Private migraine tracker: keeping your diary off other people's servers
A migraine diary is a list of the days you could not work, the medication you take, and the things that set your head off. It is medical data about a chronic condition, and it is worth knowing where it ends up before you spend two years filling it in.
The short version. Look for four things on the App Store listing and in the app's first screen: a privacy label that reads Data Not Collected, no account to sign up for, storage described as on-device or your own iCloud, and an export and a delete button you can find without emailing anyone. Everything else is a promise; those four are architecture.
Why a headache diary is more sensitive than it looks
Taken one entry at a time, it is unremarkable. Taken over two years it is a detailed picture of a chronic illness: how many days a quarter you are unable to work, which prescription medication you take and how often, what your employer would call absence, and a rhythm precise enough to be recognisable on its own.
None of that is a reason not to keep a diary. Keeping one is the single most useful thing you can bring to a neurologist. It is a reason to care which computer it lives on.
Read the App Store privacy label first
Scroll down any App Store listing to App Privacy. Apple makes every developer declare what their app collects, and the declarations fall into three buckets that are worth learning to read:
- Data Not Collected. Nothing leaves the device for the developer. This is the only label that means what you hope it means.
- Data Not Linked to You. Something is collected, but the developer says it is not tied to your identity. Common, and usually analytics.
- Data Linked to You and Data Used to Track You. Your entries, or facts about them, sit on someone's server attached to you, and in the last case follow you across other companies' apps and sites.
A migraine tracker declaring Health & Fitness under "Data Linked to You" is not necessarily doing anything wrong; it is telling you it has a copy of your diary. That is a fact about the product, not a rumour, and it is printed on the listing before you install.
The five questions that actually separate apps
- Do I have to create an account? An account exists because there is a server, and a server exists because there is a copy. No account is the strongest single signal on this list.
- Where does it say my entries are stored? "On your device" and "in your iCloud" are different from "securely in the cloud", which is a sentence about encryption, not about ownership.
- What does it do with my data if I never pay? A free app with no purchases and no ads is being funded somehow.
- Can I get everything out? A CSV export inside the app means your diary is not hostage to the app still existing in five years.
- Can I delete everything, right now, myself? Not a support ticket. A button.
Three architectures, and what each one means for you
| Architecture | Where the diary lives | What it costs you |
|---|---|---|
| Account and app server | The maker's database, attached to your email | Log in from anywhere and share with a community. In exchange, a copy exists that you do not control, outlives the app on your phone, and can be breached, sold with the company, or handed over |
| Local only | One device, nowhere else | Nothing to leak at all. In exchange, a lost or replaced phone is a lost diary, unless you exported it |
| Local first, your own iCloud | Your device, plus your private iCloud database | Survives a new phone and stays out of the maker's reach. In exchange, you rely on Apple's terms rather than the maker's |
The third is the one most single-purpose iPhone health apps should use, and the one worth looking for: it uses CloudKit's private database, which puts the sync copy inside your own iCloud account rather than in a database the developer can query.
The exceptions worth naming out loud
Almost no app is absolutely nothing-leaves-the-phone, and the ones that claim it usually mean "almost". The honest version is a short, named list:
- Purchases. If an app sells anything, something has to know whether you bought it. That is usually Apple, sometimes plus a purchase-management service that sees an anonymous ID and Apple's transaction data.
- Crash reports. Apple's own crash reporting is opt-in for you and shows the developer stack traces, not your entries.
- Anything you send on purpose. A PDF you AirDrop, a CSV you email yourself, a screenshot in a support message.
What matters is whether the list is short, named and findable. "We may share data with third-party partners" is not a list; it is the absence of one.
What you give up, honestly
Keeping a diary off a server rules out some real things: comparing your numbers against thousands of other people, a community feed, a web dashboard you open on a laptop, and anything that trains a model on your history. If one of those is why you want a tracker, a server-backed app is the right choice and the trade is a fair one to make knowingly.
It does not rule out much else. Logging, charts, calendars, medication limits, MIDAS and a printable report are all arithmetic a phone does perfectly well without help.
How Umbra is built
- No account, no email. There is nothing to sign up for and Umbra never asks who you are
- No Umbra server. Entries live on your iPhone and, with sync on, in your own iCloud through Apple's private database
- App Store privacy label: Data Not Collected. No ads, no tracking, no third-party SDK that touches your entries
- The doctor report is rendered on the device and handed to the share sheet. It is not uploaded anywhere
- CSV export and full deletion from Settings, in one tap each, with no support ticket and no waiting period
- One named exception: RevenueCat keeps track of whether Pro is active, and receives an anonymous ID and Apple's transaction data. Never your health entries. That is the whole list
The privacy policy says the same thing at greater length, and the about page says who is behind it.
Quick answers
What makes a migraine tracker private?
Architecture, not a promise in a policy. No account to create, entries on your device, sync only through your own iCloud, no analytics on what you log, and export and delete buttons inside the app. If a maker has no copy of your data, there is nothing they can lose, sell or be compelled to hand over.
Is iCloud sync less private than one device and no copy?
It is a different trade, not a worse one. With CloudKit's private database the copy sits in your own iCloud account and the app's maker cannot read it, which is not the same as an app server holding your entries next to everyone else's. The alternative means a lost phone is a lost diary.
What happens to my data if I delete the app?
With a local-first app it goes with it, which is why exporting a CSV first is worth the ten seconds. Anything in your own iCloud is removed with the app's iCloud data from iPhone Settings. With a server-backed app, deleting the app deletes nothing: the account and its copy stay until you ask for them to be erased.
Does private mean fewer features?
It rules out community feeds, population comparisons and web dashboards. It does not rule out logging, crisis-friendly design, charts, medication limits, MIDAS or a PDF report.
A diary with nothing to leak
Umbra keeps every entry on your iPhone and in your own iCloud, renders the doctor report on the device, and has no account to create. Free to log, for good.
This guide is for information only and is not medical advice, legal advice or a security audit of any particular app. Umbra is not a medical device. Talk to your doctor about your symptoms, your medication and anything you notice in your history.