Support Privacy Terms

Privacy Policy

Aura Migraine Diary · Effective 12 September 2026

The short version

What Aura records, and where it stays

Everything you enter, and only what you enter. Specifically:

• Attacks — when one started and ended, a severity from 1 to 10 where you gave one, where it hurt (the areas you mark on the head map, and the side they add up to), when an aura began and ended if you timed it, which of ten symptoms you had (aura, nausea, vomiting, sensitivity to light, sound or smell, neck pain, dizziness, tingling, difficulty speaking), and anything you typed in the notes.
• Medication — the name and dose of what you took, when you took it, and whether it gave no relief, some, or full relief. These are the words you type; Aura has no drug database and looks nothing up.
• Daily check-ins — hours of sleep, stress from 1 to 5, glasses of water, caffeine units, alcohol units, meals skipped, hours of screen time, cycle phase if you track it, and the day's notes. Every one of them is optional, and a blank is stored as "not recorded" rather than as a zero.
• Your settings — whether you have seen the introduction, which reminders are on and at what time, and whether the free report has been used.

All of it is stored on your device by iOS's own SwiftData, inside an app group shared only with Aura's own widget extension, so that a widget button can log an attack without opening the app. No other app can reach it.

We cannot read any of it. Aura contains no networking code — no HTTP client, no sockets, nothing — so there is no mechanism by which your diary could reach us even if we wanted it.

What Aura does not do

No account, no sign-up, no email address. No analytics, no telemetry, no usage measurement. No advertising and no ad identifiers. No tracking, and no data shared with data brokers or any other third party. No third-party SDKs of any kind — Aura is built only on Apple's own frameworks. No location. No access to Apple Health, Contacts, Photos, the camera or the microphone.

The App Store privacy label for Aura reads Data Not Collected, and that is meant literally. The app ships a privacy manifest declaring no tracking, no tracking domains and no collected data types, and a single required-reason API — reading and writing its own preferences.

Health information

What you record in Aura is health information about you, and in the UK and EU it is a special category of personal data under the GDPR. Because it never leaves your device and we never receive it, we do not process it and are not a controller of it in the sense the GDPR uses. You control it directly: it is on your phone, you can export it, and you can delete all of it from Settings.

Aura is a diary. It is not a medical device, it does not diagnose, and it does not give medical advice or treatment recommendations. Its analysis reports what was recorded alongside what, never what caused what — and it refuses to report even that until it has enough days on both sides of the comparison to stand behind it.

Apple Health

Aura does not use Apple Health. This is worth stating precisely, because a migraine diary is exactly the kind of app people assume does. Aura does not read any HealthKit type, does not write any HealthKit type, never asks for HealthKit permission, and does not carry the HealthKit capability at all. Nothing you record here reaches the Health app, and nothing in the Health app reaches Aura.

It follows that no health data is used for advertising or marketing — there is no advertising in Aura, no advertising identifier, and no data leaving the device to be used for anything. Should Aura ever gain a Health integration, that restriction stays: health data would be used only to fill in your own diary and the figures shown to you, never for advertising or marketing, never shared with a third party, and never sold. This policy would be updated before such a version shipped.

Widgets and the Lock Screen

Aura's widgets do not read your diary. They read a small summary file the app writes into the shared app group, and it holds only: whether an attack is in progress and when it started; the severity of that attack; when your last attack started and ended; how many attacks, attack days and medication days there have been this month; how many of the seven check-in fields you have filled in today; a six-week grid of which days had an attack and the worst severity on each; and how many attacks you have logged in total.

Your notes, your symptoms, your medication names and your cycle phase are not in that file, so no Home Screen or Lock Screen widget can display them.

The Live Activity is the one exception, and you should know about it. While an attack is in progress, Aura can show it on the Lock Screen and in the Dynamic Island, and that display carries the elapsed time, the severity, how many doses you have taken and the name of the most recent medication you recorded. That is visible to anyone who can see your screen, without unlocking it. It ends when you mark the attack as over. If you would rather it never appeared, turn Live Activities off for Aura in Settings › Aura; everything else keeps working.

All of this stays on the device. A Live Activity in Aura is never updated over the network — it has no push token and no server behind it.

The appointment report

The PDF is generated on your device, from your diary, by the app itself. It contains the attacks in the period you chose with their times, durations, severities, sides, symptoms and medications, a summary of aura, pain location and timing, your notes, and the patterns Aura can support.

It is never uploaded. Aura hands the finished file to the iOS share sheet and you decide what happens next — print it, message it, mail it, save it to Files, or nothing at all. Once you send it somewhere, it is governed by whatever you sent it through, not by this policy.

Export and deletion

Export. Settings › Export my diary writes your whole diary as a plain JSON file — every attack, dose and check-in, including your notes — with a legend translating each stored value into the label the app shows. It goes to the share sheet, the same as the report, and nowhere else on its own.

Deletion. Settings › Delete everything removes every attack, dose and check-in from the device. It asks first and it cannot be undone. Deleting the app removes everything, including your settings.

Deleting the app deletes the diary, and there is no copy anywhere else to restore from. Export first if you want to keep the record.

Your subscription

Aura Pro is sold through the App Store. Apple handles the purchase and tells Aura only whether an active subscription exists for the Apple Account on the device — never a name, an email address, or any payment detail, none of which Aura ever sees or stores.

Apple's own handling of that transaction is covered by Apple's privacy policy, not this one. Manage or cancel the subscription in your Apple Account settings.

Apple also reports aggregate, anonymised figures to developers — how many devices installed the app in a country, for instance. Those cannot identify you, and the app plays no part in producing them.

Notifications

If you turn a reminder on, it is scheduled by iOS on your device and delivered by your device. Nothing about it goes through a server, and Aura sends no push notifications — it has no capability to.

There are two, and no others: an evening prompt to fill in the day, and a single nudge if an attack has been left running for eight hours. Permission is asked at the moment you switch a reminder on, never at launch, and declining leaves the rest of the app working normally.

Crash reports

There are two, and neither sends anything anywhere by itself.

Apple's crash reporting. If you have left "Share With App Developers" on in iOS Settings › Privacy & Security › Analytics & Improvements, Apple may send us a crash report containing diagnostic information about the crash — a stack trace, device model and OS version. This is collected by Apple under your consent to Apple, and reaches us through Apple's developer tools. You can turn it off in iOS Settings at any time. It contains no diary content.

The report Aura offers you. If a previous run ended unexpectedly, Aura builds a report from a trail of which screens and actions were used, and offers it to you in Settings. It deliberately records no diary content — screen and action names only, from a fixed vocabulary, never anything you typed. Aura never sends it. You read it, and then you choose whether to share it and with whom, using the iOS share sheet. If you send it to us, we use it only to fix the fault and keep it no longer than that takes.

Device backups

If you back up to iCloud or to a computer, your diary is inside that backup, governed by Apple's terms and your own backup encryption rather than by this policy. That is iOS behaviour and applies to app data generally. It is also the only way your diary survives a lost phone without an export.

Security

Your diary is protected by iOS's own file protection, which encrypts app data at rest while the device is locked. A passcode, and Face ID or Touch ID, is what makes that protection meaningful — an unlocked phone with no passcode protects nothing. Given what this app holds, it is worth having.

Because nothing is transmitted, there is no network channel to intercept and no server to breach.

Your rights

Because we hold nothing about you, there is no account to access, correct or close, and no request to us that would produce your data. The equivalent controls are in the app itself:

• Access and portability — Settings › Export my diary writes your whole diary as a JSON file.
• Correction — open any attack, dose or check-in and edit it.
• Erasure — Settings › Delete everything removes every attack, dose and check-in from the device. It cannot be undone.
• Erasure of everything, including settings — delete the app.

If you are in the EU, the UK, California, or anywhere with comparable law, those rights apply to us too; there is simply nothing held for them to operate on. We do not sell or share personal information, because we do not have any. Write to us if you disagree, and we will answer.

Children

Aura is not directed at children and we knowingly collect nothing from anybody, of any age.

Changes

If this policy changes, the new version replaces this page and the effective date above changes with it; the previous wording stays in the public history of the repository that hosts this page. Because Aura holds no contact details for you, we cannot notify you directly — the current version is always the one at this URL. A change that materially affected how data is handled would be said in the app before it took effect.

Contact

William Scott — williamscott701@gmail.com