Last updated 8 October 2026

Privacy Policy

Quiet Atlas is a personal headache journal created by Sansavision. You can use the journal on this iPhone without creating an account. A subscription is required after onboarding. This policy explains what stays on the device, what optional services you can turn on, and what we never do.

Privacy at a glance

Local firstYour journal stays on this iPhone unless you deliberately use an optional cloud feature.

No account to logCore headache logging and export work without creating a Quiet Atlas account.

No sale or ad trackingWe do not sell personal data, share it for cross-context behavioural advertising, or build advertising profiles.

You stay in controlYou can export local records and delete the optional remote account and encrypted backup.

Data practices matrix

This table is the short version. “Optional” means the information leaves the phone only when you enable or use the described feature.

Information	When collected	Purpose and legal basis	Where shared	Retention
Journal and health details	Stored locally when you enter them. An encrypted copy is uploaded only if you use backup.	Provide the journal and requested backup service; contract. HealthKit and weather access require your permission.	Local device; encrypted backup bytes to Cloudflare R2. We cannot read the backup contents.	On-device until you delete or reset it. Remote backup until you delete it or the account.
Email, account ID and optional password hash	Only if you create an optional account. A password is optional and can be set after email verification.	Authenticate you and provide backup/restore; contract.	Cloudflare account database and email delivery infrastructure.	For the account’s life, then deleted or retained only where law requires.
Session and security data	On successful sign-in: IP address, time, device/browser details, and IP-derived coarse city/region/country/timezone.	Protect sessions and send sign-in notices; legitimate interests.	Cloudflare as service provider.	Sessions normally expire after 30 days; expired records are normally removed within 24 hours.
Email abuse-prevention counters	When a magic link or one-time code is requested.	Prevent repeated or abusive email sending; legitimate interests.	Cloudflare as service provider. Network addresses and recipient addresses are represented only by one-way SHA-256 hashes in these counters.	Counters reset after 15 minutes and expired rows are normally removed by the next daily cleanup.
Location and weather context	Only when Sky Watch is enabled and iPhone location permission is granted.	Attach the weather/pressure context you requested; consent.	Weather service receives the location needed for the request; journal context remains local unless encrypted backup is used.	Journal context follows your local/backup retention. Permission can be withdrawn in iOS Settings.
Purchase information	When you buy or restore a subscription.	Verify entitlement, restore access, prevent fraud, and meet legal obligations; contract and legitimate interests.	Apple processes payment; our service receives transaction/product identifiers and active status, not full card details.	For entitlement and legally required accounting/dispute periods.

What the app stores on your phone

Episode timestamps, optional pain, location, symptoms, notes, medications, outcomes, weather context, and settings live in a local SQLite database on the device. Missing days stay unknown. They are never converted into headache-free days.

What does not require an account

Marking a headache, adding details later, confirming a headache-free day, and exporting your journal never wait on sign-in. After onboarding, a subscription is required to keep using the app. You can still do that on this iPhone without creating an account.

Optional account and encrypted backup

You can sign in with a magic link, one-time code, or an optional password. We store your email address to authenticate you. If you set a password, we store its cryptographic hash, not the password itself. Setting or resetting a password requires a code sent to your verified email address and revokes existing sessions. Optional cloud backup is encrypted on the device before it is uploaded. The backup recovery passphrase is separate from the account password and is not sent to us. We cannot read the contents of that backup. You can delete the remote account, its credentials, and backup from Profile.

Sign-in security information

When a sign-in succeeds, we store the sign-in time, IP address, device or browser information, and an approximate city, region, country, and timezone supplied by Cloudflare from the network connection. We use this information only to create and protect your account session and to email you a successful-sign-in security notice. Our legal basis is our legitimate interest in preventing and detecting unauthorized account access.

This approximate sign-in location does not use the iPhone's GPS, Apple Location Services permission, or the location used for optional weather context. We do not retain precise coordinates or Cloudflare data-centre identifiers. Account sessions normally expire after 30 days. Expired session and verification records are deleted by a daily cleanup, normally within 24 hours after expiry. Deleting your account removes its session security records sooner.

To prevent email abuse, sign-in requests are rate limited by network address and recipient email. Both are represented by one-way SHA-256 hashes in the rate-limit counters, so those keys contain neither the readable email address nor network address. These short-lived counters reset after 15 minutes and expired rows are normally removed by the next daily cleanup.

Cloudflare processes network requests and hosts the account session database on our behalf. Authentication emails are delivered through Cloudflare's email infrastructure. These providers receive only the information needed to deliver and secure these services.

Health, location, and notifications

Apple Health sleep is off until you turn it on. Quiet Atlas reads last night's sleep only. It does not write health records.
iPhone location permission is used only to attach local weather and pressure context when Sky Watch is enabled. It is separate from the approximate network location described under sign-in security.
Notifications are the reminders you enable. Health reminders never include subscription marketing. Lock-screen previews stay generic unless you opt in to details.

What we do not do

We do not sell health data.
We do not build advertising profiles from your journal.
We do not diagnose, prescribe, or predict attack risk.
We do not require an account to log. Raw export stays available in Profile while you have access on this iPhone.

Children

Quiet Atlas is not directed at children under 13. Do not create an account for a child under 13.

Who we are

Quiet Atlas is published under the Sansavision brand. Sansa Group AB, Gothenburg, Sweden, is the legal entity responsible for the service and the controller of personal data described in this policy.

GDPR and European privacy rights

If the GDPR, UK GDPR, or similar European law applies, Sansa Group AB is the controller for account and service data. Depending on the processing, we rely on performance of our contract, your consent, our legitimate interests in service security, or a legal obligation. When consent is the basis, you may withdraw it at any time without affecting earlier lawful processing.

You may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may also complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority. We normally respond within one month, subject to identity verification and lawful exceptions. Cloudflare and other service providers may process data outside the EEA; where required, transfers use recognized safeguards such as contractual protections.

California privacy rights

California residents may request access to the personal information and categories we hold, correction, deletion, and a portable copy, subject to verification and legal exceptions. You may use an authorized agent, and we will not discriminate against you for exercising a privacy right.

We do not sell personal information, share it for cross-context behavioural advertising, offer a financial incentive for personal data, or use sensitive personal information to infer characteristics about you. Health and precise-location information is used only to provide features you request. Because we do not sell or share personal information in the California-law sense, there is no sale/sharing opt-out to action. We normally respond to a verified California request within 45 days.

How to make a privacy request

Delete the remote account and encrypted backup from Profile, or email support@sansavision.com with “Quiet Atlas privacy request.” Tell us which right you want to use and the email associated with the optional account. We may ask for reasonable verification, but never ask for your one-time code, magic-link token, recovery passphrase, or full payment details.

Contact

Privacy questions and requests: support@sansavision.com.