions about this policy, or about your own data, can go through the in-app support feature. We will answer as clearly as we can, in plain language.