Privacy

Last updated 21 September 2026 · HeartGlance, by CircleRoll LLC

Your readings are taken on your phone, worked out on your phone, and stored on your phone. Nothing about your health leaves it unless you create an account and turn on backup and sync, which are two separate switches and both start off. Everything that does leave, in either case, is set out below in full.

What stays on your device

All of it. Specifically:

WhatWhere it lives
Heart rate readings, heart rate variability and the pulse trace behind each one The app's own database on the device
Blood pressure, blood oxygen, body temperature and weight you log, and how you felt on a reading The same database
Medications, doses, reminders and alert thresholds The same database
Your name, date of birth, sex, height and profile photo The same database and the app's private file storage
Camera frames during a reading Nowhere. They are read as they arrive and discarded. Nothing is recorded

What we collect

App crash reports, which screens get opened, and the record of a purchase you make. Nothing else, and never a reading. There is no advertising, no advertising identifier, no attribution or marketing software, and nothing is sold or shared with anyone for their own purposes.

Three services handle it, each acting for us as a processor. Google's Firebase Crashlytics tells us that the app fell over, on which model of phone, and at which line of code. Firebase Analytics and PostHog both receive the same short list of usage events — how many people finished setting the app up, took a reading, saw the subscription screen, or bought one — Firebase for the counts and PostHog for the product analytics, on servers in the United States. That is how a bug gets found without waiting for somebody to write in, and how we can tell whether a change made the app better or worse. RevenueCat verifies a purchase with the App Store or Google Play and keeps the subscription bookkeeping; what it receives is set out under When you buy a subscription below.

There is a hard limit built into the app rather than promised on this page, and Firebase and PostHog sit behind the same one. The only events the app is able to send to either are a fixed list — onboarding finished, reading taken, reading abandoned, reading trouble, blood pressure scanned, cuff scan limit reached, cuff dropped, paywall shown, purchase started, purchase completed, purchase failed, purchase restored, trial converted, subscription renewed, report exported, breathing finished, health sync enabled — and the only detail any of them may carry is one word from another fixed list, such as which plan, whether a file was a PDF or a CSV, or at which step a reading stopped (the camera was refused, or no finger was seen). There is no code path that can attach a number to any of them, so a heart rate, a variability figure or a blood pressure cannot reach us even by mistake.

One of those events can also reach PostHog from our own server rather than from the app. The App Store and Google Play charge for a renewal with the app closed, and they tell us rather than telling it: the app counts subscription renewed when it is next opened, which misses anybody who does not open it again, so the server counts it as well. A count is all it is. The server's copy carries no identifier of any kind — neither your account's nor the one belonging to this installation — so it records that a renewal happened and nothing whatever about whose it was. It is the only event described here that the switch below cannot stop, because it is not sent from your phone; it is also the only one that could not name you if it tried.

You can turn off everything your phone sends. Open Me → Privacy and Data and switch off Send app crash and usage reports. Anything not yet sent is deleted, and nothing further is collected from your phone; PostHog also forgets the identifier it had given this installation, so nothing gathered before can be joined to anything after. The server's anonymous renewal count, in the paragraph above, is the one thing the switch does not reach — because it never came from your phone, and names nobody. On iPhone, with the switch off neither piece of reporting software is started at all. The switch covers reporting, not purchases: the record of a purchase is kept whether the switch is on or off, holds nothing about your health, and is described below.

Each service attaches an identifier that belongs to this installation of the app — Firebase's installation ID, PostHog's anonymous ID, RevenueCat's app user ID — so two crashes can be recognized as coming from the same phone, or a purchase as belonging to the same installation. None of them is your name, your email, your device's advertising identifier, or anything that follows you into another app, and each goes with the app when you delete HeartGlance. The one exception is deliberate: once you sign in, RevenueCat's identifier becomes your account's random identifier instead, which is how a subscription bought on one phone is recognized on another.

Backup and Sync, if you turn it on

Off unless you switch it on, and there are two switches, not one. Creating an account does not move anything: an account on its own only lets a subscription be recognized on a second device. Your readings stay on your phone until you go to Me → Backup and Sync and turn on Keep a copy in my account. That is the moment health data first leaves the device, and nothing before it does.

With it on, these are copied to your account and kept in step across your devices: heart rate readings and the variability and pulse trace behind them, how you felt on each one, blood pressure, blood oxygen, body temperature, weight, breathing sessions, reminders, medications with their dose schedules and the doses you marked as taken, and the profile fields the comparisons need — first name, date of birth, sex, height.

The account lives on Supabase, in Postgres, encrypted at rest and in transit. Every table is protected by row level security tied to your account: a query made with anyone else's session returns nothing, not a filtered list. That is enforced by the database, not by our code, and the file that sets it up is in the repository as supabase/migrations/0001_init.sql so it can be read rather than taken on trust. We do not sell it, share it, or use it for advertising, and there is no advertising in this app to use it for.

Deleting an account really deletes it. Me → Privacy and Data → Delete my account erases the account and everything attached to it, immediately, with no copy kept for us to change our minds about. Signing out is a different thing and says so: it forgets the account on that phone and leaves every reading exactly where it is.

A reading you delete on one phone is deleted on the server and on your other phones. The record that it was deleted is itself removed after 90 days, by which time every device has certainly seen it.

The six times something leaves your device

1. When you turn on Apple Health or Health Connect

Off until you switch it on. Once on, HeartGlance writes your readings into your phone's own health store and reads blood pressure, oxygen, temperature and weight back out of it so you do not have to type them twice. That store belongs to your phone and to you; we never see it. You can revoke the permission at any time in Apple Health or Health Connect, and HeartGlance keeps working.

2. When you write to us

The Help screen composes a message in your phone's own mail app, addressed to hello@heartglance.app, with the app name and a ticket number in the subject. Nothing is sent until you press send, and what you send is exactly what you can see. The form on this website's Contact page stores what you typed — topic, name, email address and message — together with a salted hash of your network address (for limiting how many messages one address can send) and your browser's identification string, and emails it to that same mailbox through Resend, the email service we use as a processor. We keep messages for as long as it takes to answer them and up to twelve months afterwards, so a follow-up question has context.

3. When you buy a subscription

The purchase itself is made with Apple's App Store or Google Play. They tell the app whether a subscription is active; they do not tell us who you are, and we never see or handle your payment details. Their own privacy policies cover that transaction.

Once the store has completed a purchase, the app passes the store's record of it to RevenueCat, acting for us as a processor under its own privacy terms. RevenueCat verifies the purchase with the store and keeps the subscription bookkeeping — which plan, since when, until when. What it receives is the store's receipt or transaction for the purchase, the product bought, the price, currency and country as the store reports them, an identifier for this installation, and — only when you are signed in — your account's identifier, which is a random UUID and not your email. Never a reading, and never your name. The store remains the authority on whether a subscription is active; RevenueCat records what the store has already done.

4. When you turn on backup and sync

Set out in full above. Off until you switch it on, and switched off again the moment you say so.

5. When you share with someone

Off until you invite somebody. Sharing sends the person you name a summary — a status and a trend for each topic you chose to share, never a reading and never a number with a unit — through your account. To do that we store the email address you invite and match it to their account when they accept, and each side's first name so the other knows who it is. A push notification tells them of the invitation and, if you both chose it, of an alert; it goes through Apple's and Google's push services and carries no measurement. Stop sharing at any time and the summary stops being readable in the same moment.

6. When the app crashes, or you use a screen

Described in full above. Crash diagnostics go to Google Firebase, and the short list of usage events to both Firebase and PostHog, each acting for us as a processor under its own terms (Firebase, PostHog). No reading is included, no advertising identifier is collected, and the switch in Me → Privacy and Data stops both.

Accounts

You do not need one. The app works fully without ever signing in. If you do create one, your email address and a hash of your password (never the password itself) are held by our authentication provider, Supabase, in the account that Backup and Sync, Sharing and subscription recognition hang on; a forgotten-password code is emailed to that address. Sign in with Apple or Google, where offered, returns only the identifier the provider chooses to share, and Apple's private relay means we may never learn a real address.

Deleting your HeartGlance account

In the app: Me → Privacy and Data → Delete my account, then confirm. That is the whole procedure; there is no form to fill in and no email to send, and it takes effect the moment you confirm.

What is deleted: the account itself, your email address and sign-in, and every row attached to the account — readings and the pulse traces and variability behind them, how you felt on each one, blood pressure, blood oxygen, temperature, weight, breathing sessions, reminders, medications and taken doses, the profile fields, the push token, the subscription record, and every share you have sent or received, which stops at that moment.

What is kept: nothing on our servers. The readings on your phone stay on your phone, because they were never ours; delete the app to remove those too. The record that a row was deleted is itself removed after 90 days, once every device has seen it, and crash reports already sent carry no account and cannot be traced back to you. The one thing that outlives the account is the purchase bookkeeping RevenueCat keeps for us, filed under the account's random identifier and nothing else — from that moment an identifier that points at no one; it is covered by the right of erasure under Your rights.

If you can no longer open the app, write to hello@heartglance.app from the address on the account and we will delete it for you within seven days.

Watches

The Apple Watch app reads the heart rate your watch has already recorded, through Apple Health on the watch itself. It does not take readings and it writes nothing back. A reading taken on a Wear OS watch is passed to the phone over Google's on-device wearable link. Both of those are connections between two devices you own. Neither goes through us.

Bluetooth cuffs

If you pair a Bluetooth blood pressure cuff, the app reads measurements from it directly and saves them alongside the rest. The Bluetooth permission is used for nothing else — no scanning for beacons, no location inference.

Children

HeartGlance is for adults. The reference ranges it compares against begin at age 20, and the app asks for a date of birth showing you are at least 18. It is not directed at children and we do not knowingly collect anything from them.

Your rights

Because your data is on your device rather than in our hands, most of these are things you can simply do, without asking us:

If you are in the UK, EU, California or anywhere else with a statutory right of access or erasure and you would like it exercised against the two things we do hold — a support email you sent us, and the purchase bookkeeping RevenueCat keeps for us — write to hello@heartglance.app and we will act within 30 days.

Changes

If this policy changes in a way that affects what happens to your data, the app will say so before the change takes effect rather than quietly updating this page. The date at the top always reflects the current version.

Contact

CircleRoll LLC · hello@heartglance.app

HeartGlance is not a medical device. It is a wellness app, and it does not diagnose, treat, cure or prevent any condition. See the terms for what that means in practice.